Extracted

• • Target

    935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe

  • Size

    944KB

  • MD5

    b8d56a76c20f7112dad67dcf0ed7db76

  • SHA1

    de67506c08d6fef79fff815e27cda68403980fc9

  • SHA256

    935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea

  • SHA512

    8211cd38a129df696ce6b5909990095c1762db549ca6c3781027c9394bb835812401237c669cdb72acb9941cf068fea1935719817bbe752a5a7df772293075ec

  • SSDEEP

    12288:snC0mUwAF27PpvOvGrAl+5tbmzaCKqk0eua+ANHNAtFDQEa5g3M5JQCjXPpXylhd:KmUXFYpRrZ55jCKq/etMeDgc5PjN6cE

  Score

  10^/10

  remcosmekusdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2