Extracted

• • Target

    f4da65fff4d9b2420e2375ce736d02b0dab3e4776115346c5219891ea8fc3c97.exe

  • Size

    973KB

  • MD5

    ecad35aa0a2834edde088dba8063486d

  • SHA1

    f09ff2154b1542326d63c1eae67a1db0d5dd3571

  • SHA256

    f4da65fff4d9b2420e2375ce736d02b0dab3e4776115346c5219891ea8fc3c97

  • SHA512

    0aea41973d5ec10e93d423985ef5a4376c43efe8eaf3b9bc353decddb62339b1f1d9e962eafa53809a75a5e2be43fdfb432f81a5a9556cdb826a440e7f33174e

  • SSDEEP

    24576:EReyAYaI69Kl3u2FRFhlF4guHGTpSD4wHCKywRmOD:EReyAk3uGTvluupQ4wHChnc

  Score

  10^/10

  remcosremdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2