Extracted

• • Target

    ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe

  • Size

    1.2MB

  • MD5

    e2f45f4dad343940e2c06b901b71a864

  • SHA1

    72223201c29be62eabac3f798ced2b8b762d833e

  • SHA256

    ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce

  • SHA512

    b5364557140c5cd4bfab75bd9ce237dd6366d19e2a6a174cc7b432e981f93928540280f251698e0b935af04fde851073b6607f60cc6c90a133aa0e7b8892d98c

  • SSDEEP

    24576:IPMpzxWvSQVw/BSCDyBSvbSFMySqL1fjv4G4uKZ0PU:JWvxiSCWBSzsVL1fktec

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2