Extracted

• • Target

    New Order 20242405.exe

  • Size

    1006KB

  • MD5

    a7a06e3b861b20e1969209a06cf79645

  • SHA1

    690925d642a8ab2c465590f473008dbe81190c14

  • SHA256

    ab8953a3cb88e1a5f5416f535c8857eba7062a741a527f7fed5274802d90d4f7

  • SHA512

    0fb13ffa94afca55aaca1283f010910ef0f38497c123c88fa6e31107c6c4560af2aaf84690b62a5bd294541fa2b41e975bc3c648aa20624c779ff477434c2689

  • SSDEEP

    24576:xNF5a247iDhR+WYig4d5bUU9iTO0LNtG5:xNF1hRzg4d5Y55XQ

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2