Extracted

• • Target

    c3698a5047a0c4d938f5f64c12b72aa6f2571947e0216fe13652cb2fb26d80f2N.exe

  • Size

    1.1MB

  • MD5

    991d6659f0bbe3f8211229f64760c700

  • SHA1

    bf8adf636855ec9c4fb6081a14063db204ef6d11

  • SHA256

    c3698a5047a0c4d938f5f64c12b72aa6f2571947e0216fe13652cb2fb26d80f2

  • SHA512

    bd759b62b781ed687d6095fb37d2d461b0d04d9cdbb88641b7c4e963afeefb9dbc1dccaefdab4d95fbb9b602042769b7e5d619108ac5465e4808c8f85180d784

  • SSDEEP

    24576:XTbM8vhEjkGD+JV9SQTOk/t1nkNzE681ZWsx:+lKJjn1tZkyRbj

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2