Extracted

• • Target

    JaffaCakes118_49b3efccb302b34666813c88d9d95dae

  • Size

    612KB

  • MD5

    49b3efccb302b34666813c88d9d95dae

  • SHA1

    0fd6a780221ef0f620468e512d3beee841f8429e

  • SHA256

    3242e8b156688b8925a6aa109a87844a9879d35425c0197128212ab6324d90ae

  • SHA512

    4b9c692cc40686ca0b224fae128cfba22895bc4f010fbfd40f6dabed7ed0164135141514f5214fe30a48d203ddbdf1cc83ad8ad6dd244ddd14c2a3f0ee5d157f

  • SSDEEP

    12288:XwN8XUsW8uCJjuCn6iQUB8CHPku8TvKNK6KSKF2C1vXRyk5x5PYSvBSc/amlC38e:XdW2spxF91vXRyoIKCUmnYyZ

  Score

  10^/10

  remcosachdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2