Extracted

• • Target

    bb4bf3eb6ca4a9b81bf741b5d85d82127c8b8e716637e7d37450980c28f0178fN.exe

  • Size

    916KB

  • MD5

    7c9117e9ec6db111cf1f67d512b5e800

  • SHA1

    8b88b24bf4893a9c1dff2f79425f4cbea4a79bd5

  • SHA256

    bb4bf3eb6ca4a9b81bf741b5d85d82127c8b8e716637e7d37450980c28f0178f

  • SHA512

    a4cf30a429ebb4f2533538f51ef0314f7993b653a5989bac51d944eb4c163dc16745e858ddc81bbe400bce80f4ee839fb876abacc1dede69b491375fd0767cb2

  • SSDEEP

    24576:bMyqk7d8gE/KTudG5Zl75eJzKo8BYttZ7npS4d:XZ8gE/KSdyT5u+fB6TpSo

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2