A recent malspam campaign was detected distributing Remcos RAT through email attachments. There were about 300 sending email addresses which were all probably spoofed, and they all ended with @t-online[.]de. The word documents attached in the email have the name resume.doc and they are password protected, using the password 123. The email typically looks like this:
These Word documents have macros which are enabled when the users enter the given password.
Once macros are enabled, an HTTP request was observed that returned a Windows executable file. In this case, the initial URL ended in .jpg. This was followed by post-infection traffic over TCP ports 2404 and 2405. The initial Windows executable (EXE) file was saved to the user’s AppData\Local\Temp directory. It generated an EXE that was slightly over 400 MB, which kept Remcos RAT persistent on the infected Windows host. This Remcos RAT sample also updated the Windows registry to stay persistent after a reboot. Detection rates on the attached Word documents are very low, since they are encrypted and use password protection.
IP(s) / Hostname(s)
Malware Hash (MD5/SHA1/SH256)