Extracted

• • Target

    9c39d381f96fb45ffcb826c90aaee8c6818767eabf44e757fa5518217611d7c7.exe

  • Size

    1.3MB

  • MD5

    8b0f66978d1934eec07b6213c2c8037a

  • SHA1

    a33a467ae0d0ceaefcefaf7a5b6f7670ec1c3062

  • SHA256

    9c39d381f96fb45ffcb826c90aaee8c6818767eabf44e757fa5518217611d7c7

  • SHA512

    16976157ddc43b02cb1d0fc1d621cdc2d64b27b1f0f7e6620fcafdaf52bd77ecf970e051ad1bcc3cb6fa74f9737c127e1af40ad04d86764931cc3b606bfc5fa0

  • SSDEEP

    24576:LaHUIH+zim0CY8iMklskJzNbpYk6B9DNSLAFi02Kyh6qqRztvjnKPXlof6btJ:LaHUIH+g8iMklfhtGkuDqAMfdh6qqttY

  Score

  10^/10

  remcosfeb 16discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2