Extracted

• • Target

    JaffaCakes118_d0aea94abf1bcc2a1600864354f1e5ec

  • Size

    990KB

  • MD5

    d0aea94abf1bcc2a1600864354f1e5ec

  • SHA1

    c7986c48e80ecc86882b716e98116552a6d9def3

  • SHA256

    bb0744d4ced4ae37ff0342a47c570a9423e2f1d62f9902be853f40a93bf8fe6b

  • SHA512

    35d70894ba8418391845de195625f23300c3562802fddb67209d33bd91d38a3b3cc25419084500241a15034111bc0e90e250052637348609e6b08b4df0a859bc

  • SSDEEP

    24576:ruvMIpIyF/xykkHeRqaHMurfE/WlBCuPWDEEzpI:rAx5h2CqAMqBBST

  Score

  10^/10

  remcosp'salm 55 2p'sdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2