Extracted

• • Target

    24777f80f39fba9da6a66bb0804bd3c3a510126f583eefb8918e24fa5fdeb69b.exe

  • Size

    972KB

  • MD5

    bed1442a4f50a01ca78baffd48313104

  • SHA1

    4920449ae36ec9f4954a60291793639a7f53223e

  • SHA256

    24777f80f39fba9da6a66bb0804bd3c3a510126f583eefb8918e24fa5fdeb69b

  • SHA512

    1435099aad068a175b61b3e9333263656eea61ca5f541c836aa780b7b6072bc681db815638f354c2b0fa3e1411756c0c7038f55990ac8eeabb4b1d1a354c16f4

  • SSDEEP

    12288:bnE1cUoV+I4MVKWb0GbmEI3PZbOrYQ3EFHOIj03GtW1wOejvgwb372hFeABqzgXB:bnEuRgoefMsEEFHOmSasSz8qaD

  Score

  10^/10

  remcos06wire2025discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2