Extracted

• • Target

    76c67a9a7f86000d03ecca3a53412616677be7841755bccb6b1b988568b8fa3e.exe

  • Size

    3.7MB

  • MD5

    b153c9fd78a67b3dd7153be08578854b

  • SHA1

    543590bc927b67e643cd2a20926f0633adca896b

  • SHA256

    76c67a9a7f86000d03ecca3a53412616677be7841755bccb6b1b988568b8fa3e

  • SHA512

    3828a518c99f8e7352157689c4f22014bad7c8868a831fd8bf4d875eff3048bd3804e74e8dffb8be4d70ac69a324a5070c8571d4441ec15f334f08f7bc38d4a4

  • SSDEEP

    12288:8EsEqWDSTFM2Txgi4bEcxpzYiwpb5ZaHhhx8FNA+fyXETyTyt8spi6ixg4dW:9qWD0MsgbZp8yzmbA+fJTyTytxpqzk

  Score

  10^/10

  remcosgasplantevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2