Extracted

• • Target

    shipment scheduled NOV 13-14TH.exe

  • Size

    920KB

  • MD5

    06cf3f0d14bcba73c87f66a821f7f4d4

  • SHA1

    bc56adb6065940a2e08bc43a027d9cfb396f642e

  • SHA256

    80e92b616e6ca40836434deeb64a032a13a2a441653b8fc4af29b075a864d3bc

  • SHA512

    2a97089579b0af02560abaebbc8b56b3c4babd9e85b92f07e2ec7fe4c4a4348bbec5214719484dd4ad8c39667c39a4b8b73596c9f2fc8fa32073862ae126a553

  • SSDEEP

    24576:hMyT7/osm++31jw2kvXvlMOj9k0T+6SXPGaDDm6UH:pT7/Bm+KNw3fvlljmCkuaD

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2