Extracted

• • Target

    e4200fd701c07fcb6e170a60baddbdeb0963f72232a2d8c2f14f1cd59853c593.exe

  • Size

    988KB

  • MD5

    9bd18661e308a4403cd73d1be9c01571

  • SHA1

    fb26784d90b9c077178a3f9751c6f6ba5db47f7a

  • SHA256

    e4200fd701c07fcb6e170a60baddbdeb0963f72232a2d8c2f14f1cd59853c593

  • SHA512

    a58ca99e578339b5a4831ff044c50c25eb03cd0070eedb2d1d36b99044eb5a704974d916696d306fc603b9a72f5c2dd009a9b53daaa6534f527dc20b409c0096

  • SSDEEP

    12288:nYUvemswecl9evMNbvz1oxE70TvG4baJ8BRw95sCq8OXDFZVVpkkL4A2/I7foIG:uweubv2EgS4WF5sr5/p94A2gz/

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2