Extracted

• • Target

    OrderBJ 02 - JUNMA016118313306,pdf.exe

  • Size

    3.4MB

  • MD5

    2a3fffe85434fb8cc6a49f3778fc018e

  • SHA1

    fc02539e02aeead5dcb46748c8ba92972b2ebbe4

  • SHA256

    a62483d750894703fef38a93f05ed625a25aba89fe80f79318d1193b39cdc198

  • SHA512

    89e8dda82c126f4a5b05c40bcd7cbbbd961c03822aaf4cef09d8a66b02973bb8d0340ffee64ed4aeb18b113cdf4f1aba7464dd290d02edadbd94dea3408496f0

  • SSDEEP

    12288:bezvK8hN5Ei531csIOMRn0ubNDLGgzfRRig8Bl7b76bwpXdcHe+8RpqZUJ9AR:bGS8hwi5RIN0ubJSgOPlUz8RIs9AR

  Score

  10^/10

  remcoswegoodcollectiondiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2