Rewterz Threat Alert – Remcos RAT Delivered via Phishing Campaign

Severity

Medium

Analysis Summary

A Remcos RAT being delivered by a recently identified phishing campaign. This remote access tool was initially observed back in 2016 and was sold on various hacking sites and hacking forums. It still remains active and in use by threat actors to this day. In this case study, it was observed being distributed via email in a phishing campaign. The adversary attempts to entice a potential victim into believing that the email contains an invoice which needs to be reviewed. The infection process begins once a user opens the malicious attachment (order201900512.ace). Once the malware has been successfully installed on a victim’s system, the adversary will have full remote control of that system. The email comes from a legitimate domain and the subject was seen as “RE: NEW ORDER 573923”. The malware itself makes use of an obfuscated AutoIt wrapper that possesses anti-debugging capabilities used to make being detected difficult.

Impact

System access

Indicators of compromise

Filename

order201900512.ace

Email Address

rud-division@alkuhaimi.com

Email Subject

RE: NEW ORDER 573923

Malware Hash (MD5/SHA1/SH256)

• cf624ccc3313f2cb5a55d3a3d7358b4bd59aa8de7c447cdb47b70e954ffa069b
• 1108ee1ba08b1d0f4031cda7e5f8ddffdc8883db758ca978a1806dae9aceffd1
• 6cf0a7a74395ee41f35eab1cb9bb6a31f66af237dbe063e97537d949abdc2ae9

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.