# MA-967.092023: MyCERT Alert - Malicious PDF File Attached in a Fradulent Banking Email

**Date:** 03 Sep 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-967.092023  
**Advisory ID:** MA-967.092023

---

**1.0 Introduction**
MyCERT identified a fraudulent email purportedly from Maybank sent to potential victims.
The fraudulent email works by luring the victim into believing that a certain amount of payment has been credited to the victim’s account. Proof of payment in the form of a PDF file purportedly the receipt of the payment transaction is attached to the email.
Upon our analysis, the PDF file is malicious, containing the Remcos (short for Remote Control and Surveillance) Remote Access Trojan (RAT) that can trick users into running a malicious code without any warnings and notifications.
Remcos RAT was originally designed as a professional tool to remotely control and monitor any Windows computer ranging from XP onwards. However, it is now widely weaponised by threat actors in multiple malicious campaigns using social engineering techniques by leveraging worldwide trends.
The inexperienced and untrained victim on security awareness would believe the fraudulent email and click on the PDF file attached to the email, without verifying the email and file.
**2.0 Impact**
- Identity theft as confidential details of victims are stolen from victims’ computers
- Victims’ confidential details could  be used for other malicious activities
- Any information about victims’ computers may have been stolen
- The infected computers may be susceptible to further attacks
**3.0 Indicators of Compromise (IoCs)**
3.1 The malicious **PDF file** attached to the fraudulent email is: Salinan\_Pembayaran\_\_Maybank\_Pdf.7z
The malicious PDF file includes an executable for the REMCOS RAT dropper. Once clicked the file, the malicious code will execute the Remcos RAT onto the victim’s computer. The Remcos RAT then gives the threat actor full control over the infected system and gathers the following information and sends it to a C&C server:
- Computer Information (OS version, computer name, system type, product name, primary adapter)
- User information (user access, user profile, user name, user domain)
- Processor information (processor revision number, processor level, processor identifier, processor architecture)
The below figure shows the flow of the infection beginning with a victim receiving a fraudulent email with the malicious PDF file until the attacker gets control of the victim’s computer.
Figure 1: Remcos RAT Infection Flow Diagram
Below is the sample email used as the vector and sent to victims.
Figure 2: Sample of fraudulent email received by victims with the malicious PDF file
3.2 Below are the **hashes** associated with the malicious PDF file.
Table 1: List of hash
|  | --- | --- | **Hash** | **Type** | 6371748fd9ab34bdb247c547d6a0b7af | MD5 | be4b9a465a1a06fc0381a356d8434d2776c9446e | SHA-1 | 98dcf3f3ed2ec4d0c9892e8e75e3b2214330635e5d1f6a34c01cc8843dff3f4d | SHA-256 | f69b6408bb756faa87513d599e6080a8 | Vhash | 12288:LvA6vH7e20RNq0tnLxNWLQ9hILNAyXCfnGzxXSCHeWR9q+vlm7nicKd6GqRR:L/filRR1kMLygGzxiCHeWR79m7niJUGI | SSDEEP | T114F43385A1181D5DFBD2EF2115B81CD50633993C0E6A7937F8C0BB68B8BE7B580789C6 | TLSH |
**4.0 Recommendations**
Below are guidelines and best practices for protection against successful Remcos infection:
- Do not open or download or save any document file received via suspicious or unexpected email or messages over the Internet. Recognise the increased risk that files of unknown origin present and verify the context of such documents thoroughly before opening them
- Users must be always vigilant of such emails and refrain from responding to them.
- Ensure Office applications are configured with *Disable all macros without notification or Disable all except digitally signed macros settings*
- Make sure the PDF application and is up to date and use the latest patch. In general, make sure your computer is up-to-date with the latest patches.
- Contact BNM and the banks for clarification and verification of suspicious or unexpected banking emails.
- Forward the phishing email, the full email header of the email or any suspicious files associated with the email to [[email protected]](/cdn-cgi/l/email-protection)  for our further analysis of the incident.
- Ignore and never respond to any suspicious emails.
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US&sfdcIFrameOrigin=null>
2. <https://www.malwarebytes.com/blog/detections/trojan-remcos>
3. <https://www.bitdefender.com/blog/hotforsecurity/attackers-try-to-deploy-remcos-malware-with-covid-19-
4. <https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/remcos>