Extracted

• • Target

    9266e7c60ee4abd1b415a2ca3273d0a9d83547807f610565ca964065fa0aac14.exe

  • Size

    1.0MB

  • MD5

    d781792d361fd943400e62fd653d3e4a

  • SHA1

    37199a0c8450c9a7e8976531fe9183bf5dab4f75

  • SHA256

    9266e7c60ee4abd1b415a2ca3273d0a9d83547807f610565ca964065fa0aac14

  • SHA512

    ea132456b576df8da4aef874e8bb7d77ecabcdf44679437ca7567f5832c096dc1bf31575d4ae37f3236d3313b1b9513de623cbadc85bc531c840dd3729e0acd3

  • SSDEEP

    24576:4GYurNDn2jBroy03+qrgX0Gb1Qvhie97Mq6WULwPXn:4vuEpXCgJQ4sWwPn

  Score

  10^/10

  remcos8846455discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2