Extracted

• • Target

    PaymentTransferRequestForm.bat.exe

  • Size

    1.2MB

  • MD5

    fc5a80adf45d78ffa834283d0a78f9f6

  • SHA1

    6865dec6f71546ea01420295b7175038c3a81ec4

  • SHA256

    e588a098e9ceb33f2616e11a3faf28162e5f4b7f3800b22ab3023bc376aeb18c

  • SHA512

    27636cd0d31e3b1ff384869f1f2be6c23d7f02ecd70027c5d689de0893835d070218596a941472481d637cc6253ed3f2405991a6af4772596cc88f909a7dd7cb

  • SSDEEP

    24576:RYdgfvzAKzxWCC9vSA6GRdsttHVqowvVpBdlvlOUa:rzAcWFt96ydyQow5dldna

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2