Extracted

• • Target
    b32da4c31255e2f5dcf961e35e1757aca22f0c39cf80b3fac1d2a8aa734ae167.exe
  • Size 1.0MB
  • SHA256 b32da4c31255e2f5dcf961e35e1757aca22f0c39cf80b3fac1d2a8aa734ae167
  • MD5 c782c47798d131d9bcdde8d04b48ec4d
  • SHA1 fa46f037e61ba618317d5a43d790906ccacc7195
  • SHA512 9c4db1db2a529f0990dd90160ab0874e9f8de993cb3fe93f5640492371cef3fc8aef82f861b66daa122c22c612827eb0efdbf0d3ecf7ab6897ecfc60886a5cbe
  • SSDEEP 24576:cx40ZLVqmBmhxSr79IWbNXrFY7tsAKZNQHCiz+Z5Jdog:cxvZxq2m+r79hZFesAKrQHBGDdT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2