Extracted

• • Target

    deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded.exe

  • Size

    1.1MB

  • MD5

    08ac08e7223680fbe534d31ae219e649

  • SHA1

    7d003910e435153f65c2726f8d3fe2669606fcbf

  • SHA256

    deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded

  • SHA512

    75b30cb6b060cd39b3bb4e8b16f8735a11eb1b577807fd574e84b11a39a34fe82ee819fbc9307b9b19e3d14f8ce609036e99b315fe89319befb39b023d3b3b7f

  • SSDEEP

    24576:BPd+pxd29086WHK9M9yBj2ESIMkM6ZI6d:BPspx4bFHhENMkM6G

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2