Extracted

• • Target

    INVOICE-No96322.pdf.exe

  • Size

    1.4MB

  • MD5

    249c3c371f979d96fe26448702a8b980

  • SHA1

    7d974b6cc1857df402c713b8d6f926b702a3882e

  • SHA256

    d5082cf733716620aa756f1c0cab59246ddab03b8c8ef06cdada69cbaa41593a

  • SHA512

    b052c78486d55697e94213a51f75a824d2c834c246cd7dcca9da3a4747a318f538001d7b899f2a06b2f7b8c2428f0e9f614713af6415ff897b634615d5e8d255

  • SSDEEP

    24576:jaHUId+zim0CY8iM277XXPIDm6bjjmmtyJQYYt2QWfn8qpXrZgrxrW6btnU:jaHUId+g8iM27jfObji9JbUa3BrCJP2

  Score

  10^/10

  remcosfeb 16discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2