✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – FBR Phishing Campaign Continues to Target Users

August 19, 2019
Rewterz

Rewterz Threat Alert – Troldesh Ransomware Dropped via PHP Files

August 19, 2019

Rewterz Threat Alert – Remcos RAT Delivered via Phishing Campaign

Severity

Medium

Analysis Summary

A Remcos RAT being delivered by a recently identified phishing campaign. This remote access tool was initially observed back in 2016 and was sold on various hacking sites and hacking forums. It still remains active and in use by threat actors to this day. In this case study, it was observed being distributed via email in a phishing campaign. The adversary attempts to entice a potential victim into believing that the email contains an invoice which needs to be reviewed. The infection process begins once a user opens the malicious attachment (order201900512.ace). Once the malware has been successfully installed on a victim’s system, the adversary will have full remote control of that system. The email comes from a legitimate domain and the subject was seen as “RE: NEW ORDER 573923”. The malware itself makes use of an obfuscated AutoIt wrapper that possesses anti-debugging capabilities used to make being detected difficult.

Impact

System access

Indicators of compromise

Filename

order201900512.ace

Email Address

rud-division@alkuhaimi.com

Email Subject

RE: NEW ORDER 573923

Malware Hash (MD5/SHA1/SH256)

  • cf624ccc3313f2cb5a55d3a3d7358b4bd59aa8de7c447cdb47b70e954ffa069b
  • 1108ee1ba08b1d0f4031cda7e5f8ddffdc8883db758ca978a1806dae9aceffd1
  • 6cf0a7a74395ee41f35eab1cb9bb6a31f66af237dbe063e97537d949abdc2ae9

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo