Lmst

Remcos RAT Delivered via MSHTA and PowerShell in Fileless Malware Campaign

Hashes (SHA256) are commonly used to identify people who are at risk of falling into a relationship with a different party or organisation. and their potential impact on their respective social status is revealed.

Pulse ID: 6840214f09754e0950515733
Pulse Link: https://otx.alienvault.com/pulse/6840214f09754e0950515733
Pulse Author: cryptocti
Created: 2025-06-04 10:34:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #RAT #Remcos #RemcosRAT #bot #cryptocti

⚠️ Watch out for ZIP and shortcut files on #Windows as attackers are using fake PDF icons to trick users into installing #Remcos trojan and take over computers.

Read: https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/

#CyberSecurity #Windows #Malware #RemcosRAT

#MalspamMonday

Malspam Monday is when I check the inboxes of my honey pot accounts for anything interesting distributed through email.

Today, I found an example of #GuLoader for #Remcos #RAT

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-24-GuLoader-for-Remcos-RAT.txt

#RemcosRAT #malspam

Screenshot of the email with the malicious attachment containing GuLoader for Remcos RAT

Traffic from the infection by GuLoader for Remcos RAT filtered in Wireshark. The Remcos RAT C2 server for HTTPS traffic over TCP port 9090 uses a self-signed certficate.

Social media post I wrote about #RemcosRAT for my employer at https://www.linkedin.com/posts/unit42_remcos-rat-keylogger-activity-7304958245322768385-tu-a/ and https://x.com/malware_traffic/status/1899207006939947440

2025-03-10 (Monday): #Remcos #RAT activity. Email distribution used a zip archive attachment with a .7z file extension. During a test infection, we saw indicators of a #Keylogger and a Hacking tool to view browser passwords.

More info at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-10-IOCs-for-Remcos-RAT-activity.txt

A #pcap of the infection traffic and the associated #malware files are available at https://malware-traffic-analysis.net/2025/03/10/index.html

Screenshot of the email distributing Remcos RAT, focusing on the attached archive and its contents.

Traffic from the Remcos RAT infection filtered in Wireshark. It show information about the infected Windows host, and it also shows a Windows EXE sent over the C2 traffic. The Windows EXE is a hacker tool to view browser passwords.

Location of a text file for an offline keylogger. The image shows the beginning of the contents of this keylogger data file.

$This infection was persistent through copies of the initial malware saved to the AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup directory. This image also shows a Windows Registry update caused by the Remcos RAT infection.$

🚨 Attenzione: Campagna Malware #RemcosRAT in Italia 🚨
#Malware #Italy #mwitalymia "Fattura Energia" distribuiscono il trojan #Remcos RAT 🐁

⚠️ IoC:
- MD5 66e9e95985918197cabcedecef2d981d
- C2: 5nd42h78s.]duckdns.]org

#Malware #Italy #mwitaly

Los #hackers están usando el #exploit de #Excel para propagar el #malware #RemcosRAT sin archivos
https://blogs.masterhacks.net/noticias/hacking-y-ciberdelitos/hackers-usan-el-exploit-de-excel-para-propagar-el-malware-remcos-rat-sin-archivos/

Cybersecurity researchers have discovered a new phishing campaign that spreads a new fileless variant of known commercial malware called #RemcosRAT. #malware #phishing #CyberSecurity https://thehackernews.com/2024/11/cybercriminals-use-excel-exploit-to.html

Campagne #Malware #Italy Week 34

🔥☠️💣👻
#VIPKeylogger: Fattura
#RemcosRAT: Delivery
#Formbook: Preventivo
#Irata: #APK Bank
#Adwind: Fattura
#SnakeKeylogger: Pagamento
#AgentTesla: Bank
#QuasarRAT: Udienza Centrale Polizia
#Vidar: Pagamento via PEC
#Unknown: Telecom

#mwitaly

Campagne #Malware #Italy Week 33

🔥☠️💣👻
#RemcosRAT: Errore Pagamento
#AgentTesla: Formulario bancario
#QuasarRAT: Fattura Entrate Governative
#Guloader: Ordine d'Acquisto
#XWorm: Proposta Contratto
#SnakKeylogger: Quote

#mwitaly

Campagne #Malware #Italy Week 32
🔥☠️💣👻

#SnakeKeyLogger: Citazione
#Guloader: Ordine
#Formbook: Modulo bancario
#AsyncRAT: Documento
#RemcosRAT: Prezzi
#AgentTesla: Preventivo
#ModiLoader: Pagamento
#StrRat: Ordine
#RedLine: Quotazione
#Vidar: Pagamento
#Ousaban: Documento

#mwitaly

Campagne #Malware #Italy Week 31

👻🔥💣☠️
#SmokeLoader: Preventivo
#RemcosRAT: Pagamento Bancario
#AgentTesla: Etratto Conto
#Formbook: Ordine
#AsyncRAT: Fattura
#StrRAT: Delivery
#SpyNote - #BingoMod: Malware APK

#mwitaly

Found this user on the @internetarchive hosting images with embedded base64 encoded #malware between <<BASE64_START>> and <<BASE64_END>> flags. The malware is used to download an inject the next stage payload into another process. The campaign I observed involved #RemcosRAT

User page: https://archive.org/details/@nodetectonn
Remcos: hxxps://petshopsirena[.]mk/a.txt
#c2 : 45.95.169[.]135:2404

I found samples dropping others such as #agenttesla and #formbook as well.

#infosec #threatintel

🚩 Active #RemcosRAT campaign is distributed via GitHub through abuse of comments in legitimate repositories.

Some malicious links:
- https://github[.]com/ustaxes/UsTaxes/files/15421286/2022and2023TaxDocuments[.]zip
- https://github[.]com/ustaxes/UsTaxes/files/15419438/2023TaxDocuments[.]zip
- https://github[.]com/PolicyEngine/policyengine-us/files/15487603/2023.TAX.ORGANIZER.pdf[.]zip
- https://github[.]com/hmrc/claim-tax-refund/files/15487332/TaxrefundlistPDF[.]zip

They also got creative and registered the user "user-attachments" on GitHub 😄
- https://github[.]com/user-attachments/files/15592343/Rachel.Completed.Organizer.Season.TAX.2023[.]zip

Remcos C2 servers:
- pattreon.duckdns[.]org:7035
- deytrycooldown.duckdns[.]org:7070
- newlink.duckdns[.]org:5111
* Botnet: RemoteHost

REF: https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/

Campagne #Malware #Italy Week 22

☠️🔥👻💣

#AgentTesla: Ordine d'acquisto
#Formbook: Preventivo
#RemcosRat: Pagamento
#Irata: APK Bank
#Guloader: Contratto
#XWorm: Fattura

#mwitaly

Campagne #Malware #Italy Week 21
☠️🔥👻💣
#AgentTesla: Bozza Contratto
#RemcosRat: Ordine
#Formbook: Fattura
#SnakeKeylogger: Ordine
#GuLoader: Lisino
#Unknown: Contratto
#Lokibot: Delivery
#XWorm: Documentazione
#Ransomware: Cambiare Rotta
#mwitaly

Campagne #Malware #Italy Week 20

☠️🔥💣👻
#AgentTesla: Bozza Contratto
#Guloader: Ordine
#Formbook: Pagamento
#ZGRat: Contratto
#Irata: APK Bank
#PureLogs: Documenti
#Nanocore: Fattura
#LokiBot: Delivery
#RemcosRat: Ordine

#mwitaly

Campagne #Malware #Italy Week 19

☠️🔥👻💣
#AgentTesla: Documenti
#GuLoader: Ordine
#RemcosRat: Bank
#Formbook: Preventivo
#PureLogs: Ordine

#mwitaly

The Computer Emergency Response Team of Ukraine (CERT-UA) reports that the threat actor group UAC-0184 is increasingly using popular messengers and social engineering in 2024 to target the Ukrainian military, and steal documents/messenger data (e.g. Signal). Malware delivered include IDAT, RemcosRAT, VIOTTOKEYLOGGER, XWorm, SIGTOP and TUSC. A lot of IOC provided, and images depict infection chains or lure messages. 🔗 (Ukrainian language) https://cert.gov.ua/article/6278521

#CERTUA #UAC0184 #Ukraine #cyberespionage #threatintel #IOC #RemcosRAT #IDAT #xworm

Fortinet reports on a recent phishing campaign containing Scalable Vector Graphics (SVG) files. The malicious attachment downloads a ZIP file and begins the infection chain. ScrubCrypt, described as an "antivirus evasion tool", is used to load the final payload VenomRAT while maintaining a connection with the C2 server to install plugins like XWorm, NanoCore, RemcosRAT and a crypto wallet stealer. They provides detailed insights into how the threat actor distributes VenomRAT and other plugins. IOC listed. 🔗 https://www.fortinet.com/blog/threat-research/scrubcrypt-deploys-venomrat-with-arsenal-of-plugins

#ScrubCrypt #VenomRAT #RemcosRAT #XWorm #NanoCore #threatintel #IOC

ESET Research reports that AceCryptor use surged in the second half of 2023. This included Remcos RAT campaigns for the first time, using compromised accounts for credibility in phishing emails. AceCryptor + Remcos campaigns targeted Poland, Bulgaria, Spain, and Serbia. Campaigns were described, MITRE ATT&CK TTPs and IOC provided. 🔗 https://www.welivesecurity.com/en/eset-research/rescoms-rides-waves-acecryptor-spam/

#AceCryptor #threatintel #IOC #Remcos #RemcosRAT #VidarStealer #Stopransomware #SmokeLoader

#RemcosRat

Client Info