Extracted

• • Target

    e744e0aa890a2d9b5e6eed8403cb16f6098baee4a0529b1fabc0644ee4ba6b32.exe

  • Size

    959KB

  • MD5

    b074e2458b987efec69536a58316d5a6

  • SHA1

    ffebefa18462d47fc8b82abc9069c9fdd6079da9

  • SHA256

    e744e0aa890a2d9b5e6eed8403cb16f6098baee4a0529b1fabc0644ee4ba6b32

  • SHA512

    1f76d7ae0558962781b913b765ff6b92b5f03aa511c6be2f206ff17c361052d4b34a37d46e49447a0860586474c3bc656ed34d9d094b605d06a6ebfbcc0a2422

  • SSDEEP

    24576:YQm35eXO2xQ7nEP9FsGu0ftQbg665Xp3GuD+XjK:jej2ynElFsGu0fsgD5XpTqXj

  Score

  10^/10

  remcosdocumentdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2