Extracted

• • Target

    249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe

  • Size

    637KB

  • MD5

    b10c024a554e72d81cd2b73fa9221c3c

  • SHA1

    7f0583adc456a1dbae4fafc1831475f844e227a7

  • SHA256

    249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544

  • SHA512

    39ff1f04d7afc319fb5c89891051b621ee25a76adf3171b9212f61f76cfcfcb433187359f6db7ee3141a7722e61884b2edabea929f91c1598813eb08cc998fa7

  • SSDEEP

    12288:tN+qbeco9zUKLorNknrJHbzdOLYyWMkK79EAmD1:fvicoRRo4rJHvdIBWMX9g

  Score

  10^/10

  discoveryexecutionremcossuperrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2