- Recently, a new phishing campaign was noticed, involving the distribution of an Excel file
- The file drops a fileless version of the Remcos RAT on the device
- Remcos can steal sensitive files, log keys and more
Hackers have been seen distributing a fileless version of the Remcos Remote Access Trojan (RAT), which they then use to steal sensitive information from the target devices using hijacked spreadsheet software.
In a technical analysis, Fortinet researchers said they observed threat actors sending phishing emails with the usual purchase order theme. Attached to the email is a Microsoft Excel file built to exploit a remote code execution vulnerability in Office (CVE-2017-0199). When activated, the file downloads an HTML application file (HTA) from a remote server and launches it via mshta.exe.
The downloaded file fetches a second payload from the same server, which performs the initial anti-analysis and anti-debugging, after which Remcos RAT is downloaded and executed.
Remcos returns
Remcos, for its part, was not always considered malware. It is built as legitimate commercial software, used for remote management tasks. However, it was hijacked by cybercriminals in the same way Cobalt Strike was hijacked, and today is mainly used for unauthorized access, data theft and espionage. Remcos can record keystrokes, take screenshots and execute commands on infected systems.
But this version of Remcos is dropped directly into the device’s memory: “Instead of saving the Remcos file to a local file and executing it, Remcos is deployed directly into the memory of the current process,” Fortinet explains out. “In other words, it is a fileless variant of Remcos.”
Email phishing remains one of the most popular ways cybercriminals infect devices with malware and steal sensitive information. It is cheap to implement and performs well, making it a very efficient attack vector. The best way to protect yourself from phishing is to use common sense when reading emails and be extra careful when downloading and running attachments.