Extracted

• • Target

    abdcdab6bbb236063e2e8eeba4c42a18fca87491dd340c90cba6c40c85db4adeN.exe

  • Size

    964KB

  • MD5

    ceb204ea34f5fb871c3d6cb84d6412a0

  • SHA1

    705a6497dfbd6b8b35c0a5dc0d0170f29d1e90d9

  • SHA256

    abdcdab6bbb236063e2e8eeba4c42a18fca87491dd340c90cba6c40c85db4ade

  • SHA512

    cadba3cfa0282953cc729f62cc391d27efd77845b475ca9bf5dad905aa07e89b29bcdf098a85e34b0475871d019b8385b576a022d568f3ef70a05a14c42887e4

  • SSDEEP

    12288:1Cb+eCSmSykDxVpYxfkC/ORUTzNV8y1A3P2quSfIIsVSV2aOoJhqE2gytJXrkR:MCoBxVWx9ORmzAu0PVAfE2gytJXu

  Score

  10^/10

  discoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2