Extracted

• • Target
    Products.pif.exe
  • Size 1.5MB
  • SHA256 73827e53552bac53092a3f937f4c29d060969093cf20d9548836de516f2efede
  • MD5 9ce153849e117145877431ce9e43e110
  • SHA1 4912001b000d5414dcaa0c3a0ef8cda8260ad920
  • SHA512 e98cfcef29555be30ab9770e8d7041768791c65c868095979d7a16be944e6c9b00904f1c29ca6effbdc5f3a714c6006f91879eebc84c6ad238b3cad1b358bd2a
  • SSDEEP 24576:anZcBVKZDQ/LCuqdrihlimb5DXCHVLA+j+09TUgM2yCmsn/TNIQgdUAku0u:2cnmuqdrebDz+y0i985I3dUAN
  • TLSH
    T1197502AC7354E58FC80689318D60FE78A6146D679707D243A9EB3EEF792D947CE040E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  goldhostexecutionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2