Headline
Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts
A new wave of attacks uses PowerShell and LNK files to secretly install Remcos RAT, enabling full remote…
A new wave of attacks uses PowerShell and LNK files to secretly install Remcos RAT, enabling full remote control and surveillance of infected systems.
Cybersecurity experts at the Qualys Threat Research Unit (TRU) have recently uncovered a sophisticated cyberattack that utilizes the scripting language PowerShell to secretly install Remcos RAT (Remote Access Trojan).
This method allows attackers to operate undetected by many traditional antivirus programs because the malicious code runs directly in the computer’s memory, leaving very few traces on the hard drive.
For your information, Remcos RAT is a powerful tool that cybercriminals use to gain complete control over infected computers. Once installed, it allows them to spy on victims, steal data, and perform other harmful actions.
According to the Qualys TRU analysis, the attack begins when a user opens a harmful file inside a ZIP archive, new-tax311.ZIP, which contains a shortcut file ‘new-tax311.lnk.’ Clicking this .LNK file doesn’t open a normal program. Instead, it uses a Windows tool called ‘mshta.exe’ to run a confusing (obfuscated) PowerShell script.
This script prepares the computer to get infected with Remcos RAT. First, it tries to weaken Windows Defender by telling it to ignore the “C:/Users/Public/” folder. It also changes PowerShell settings to allow unsafe scripts to run without warning and tries to run secretly. To make sure the Remcos RAT starts every time the computer is turned on, the script adds information to the Windows Registry.
Attack Flow (Source: Qualys TRU)
The script also downloads several files to the “C:/Users/Public/” folder. One might be a fake harmless file like pp1.pdf. It also downloads two key files: 311.hta (set to run at start-up and similar to ‘xlab22.hta’) and ‘24.ps1.’ The ‘24.ps1 file is the main, hidden PowerShell script that contains the Remcos RAT. This script uses special Windows functions (Win32 APIs) to load and run Remcos RAT directly in the computer’s memory, avoiding detection by file-based security.
The Remcos RAT TRU researchers analysed is a 32-bit V6.0.0 program designed to be stealthy and give attackers control over infected computers. It is a modular design, which means it has different parts that can perform different tasks. The program also stores encrypted data, which it decrypts when needed.
This encrypted data contains the remote server’s address that it connects to (readysteaurantscom on port 2025 using a secure connection called TLS), the malware’s name (Remcos), and a special code (Rmc-7SY4AX) it uses to identify if the computer is already infected.
Remcos can perform various harmful actions, including keylogging, copying clipboard content, taking screenshots, recording from microphones and webcams, and stealing user information. It also tries to prevent security programs from analysing it.
In their research, Qualys TRU team emphasized that users should activate PowerShell logging and AMSI monitoring (a Windows feature that helps detect malicious scripts) to be turned on, and to use a strong EDR (Endpoint Detection and Response) solution for better protection.
In a comment to Hackread.com, Xiaopeng Zhang, IPS Analyst and Security Researcher with Fortinet’s FortiGuard Labs, stated “The attackers behind Remcos are evolving their tactics. Instead of exploiting the CVE-2017-0199 vulnerability through malicious Excel attachments, they now use deceptive LNK files disguised with PDF icons to lure victims into executing a malicious HTA file.“
Xiaopeng warned that “PowerShell continues to play a role in the campaign. However, the latest variant adopts a fileless approach, using PowerShell to parse and execute Remcos directly in memory via the CallWindowProc() API. This marks a shift from previous methods, where Remcos was downloaded as a file before execution.“
Related news
SmokeLoader malware has resurfaced with enhanced capabilities and functionalities, targeting your personal data.
Windows users are at risk for full device takeover by an emerging malicious version of the Remcos remote admin tool, which is being used in an ongoing campaign exploiting a known remote code execution (RCE) vulnerability in Microsoft Office and WordPad.
This article explains the inner workings of the Remcos RAT, a dangerous malware that uses advanced techniques to…
More than 140,000 phishing websites have been found linked to a phishing-as-a-service (PhaaS) platform named Sniper Dz over the past year, indicating that it's being used by a large number of cybercriminals to conduct credential theft. "For prospective phishers, Sniper Dz offers an online admin panel with a catalog of phishing pages," Palo Alto Networks Unit 42 researchers Shehroze Farooqi,
Chinese-speaking users are the target of an ongoing campaign that distributes malware known as ValleyRAT. "ValleyRAT is a multi-stage malware that utilizes diverse techniques to monitor and control its victims and deploy arbitrary plugins to cause further damage," Fortinet FortiGuard Labs researchers Eduardo Altares and Joie Salvio said. "Another noteworthy characteristic of this malware is its
Spanish speakers beware! A new campaign using the Agent Tesla RAT targets Spanish-speaking individuals. Learn how to protect…
Kim Jong Un's Swiss Army knife APT continues to spread its tendrils around the world, showing it's not intimidated by the researchers closing in.
The health, manufacturing, and energy sectors are the most vulnerable to ransomware.
By Chetan Raghuprasad and Vanja Svajcer. Cisco Talos discovered a malicious campaign in August 2022 delivering Cobalt Strike beacons that could be used in later, follow-on attacks. Lure themes in the phishing documents in this campaign are related to the job details of a government organization in the United States and a trade union in New Zealand. The attack involves a multistage and modular infection chain with fileless, malicious scripts. Cisco Talos recently discovered a malicious campaign with a modularised attack technique to deliver Cobalt Strike beacons on infected endpoints. The initial vector of this attack is a phishing email with a malicious Microsoft Word document attachment containing an exploit that attempts to exploit the vulnerability CVE-2017-0199, a remote code execution issue in Microsoft Office. If a victim opens the maldoc, it downloads a malicious Word document template hosted on an attacker-controlled Bitbucket repository. Talos discovered two attack met...
The most heavily targeted flaw last quarter was a remote code execution vulnerability in Microsoft Office that was disclosed and patched four years ago.