Remcos RAT malware resumes attack on Windows systems

Remcos RAT malware resumes attacks on Windows systems in a more malignant way.

That malware in recent times may have seen news of the emergence of many new malware, but many that have been famous in the past, even if silent, have not disappeared at all. On the contrary, these malware developers have spent their lost time developing even more insidious capabilities, such as this news.

According to a report by the website, The Hacker News has mentioned the detection of a malware distribution campaign type remotely controlled the victim's machine, or the new RemcosRAT (Remote Access Trojan) after a while of absence under the campaign name SHADOW.# REACTORThis campaign is accompanied by an even more insidious multi-Stages Infection procedure, which also has the ability to evade detection. A research team from Securonix, a cybersecurity management specialist, discussed the embedded stages of malware:

The malware will start by running a launcher in the form of a camouflaged VBS script to confuse the detection system or Obfuscation via wscript.exe. This will lead to a downloader in the form of PowerShell that will download the malware file or a Text payload from the server. All the font code will be reassembled through the malware, another loader that is encrypted (Encoded) and then decoded (Decoded). ) With the use of the .NET Reactor-Protected Assembly, it runs directly on the memory. The malware retrieves the Remcos RAT malware configuration from the server for application, and finally uses a tool that is already on the system, or Living-off-the-Land (LOL), by running a malware through a Windows tool called MSBuild.exe. This will result in Remcos RAT malware being able to take full control of the victim's system, which is a very complex embedded, and can evade detection well.

Technically, the research team said that there are many interesting things, such as the use of Payload in Text and then later assembled to avoid detection systems that can work if a Payload file is downloaded straight down, the use of VBS scripts that do not look like files that people regularly use, such as win64.vbs. It is estimated that hackers may use social engineering deception to trick the victim into pressing the link and leading to the download and run of such files.

In terms of PowerShell operation, it is also interesting that it is used. WebClient to communicate with the server used to pull down the VBS script in the first step to download a Payload file named "qpwoe64.txt" (or "qpwoe32.txt" for 32-bit systems) into the% TEMP% temporary folder. The script in this step whether the file is complete with the minLength function. If the file is smaller than specified, it will stop downloading and redownloading, or the download period does not exceed the system break, or Timeout. From the maxWait function, the malware installation process will continue to work.

If the file is fully compliant, it will convert the file into a second PowerShell script called "jdywa.ps1" to the temporary folder% TEMP%, after which the Loader is formed. NET Reactor will create persistence on the system or Persistence on the malware, download the next payload, and add a debugging protection system with a virtual machine, and then run the malware via MSBuild.exe and then place the script via "wscript.exe" to create a new win64.vbs script condition, allowing the malware to remain on the system for a long time.

This malware focuses its attacks on small and medium-sized businesses, or SMEs. Therefore, those working in such organizations should be prepared to defend themselves, starting with the clicks received by untrustworthy groups.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack