By - A new phishing campaign was recently spotted, distributing an Excel file
- The file drops a fileless version of the Remcos RAT on the device
- Remcos can steal sensitive files, log keys, and more
Hackers have been seen distributing a fileless version of the Remcos Remote Access Trojan (RAT), which they then use to steal sensitive information from the target devices using hijacked spreadsheet software.
In a technical analysis, researchers from Fortinet said they observed threat actors sending out phishing emails with the usual purchase order theme. Attached with the email is a Microsoft Excel file, built to exploit a remote code execution vulnerability found in Office (CVE-2017-0199). When triggered, the file will download an HTML Application (HTA) file from a remote server, and launch it via mshta.exe.
The downloaded file will pull a second payload from the same server, which will run the initial anti-analysis and anti-debugging, after which it will download and run Remcos RAT.
Remcos returns
For its part, Remcos was not always considered malware. It was built as a legitimate, commercial software, used for remote administration tasks. However, it was hijacked by cybercriminals, in the same way Cobalt Strike was hijacked, and is nowadays mostly used for unauthorized access, data theft, and espionage. Remcos can log keystrokes, capture screenshots, and execute commands on infected systems.
But this version of Remcos gets dropped directly into the device’s memory: “Rather than saving the Remcos file into a local file and running it, it directly deploys Remcos in the current process’s memory,” Fortinet explained. “In other words, it is a fileless variant of Remcos.”
Phishing via email continues to be one of the most popular ways cybercriminals infect devices with malware, and steal sensitive information. It is cheap to execute, and performs well, making it a highly efficient attack vector. The best way to defend against phishing is to use common sense when reading emails, and to be extra wary when downloading and running any attachments.
