Extracted

• • Target

    018292540-SuratTeguranPPI-20230814215304.PDF

  • Size

    2.1MB

  • MD5

    e3d0f03ab192e8872b4f55f1adce1269

  • SHA1

    61546d9f65507e4e3eb880d661a1a4b4f741ac1f

  • SHA256

    19ea9d81975410116f668db902265e8e3c3381655692de707aa1b37ab84484c1

  • SHA512

    91ba2094d5c5c94601e60bf561f67c91872349da9e363e065ff2d65af0f9812b96a3920c3a6cbaf6580cdb676873ddbfa1aa2c7402449985f7a490a8edefd7f5

  • SSDEEP

    24576:I6cblZYtHi+WrePAlb8UNtlD211TLIgXx:I6cblZOC+3PgdKzTLIgh

  Score

  10^/10

  remcoshostdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1