Extracted

• • Target

    ecome.exe

  • Size

    1.1MB

  • MD5

    387a4f5a3791b3467434add8798e156c

  • SHA1

    3eb4d42ca10ca4705bd8e6411e09b31b8f04914e

  • SHA256

    0ccf18985ae70f2004c2ccc11f470b7bbd0884fce623a606a67b2e4e66916791

  • SHA512

    7ad99b695ca917759de3bb75bc1f449f80b6b8d44b081b2036e4824a82847df4990c21862b49c71da79d3d4c3e115bcb3edea8b10e7a445be66dfa8da9cb1eff

  • SSDEEP

    24576:lPSbyKdceodVn4sgUmwzzjKsjOxXVsCdPd+p:JgxebtgIznKaKsCdPsp

  Score

  10^/10

  remcoselvisdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2