Extracted

• • Target

    19ad911891d3976694387b96e312725c1e2aaacd1e5d63651cde29e4feea9ab8N.exe

  • Size

    637KB

  • MD5

    4a95c21701590e49c64e6bea222232e0

  • SHA1

    dc6392bccc4f8acfa2457b7bdd136f6e267f2b42

  • SHA256

    19ad911891d3976694387b96e312725c1e2aaacd1e5d63651cde29e4feea9ab8

  • SHA512

    9754729d7d9da7d873499d96c64f9647918965c30562a6c06d5a51538c66a9bf0e63c8cbec8e6bb927bb0b2a95e1dd7f5cd3e5680c52ca97646ee9d03d71f58b

  • SSDEEP

    12288:tN+qbeco9zUKLorNknrJHbzdOLYyWMkK79EAmD:fvicoRRo4rJHvdIBWMX9

  Score

  10^/10

  remcossuperdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2