Extracted

• • Target

    905eb3c354f4f1210442b25983482a2612d6354df9c3d26beb9a0bdaf1e9ac04.exe

  • Size

    1.0MB

  • MD5

    67b86e9595c2d0d2f44454ec239fda56

  • SHA1

    1a44600a7b4e010174d99c152dc20fef1d84061a

  • SHA256

    905eb3c354f4f1210442b25983482a2612d6354df9c3d26beb9a0bdaf1e9ac04

  • SHA512

    73fb542c826f8e75683e7944f0f616d2317d17c5cc153610e7d2107c6da7458da00c89e797aa4f59c92d92095dcf884ef9474cf7ac5dcc4bf526aa8389486604

  • SSDEEP

    24576:BHAXaxESQklIlQcZrVs+3FvrVOuHvKYKrVFmdGp7N1/TBt:BgAlFUrv3FjwuPKYaGK/t

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2