Extracted

• • Target

    b254541038b979c1c21f489e21bc15f594492aff656bc908aa54033bafb05775.exe

  • Size

    1.0MB

  • MD5

    ec5a7a616e71dd9eaa5453a172a2c952

  • SHA1

    77c2abbfee86dc74dab6b7a13e7d0e3cd1589dec

  • SHA256

    b254541038b979c1c21f489e21bc15f594492aff656bc908aa54033bafb05775

  • SHA512

    7192ba6bc1353ad5ec5c1b6a19b7e7402cb36fc11e377fd23859c24a9ee28a6767138a726d630b5d201f4dc202a6d02cb1e18845115d7e83eae7808977e3fb9a

  • SSDEEP

    24576:k+wIZTEg2BKLobjEmOTWcN0QCgqYmt9yX8THRr1OBQeb:k+wIZTPBkEWeCgZmt3p1OBzb

  Score

  10^/10

  remcosfeb 09discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2