Extracted

• • Target

    b58a7d4bb391ebe2243a86ea92641445e98a4da3e51abf3d2c905fb8ac0dd9dd.exe

  • Size

    1.1MB

  • MD5

    1a9f017e35766201caca66b99c8700eb

  • SHA1

    c276dd064641b832dfdf4886267526c827251467

  • SHA256

    b58a7d4bb391ebe2243a86ea92641445e98a4da3e51abf3d2c905fb8ac0dd9dd

  • SHA512

    ebe846e24f247bda738c4c6b31e1328210becc9233262ed25955e3dc627a0a251851add60db743c9eb507fb9c337fc69308e64117313f833da0e921a5f51e734

  • SSDEEP

    24576:tqv1KmEM2KM1NJL09EkhupPKRmtgAV189rYYDk4CvM:4v1KmEXKM1jGhwKstpVy9cYApvM

  Score

  10^/10

  remcoscocohostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2