Extracted

• • Target

    Confirmation Order.exe

  • Size

    892KB

  • MD5

    3b13b07b05ea3f2084ee3c38080fffe3

  • SHA1

    dde112544004281ad7d02b36c607bc4a258f22a6

  • SHA256

    b93408af1dfa127e3b11d16cd92dab65f448d77fa933259c139bb0f0e6d33a75

  • SHA512

    c09987d78d52fc94bc991b40380b6f5752f1b15139850d24ed93e9ea8ce74add4b4b477493fb8c0a6980de9e14fb511123e2571622c3c5a46f4402f09d037fe0

  • SSDEEP

    12288:5Eqv8RratEshTEMAiqoWpVvfS4D36FUOJT02id9IV/SxjTWAY+acgp8bQbQk:J8OZTEMAifWTvfuL42id94cgGIQ

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2