Extracted

• • Target

    DHL AWB# 13700658 DOCS.exe

  • Size

    1.0MB

  • MD5

    4f7f4be9f7d4dce08243c683cde82441

  • SHA1

    05ae46d21d6ace8e5c6202d1721f429b9077a6fc

  • SHA256

    d82420c6174978cbfa6a7ece576ad2e5e3bc66324126298e46f5b1845b6a11b3

  • SHA512

    ecb7848144cf58974e089f0ea12d2a37ccf425f0e028407cfdcc9e160af5c574d699e7bf19b3442f890e9635fd400d7ae077d4acac092b306984de024c339d3f

  • SSDEEP

    24576:HrycfLAsNBbi6oRqh/Jlmi4oHU1Ca5YkC:HjfLAsNo62EhoC+YkC

  Score

  10^/10

  remcos54436discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2