Extracted

• • Target

    c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61.exe

  • Size

    908KB

  • MD5

    1cb86400147c835af58017f0474c5bcc

  • SHA1

    ac285cb623bf292341068dead954cfed9a1f8c81

  • SHA256

    c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61

  • SHA512

    ce74f39d092b13570f9387e5d43ced748dea9557e8887fc072694a2cf448b2c4cf741db3e76d551ebef3511b906ae1cbe0fe670f8968e51d1441982ec73b9b0c

  • SSDEEP

    24576:Nqho7Y33wd4D5N4UmVFruPkMKXbY31qKblvh:y1Hwd4FN4UoFqjKXboTp5

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2