Extracted

• • Target

    c6a06ff2641493643fcd905be87713ffa41ce03823a6bf6ac4b6dc2071c2ed06.exe

  • Size

    916KB

  • MD5

    68f40766e94fc1af54416d9a70dac75d

  • SHA1

    59392802094efcea3c633bff647bb827518fa75d

  • SHA256

    c6a06ff2641493643fcd905be87713ffa41ce03823a6bf6ac4b6dc2071c2ed06

  • SHA512

    95c0916a00921fdb308c83d5a873b1a6ea6a4e86aa852102f8c707da7738623629d44fffafe325356bc7b6cfcbadd1dceaa3dd3ff38fe6baf3ec0d4c05c0e16e

  • SSDEEP

    24576:bMyqk7d8gE/KTudG5Zl75eJzKo8BYttZ7npS4dO:XZ8gE/KSdyT5u+fB6TpSoO

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2