Extracted

• • Target

    43cb1f81a50bfc91ff025a0c0ddfc9d9dc14dca28bbf966cd3240162fc1eeb36

  • Size

    852KB

  • MD5

    2aa3e6891a29471057d6757b4ae7be70

  • SHA1

    45e6bd7f8578facc1391877744a5bd18723d5b30

  • SHA256

    43cb1f81a50bfc91ff025a0c0ddfc9d9dc14dca28bbf966cd3240162fc1eeb36

  • SHA512

    299fb4ba25b370d3abe017f773ee0c30a98d78d9b87078baa83a04aefc1b6b390876e2cf16f5eda4a2ed378d394d685dbcde2057d4d0f7e15d886f78ffe9bd4f

  • SSDEEP

    24576:c7bmguo9DkXFCkTqVrkFlfEbNzDe6Vryr:kb+8DIhp8NRyr

  Score

  10^/10

  remcossep 26discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2