Extracted

• • Target

    aad7bf71a682b4e3b5814d3096cd40b27c194a68a536fb16127f969627ebbf19.exe

  • Size

    972KB

  • MD5

    d62f3667a3442858a997db89c58f4eef

  • SHA1

    dae557169720173b6ce70228670154bd95cae0c3

  • SHA256

    aad7bf71a682b4e3b5814d3096cd40b27c194a68a536fb16127f969627ebbf19

  • SHA512

    c85a29e92edf84235de9891b13b09c000bd948363d5fe1c3eb5af1ffeb35c0b95da7f8a166cec5df83c0e5feb5d7234cc9a8e44c884189b9c34cc8d7daa11bbc

  • SSDEEP

    12288:5umVWXiUJmBCk1sV2tfIUFspQ2zgKZhKV9+xhJJPeWiHD7aqZMJkD:hifJmBPfepFgahKmJejcs

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2