### Overview
Following the execution of the Total Commander RAT, we conducted a forensic analysis to understand its operation within the compromised systems.

### Execution Details
- **Initial Payload:** The RAT was executed via a malicious macro embedded in the PDF from the phishing email.
- **Execution Path:** The initial payload created a scheduled task to ensure the RAT's persistence.

### Capabilities
- **Remote Access:** The RAT allows attackers to remotely control the compromised system.
- **Credential Harvesting:** It includes modules for capturing user credentials.

### Recommendations
- **Endpoint Protection:** Deploy robust endpoint detection and response solutions to identify and mitigate RAT activity.
- **Macro Restrictions:** Consider disabling macros by default in office documents.