Extracted

• • Target

    82c624e0eac90e956572497c9fd01879245a3c03b546d2d48eb5ef9e67a3e3f7.exe

  • Size

    1.2MB

  • MD5

    d07ea806e36f7c5194e2383944e7cc42

  • SHA1

    a912d94b2eee9852b8463904b3f748151b775dcd

  • SHA256

    82c624e0eac90e956572497c9fd01879245a3c03b546d2d48eb5ef9e67a3e3f7

  • SHA512

    ea8a56424ad4b8244867a97934fd24532a3f30591dcdffd77a722fa1d216c65efd8c933534ffeeeef1419e1d03af1fc5d15788191693bb248654d9b64c9ca501

  • SSDEEP

    24576:8BOtGnZ12iiD5NNpcqTeNZX0UuZIRC6p4TrR:8B4gZApr6N50UueRC66V

  Score

  10^/10

  remcosgasplantdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2