Extracted

• • Target

    Quotationpdf.exe

  • Size

    869KB

  • MD5

    27934061e8cbcfcf5e5b8937a662c26f

  • SHA1

    a508513b842e11c7c277af67e4bc51466d0637b8

  • SHA256

    49e7ee12a475105efab2e363450b2e5582fc05d114967fe57a3d80d22a2fea81

  • SHA512

    c79374546867ae8197d6fdbec40150b7124e272151e73c2a7361dd96a04b3a5f710d42f82b0d77349a07ae667aee066b11c949782eb2f2329e3711752e2c95d2

  • SSDEEP

    24576:q0jXiRZoEJGywbvjCe9WRSKObmSej7vydBs:MDIvjCe4ebmSejzf

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2