Extracted

• • Target

    eb4172617d34c01a45390b880499b0c1eef52a466852241e5a2db92b660a5f41N

  • Size

    2.5MB

  • MD5

    1627304a7d3f6859001efebde8c08220

  • SHA1

    99d184f60f258ffaf6b64dc87e1c13b70d227009

  • SHA256

    eb4172617d34c01a45390b880499b0c1eef52a466852241e5a2db92b660a5f41

  • SHA512

    59704afd589bd797a07296a00639f8244d9bc7bcd071e6a0368aebb309cb8a6c3a270ed2e966945c5dc36819c61394dda204338cb2e814d770a502ab92aa6355

  • SSDEEP

    24576:4u14cbiD+YsyBvUmrUeZ4nXksgBMVqYyFU:4udiD8mgemnXksgBMV0C

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2