Extracted

• • Target

    b4ea9fc8891fce7e255d583efa962256b0dee44df2de28f0e4d4ae8145f0ca5a.exe

  • Size

    926KB

  • MD5

    4d6e7990958750655c63899f3b4e96aa

  • SHA1

    f4113dd8af0bc21a471273d17f4572f6d23782eb

  • SHA256

    b4ea9fc8891fce7e255d583efa962256b0dee44df2de28f0e4d4ae8145f0ca5a

  • SHA512

    b16b32d1076112835c6ade4b40b76cf98d851ae066c0f4b9d2054ce8c8208cc03a7fa0f3d59234d690fb37deb4775fd8f306eacd92c69df49d18c8b2331870e1

  • SSDEEP

    24576:gduE/JmHlhNBv7XVWJp75vbl+JtiS6AMX+:g0E/JqNZZWJp9bl+96AMO

  Score

  10^/10

  remcoszynovadiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2