Extracted

• • Target

    ac56ec5a81bca833585ad1c052dc5614936523763c87ade64f519b23a4f0b24a.exe

  • Size

    854KB

  • MD5

    a0602bf02ae7766b58bffd108f148b7b

  • SHA1

    65b1ea618e93e70049d395401352fa06c85ffa38

  • SHA256

    ac56ec5a81bca833585ad1c052dc5614936523763c87ade64f519b23a4f0b24a

  • SHA512

    27a6ef4322db17ab64acc78b946f14400cda55b1e800d674dd3a47fe89521e227d31f41df00ada3336c82a34bf1b023a2710aa9b4836ea64877c0d866accb00c

  • SSDEEP

    12288:DvUSmi/ScuxtPoeptfKh74Us0kJMxghMDXP4Faaxttoeq8:DXmi/SLxtJnyE0cMxrLEawtKet

  Score

  10^/10

  remcos8846455discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2