Extracted

• • Target

    c0b8ab0ce70e5ef60f0e3a39efb2a33b2ca93d7c129a08fd05323575fb4a3dad.exe

  • Size

    936KB

  • MD5

    30586cbe469e9512308408268d1cf7cf

  • SHA1

    4fbe66e2ac6e47a813d2b16f0323abf899ce0425

  • SHA256

    c0b8ab0ce70e5ef60f0e3a39efb2a33b2ca93d7c129a08fd05323575fb4a3dad

  • SHA512

    2c441b4c527f97e16ea3135e5715f3efa347a1214aa1d036cfa04cdce757dfa05823acb19c8f9d80b76858410ea05916cfa030d5bc48b5cae61d3a33e52ee066

  • SSDEEP

    24576:cxoL0xHuCPEHka3tAZoZV/MXllDDYbb23IYJI:cxoLjCL+uZGV1XY

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2