Extracted

• • Target

    BankFundTransfer-589237.scr.exe

  • Size

    1.2MB

  • MD5

    552044ce92b78bf4b68d242c2c380afe

  • SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

  • SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

  • SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • SSDEEP

    24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2