Extracted

• • Target

    932c8687387b5fa94ef7b5c11358b0d0dc90ea488729382e09ec126d61457d6d.exe

  • Size

    879KB

  • MD5

    1d818c67cd7b934a84588a3207b2e50a

  • SHA1

    f143719dafea314eb6ae638e9a7694da54c3a445

  • SHA256

    932c8687387b5fa94ef7b5c11358b0d0dc90ea488729382e09ec126d61457d6d

  • SHA512

    41e68271ed5c52427c1e9953bc3ac9c0562541a186a6a44712602dd88968fdd2d896f3c56dccc39dac512c9885e0eb9c194d26f148ce484418b001d1bf60401e

  • SSDEEP

    24576:Ovd+fC6BjsHpE+dOj+18tyAgajKCzMlTyFjSIi0/:O1+a6NsHp3MlhOGM1mO0/

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2