Extracted

• • Target

    402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

  • Size

    1.2MB

  • MD5

    08b5fa6876e0dc8d5c226597d89e646b

  • SHA1

    4b5f7b0dd2303c81427f9ab47ff9046c43718552

  • SHA256

    402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361

  • SHA512

    4f20a03dbcb5e16c4e934e67455eb48bf7bd9681b5fdc731bf278409c78e698527ee125ac2ed0e3f09bc1551a2684e16ba3e34613da9a1eb32bca781b85ea48c

  • SSDEEP

    24576:IPMpzxWvSQVw/BSCDyBSvbSFMySqL1fjv4G4uKZ0PU:JWvxiSCWBSzsVL1fktec

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2