Remcos RAT Uses Obfuscated Scripts, Trusted Windows Binaries to Evade Detection

Key Takeaways

• A sophisticated Remcos RAT campaign is actively leveraging multi-stage, in-memory execution to evade traditional detection mechanisms.
• The attack chain begins with a phishing email containing an obfuscated JavaScript file, leading to the download and execution of a PowerShell loader.
• Remcos RAT is delivered entirely in memory, abusing trusted Windows binaries like aspnet_compiler.exe for command and control (C2) communications.
• The malware steals data, logs keystrokes, and establishes persistent remote control over compromised systems, storing exfiltrated data in C:ProgramDataremcoslogs.dat.
• Organizations must enhance monitoring for suspicious PowerShell activity, anomalous outbound connections from legitimate binaries, and specific indicators of compromise.

Sophisticated Remcos RAT Campaign Evades Detection with Obfuscated Scripts and Trusted Binaries

A new campaign deploying the Remcos Remote Access Trojan (RAT) has been identified, showcasing advanced evasion techniques that bypass conventional security measures. Unlike typical malware operations that drop malicious files directly onto a system, this attack employs a complex, multi-stage infection chain designed to operate primarily in memory, leaving minimal forensic traces.

This highly sophisticated approach begins with a seemingly innocuous phishing email and culminates in a full system compromise, granting attackers remote control, data exfiltration capabilities, and keystroke logging functionality. The campaign’s reliance on obfuscation and the abuse of legitimate Windows binaries makes it particularly challenging to detect and mitigate.

Evolving Tactics: In-Memory Delivery and Living-off-the-Land

Remcos RAT, a long-standing threat known for its capabilities in data theft and remote system control, is being deployed with renewed stealth. This latest iteration distinguishes itself through an intricate delivery mechanism that leverages multiple layers of obfuscation, trusted Windows tools, and live command-and-control (C2) infrastructure to deploy its payload with surgical precision.

Researchers from Point Wild’s LAT61 Threat Intelligence Team uncovered this campaign during an analysis of a malicious email file (.eml). Their findings indicate that the initial vector is a ZIP attachment named “MV MERKET COOPER SPECIFICATION.zip,” crafted to appear as a standard business document. Once opened, this archive releases a heavily obfuscated JavaScript file, initiating the attack chain without triggering immediate security alerts.

The impact of a successful compromise is severe. Upon deployment, Remcos establishes a persistent connection to a remote C2 server at 192[.]3[.]27[.]141:8087, facilitating active data exfiltration. Evidence of data collection was confirmed by the presence of a log file at C:ProgramDataremcoslogs.dat, which stores captured keystrokes and other sensitive system information, indicating active staging for exfiltration.

A key factor contributing to the threat’s elusiveness is its ability to blend into normal system activity. By abusing legitimate Windows binaries and executing almost entirely in memory, the attackers effectively circumvent many traditional endpoint security solutions. This strategy underscores a growing trend among threat actors to develop operations that mimic benign system processes, making them harder to identify.

Multi-Stage Infection Mechanism: From Phishing to In-Memory Execution

The infection sequence is activated when a user opens the phishing email and extracts the malicious ZIP file.

The archive contains a JavaScript file, “MV MERKET COOPER SPECIFICATION.js,” which is extensively obfuscated using string-mapping functions and encoded arrays to conceal its true malicious intent.

When executed via Windows Script Host, the JavaScript creates ActiveX objects to manage HTTP communications, execute commands, and perform file operations. It then connects to almacensantangel[.]com to download a remote PowerShell script named ENCRYPT.Ps1.

The downloaded PowerShell loader employs multiple layers of obfuscation to reconstruct the payload directly in memory.

Encrypted data is stored as a large Base64-encoded string within the $securecontainer variable. The $base64reconstruction function then converts this string into raw byte arrays.

A rotational XOR function decrypts the data using a dynamic shifting key mechanism, with the $masterdecoder function orchestrating the full decryption process. Finally, the $executionhandler executes the recovered script using Invoke-Expression, incorporating built-in fallback methods for resilience.

The decrypted script reveals a .NET assembly, ALTERNATE.dll, which is loaded directly into memory using .NET Reflection APIs, ensuring no executable file is written to disk. A secondary payload, Cqeqpvzeia.exe, embedded as a raw byte array beginning with the “MZ” PE signature, is then injected into aspnet_compiler.exe—a legitimate Microsoft .NET tool. This “Living-off-the-Land” technique allows the abused aspnet_compiler.exe process to handle all outbound C2 communications, making malicious network traffic appear as routine system activity.

What You Should Do

• Enhanced Monitoring for PowerShell Activity: Implement robust logging and monitoring for PowerShell execution events, particularly those involving Base64-encoded commands, obfuscated scripts, and execution policy bypass flags.
• Network Traffic Analysis: Scrutinize outbound connections from legitimate system utilities like aspnet_compiler.exe to external hosts, especially those that are unknown or appear anomalous.
• Indicator of Compromise (IOC) Detection: Monitor for the presence of the file C:ProgramDataremcoslogs.dat, which serves as a key indicator of compromise for data staging.
• Threat Intelligence Integration: Block known malicious URLs, hashes, and C2 infrastructure identified in threat intelligence feeds to prevent early stages of the attack.
• User Awareness Training: Conduct regular training sessions to educate employees about identifying and reporting phishing emails, especially those with suspicious attachments.
• Endpoint Detection and Response (EDR): Utilize EDR solutions capable of detecting in-memory attacks, process injection, and anomalous behavior from trusted binaries.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.