Extracted

• • Target

    e54d75beb808253cbb5c06bbe37211b9a7467c39dac776ea72df26be3b30f5ea.exe

  • Size

    1011KB

  • MD5

    cbe2a525a70f1ae12ed19db3d2ce8a9a

  • SHA1

    c9ebbc22c4c793bd7ab2651b997aea1fb6651715

  • SHA256

    e54d75beb808253cbb5c06bbe37211b9a7467c39dac776ea72df26be3b30f5ea

  • SHA512

    2b77c70e595b2237409769d99b7c3448f70853780fd865d7eb721d421d9cabc007fdd7a2e0ee7b401fea5951230bee848bb33d2c2aa0ffaee84ef3cae8bc7fd1

  • SSDEEP

    24576:e4Z8z1TQIYt/R6Zg2k85kP0vv4EvfiYPgPTatiI1LHx:e4SzmIoKNCPoZntPgPTatiIlx

  Score

  10^/10

  discoveryexecutionremcosnewtesthostratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2