Severity
Medium
Analysis Summary
A Remcos RAT being delivered by a recently identified phishing campaign. This remote access tool was initially observed back in 2016 and was sold on various hacking sites and hacking forums. It still remains active and in use by threat actors to this day. In this case study, it was observed being distributed via email in a phishing campaign. The adversary attempts to entice a potential victim into believing that the email contains an invoice which needs to be reviewed. The infection process begins once a user opens the malicious attachment (order201900512.ace). Once the malware has been successfully installed on a victim’s system, the adversary will have full remote control of that system. The email comes from a legitimate domain and the subject was seen as “RE: NEW ORDER 573923”. The malware itself makes use of an obfuscated AutoIt wrapper that possesses anti-debugging capabilities used to make being detected difficult.
Impact
System access
Indicators of compromise
Filename
order201900512.ace
Email Address
rud-division@alkuhaimi.com
Email Subject
RE: NEW ORDER 573923
Malware Hash (MD5/SHA1/SH256)
- cf624ccc3313f2cb5a55d3a3d7358b4bd59aa8de7c447cdb47b70e954ffa069b
- 1108ee1ba08b1d0f4031cda7e5f8ddffdc8883db758ca978a1806dae9aceffd1
- 6cf0a7a74395ee41f35eab1cb9bb6a31f66af237dbe063e97537d949abdc2ae9
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.