Extracted

• • Target

    c28afe52e15d615ba4564d0223dba716.exe

  • Size

    948KB

  • MD5

    c28afe52e15d615ba4564d0223dba716

  • SHA1

    d92a8a3d96e130eda394f74583dd67941de22c04

  • SHA256

    36ed24fd100db4ab36461303fcadf2101c391f95e635fb33f0fa396204e642ab

  • SHA512

    63b17395d174d1959ec7d52e5b87b736890be4d77669311e8e734a4feb9d01e025228b4def13841a11f295809f28101c2ac402ebdc5ca4bfbc4ab1bd900ca428

  • SSDEEP

    24576:58kh5oDiJiFYu7nK4o7bpcF6b0xV5+rVfWnKG:5v5oDigFzVofpcF6b0xehkKG

  Score

  10^/10

  remcosm33rmcodiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2