Skip to content
OriginalSign in
Image: SANS ISC

SANS ISC

German users hit by ZIP to VHDX malware delivering Remcos RAT

Part of the Remcos story · since 2 Jun

Quiet for 18 weekslast report 26 Jun4 articles2 outlets
2 Jun · SecurityOnline first18 Aug13 Sep9 OctNowThis article3rd of 4
  • Tue 2 Jun, 10:32 UTC. SecurityOnline, first report. BlackToad Uses Remcos RAT and Network Blackout in Phishing Attack.
  • Fri 5 Jun, 09:32 UTC. SecurityOnline. New Remcos RAT variant evades detection via phishing batch file.
  • Tue 16 Jun, 09:28 UTC. SANS ISC, its first report on the story. German users hit by ZIP to VHDX malware delivering Remcos RAT. This article, 3rd of 4.
  • Fri 26 Jun, 07:20 UTC. SecurityOnline. India Targeted Phishing Uses Bitmap Hidden Remcos RAT Steals Data.

The article, authored by Xavier Mertens, discusses a cybersecurity threat involving a malicious ZIP file that, when extracted, reveals a VHDX file containing obfuscated JavaScript. This JavaScript leverages WMI to execute a PowerShell script, bypassing traditional security measures. The PowerShell script reconstructs hidden strings and downloads further malware, specifically targeting German-speaking victims. The ultimate outcome is the installation of Remcos RAT, which compromises system integrity.

The infection pathway includes: Email → ZIP → VHDX → JavaScript → PowerShell Decoder → PowerShell (.Net Loader) → Shellcode (Downloader) → Remcos. Key indicators and file hashes are provided for further analysis.

How the story developed

All 4 articles
Quiet for 18 weekslast report 26 Jun4 articles2 outlets

4 articles from 2 outlets since 2 Jun. Quiet since 26 Jun. This was the 3rd report, 14 days after the first.

Now2 Jun5791113151719212427First reportSecurityOnline · 2 Jun, 10:32This article3rd of 4 · day 14Picked up againafter 3 days quiet
  • Tue 2 Jun, 10:32 UTC. SecurityOnline, first report. BlackToad Uses Remcos RAT and Network Blackout in Phishing Attack.
  • Fri 5 Jun, 09:32 UTC. SecurityOnline. New Remcos RAT variant evades detection via phishing batch file.
  • Tue 16 Jun, 09:28 UTC. SANS ISC, its first report on the story. German users hit by ZIP to VHDX malware delivering Remcos RAT. This article, 3rd of 4.
  • Fri 26 Jun, 07:20 UTC. SecurityOnline. India Targeted Phishing Uses Bitmap Hidden Remcos RAT Steals Data.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Tue 2 JunDay 01
    1. BlackToad Uses Remcos RAT and Network Blackout in Phishing Attack10:32 · SecurityOnline · First report

  2. Quiet for 3 days

    Fri 5 JunDay 31
    1. New Remcos RAT variant evades detection via phishing batch file09:32 · SecurityOnline · Picked up again

  3. Quiet for 11 days

    Tue 16 JunDay 141
    1. German users hit by ZIP to VHDX malware delivering Remcos RAT09:28 · SANS ISC · Picked up again · This article, 3rd of 4

  4. Quiet for 10 days

    Fri 26 JunDay 241
    1. India Targeted Phishing Uses Bitmap Hidden Remcos RAT Steals Data07:20 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in