Extracted

• • Target

    700abeeb6388de45b2e0c175f6de719df739b14cfd0500f3fce94e95d0a9f127.exe

  • Size

    908KB

  • MD5

    101a0df83daf8836f9bf996d72c4c6a9

  • SHA1

    c778e9a0ff2dab0404cf84ac4db2139aa4d2b000

  • SHA256

    700abeeb6388de45b2e0c175f6de719df739b14cfd0500f3fce94e95d0a9f127

  • SHA512

    2e6d4de5edfb066c81e08a6d04f82b09c44f520898d8328230b172dafda2197dc509dd6a58e0a345ffc74d403e9a7ff949e1ae2d20ac9f6152c41bf8bee60661

  • SSDEEP

    24576:ZlDEOmXZLjtSvwE8hm3vVp7QbsKswxPSIk:kOUZLjAbh3vVNWRswI

  Score

  10^/10

  remcosmekusdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2