Extracted

• • Target

    be5fbed126be0685414464f8d18c42027cbb09c884640c35e2420f96c0d254df.exe

  • Size

    1.0MB

  • MD5

    065a6053492ecc989755413d4b9cffea

  • SHA1

    9955cde6556837bc877e596c5b206df39d060a00

  • SHA256

    be5fbed126be0685414464f8d18c42027cbb09c884640c35e2420f96c0d254df

  • SHA512

    1185623940e192747b0c794c3e63c56ad6f941dca6cccf5db2cbf57ccf3cca6b3ba49aa9922dfde87c82b69920c48222c249b70e13915e542dfb6e11072c9588

  • SSDEEP

    24576:60u2uOCjadxmISCQDJ8wovaxTFfJDe4Pu2:6euCfLQ5xTFd5

  Score

  10^/10

  remcoselvisdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2