Extracted

• • Target

    10ab4b6fb83aea3840ac04855974f62d.exe

  • Size

    959KB

  • MD5

    10ab4b6fb83aea3840ac04855974f62d

  • SHA1

    c41572120bb8f298d4a8683321e7a3b1cc7c54da

  • SHA256

    8c62537b7b875c364a79b98adaa8d341b4a52e4d0a27697f0f07b1209ed53301

  • SHA512

    d414499348356d4028c97718126dbc51aa240a63b70f3236d73003821910735bcef0761da0a873b55abfb18b71820fcd6bf4e58bac98109274c477cc68633d94

  • SSDEEP

    24576:TuWl35eXIVicKGaiT+zuOiNPjdbdpcg4qCYi:BnXicKE6zuOiNPjdZ4qCYi

  Score

  10^/10

  discoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2