Remcos RAT is a remote access trojan that a phishing campaign delivers through a password-protected Excel file in fake payment emails. When the user enables macros, a chain of scripts downloads and injects the trojan, which lets attackers control the computer, steal personal information and watch activity. Avoid attachments from unknown senders.
What is the new Remcos RAT phishing campaign?
Morphisec Labs researchers have detected a new phishing campaign that deploys Remcos RAT. The chain of attacks begins when threat actors send targets phishing e-mails that appear to be from a financial institution and contain a malicious attachment related to payment methods (Money Transfer/EFT).
In the e-mail content, the threat actors request the targets to open the Excel file containing recommendations on payment methods. The Excel file is password-protected to avoid detection, and the password is included in the text of the e-mail sent to the destinations.
How does the attack chain run?
The Excel file contains Visual Basic code that runs when a user opens the file and enables macros. The Visual Basic code in question executes a PowerShell command that downloads another .vbs file from a remote server. Then the newly downloaded and executed .vbs file connects back to the C2 server and fetches a hardcoded PowerShell code. This PowerShell code is responsible for downloading and decoding the next phase. In the final stage, Remcos RAT is injected into the target system.
- Phishing e-mailFake payment message with a password-protected Excel file
- Macros enabledThe Visual Basic code in the workbook runs
- PowerShell commandDownloads a .vbs file from a remote server
- Second scriptConnects to the C2 server and fetches hardcoded PowerShell
- Remcos RAT injectedThe trojan is loaded into the target system
What is Remcos and what can it do?
Remcos is a commercial remote access trojan developed by BreakingSecurity. The Remcos trojan allows threat actors to quickly and easily control an infected computer, hijack personal information and monitor the target’s activity. This type of malware uses advanced defense techniques to evade detection. These techniques include disabling and removing security solutions, hiding or encrypting data and scripts.
How can you protect yourself?
In this context, in order not to be the target of similar malware campaigns, it is recommended to disregard e-mail attachments and links from unknown parties, download files/programs from reliable sources, raise awareness of institution/organization personnel about possible social engineering/phishing attacks, and use reliable security solutions. In addition, it is recommended that the IoC findings related to the campaign be blocked from the security solutions in use.