Extracted

• • Target

    Bukti-Transfer..pdf.exe

  • Size

    1.3MB

  • MD5

    62bf026c84bdd7358c90d811a884ee9a

  • SHA1

    2c7981b703dcf58b2955395cb1fb7e796de9f1a4

  • SHA256

    18f7d8baabaee1f33165f8be68118400d9ac93393ac2352c53f014f45e623aba

  • SHA512

    9820afd72c7d028e4d9ed953551137c02da23ed3a76b2f94590a233da617abb3392485272529208007d115b4d021b139f40234fa0c66f42a3549d5b2cb65b07a

  • SSDEEP

    24576:IKaHUIr+zim0CY8iMSjRlgAgBVP+z9SukaqDoXaadupi8EU6btt:xaHUIr+g8iMSjRlg1PgfCyuUhL

  Score

  10^/10

  remcosfeb 13discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2