Extracted

• • Target

    JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e

  • Size

    1.0MB

  • MD5

    e77736cd2247a057638f7010e5ca80e6

  • SHA1

    938ac139fd722f3d7c0ac4c06019c6c794b4048b

  • SHA256

    6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e

  • SHA512

    08416526c24a818ebbf52106422849ae8ff9ab75b6df372e0bb8abe42deb77ed64226cec2b80ce125fe68da63d27e614250a0c78efa73c84ddcbebacfd098a3c

  • SSDEEP

    24576:XbYPbYPbYPbYPbYPbYEEbF5uSPTAaTVxuWcE9i1ZN6/BABT/9:XbubububububsF5tPTAaTVxhcQid6y/9

  Score

  10^/10

  remcos31discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2