Extracted

• • Target

    f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b

  • Size

    908KB

  • MD5

    0a91b0a960e1cb925434f0ded97e30b7

  • SHA1

    ea0ed432c0cdb5f86cde1b17850a77b68ad71af4

  • SHA256

    f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b

  • SHA512

    37d4fbd29f3a5b274545f4864f9005b814410e35abc94c106e433ecd5c403a230eb2ca38d1d20aaa1f29ad0fbef5997c0c0cae37c2237b165e2eb5778dd2f7e4

  • SSDEEP

    24576:Mo7x/alQteiW/C+sHTTPrCehcxQv4Zj6CSy:Mc/zhWK+vC4ZIy

  Score

  10^/10

  discoveryexecutionremcosremotehostpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2