Extracted

• • Target

    6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe

  • Size

    972KB

  • MD5

    a035a6cfbe07dadcd1a4f89cc77d99b0

  • SHA1

    ab53ba007f55daefb7dbf7d82fa135fe3046a208

  • SHA256

    6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973

  • SHA512

    d03baddf8283857fa4bd61cb3b279413761143605a9bc2a26e7303ac9cf125cff5d2c263ca97e30e79928c839d5ad617bb2328f615d445ad81d05771e49a010b

  • SSDEEP

    12288:5umVWXiUJmBCk1sV2tfIUFspQ2zgKZhKV9+xhJJPeWiHD7aqZMJkR:hifJmBPfepFgahKmJejcU

  Score

  10^/10

  discoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2