Extracted

• • Target
    NEWRFQRef.2025503-Qty-300PC.exe
  • Size 962KB
  • SHA256 f75c114f83d3d078bd85e7e59cd8a4ed6e8be4a33db6600bd9eda842845ac2fe
  • MD5 408fde232dc513fa00fc6f0033cfe6bb
  • SHA1 16ddf518f76de5e42e7c21c0ea208c3a7fb26cc0
  • SHA512 f54aea19d6ee89786dadb62ad2d58a080ab351e0c5e28e58de72492f425f958cb2a207ee812498f02e5a58fd4534ca16aa9ffe0ab7eda378c1e021af4a7a3eec
  • SSDEEP 24576:rNQ4Dh4Tci++bXmtW5khObCXEEo9A46zAIQfJJZyOh1/0b5z1I5H0:r9DYsOXmaojXE79Ar8PJXyOv/SO5H0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1