Extracted

• • Target

    4304f60f1efdc44fb82e632d7d6a15a62c8583aab914da08ec73b8bc709a209b.exe

  • Size

    938KB

  • MD5

    041848dfe86c9d7e4f84a3b4bf065075

  • SHA1

    33ae188d83c9bdcfc1e7c37604011161564d1ad3

  • SHA256

    4304f60f1efdc44fb82e632d7d6a15a62c8583aab914da08ec73b8bc709a209b

  • SHA512

    723086e68480c295cbdd57aeda44785f83cca40ef43a166a427135d3b7969fdbfc184a975a4da20b6bc66833f168477b13a50306f66ac5dcdbe95998514f6648

  • SSDEEP

    24576:OiwEHfhzre4gZVF4tspROMsDInpvmMB/pAzDbY:/7SF4toYFqUDU

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2