Remcos is a RAT type malware which means that attackers use it to perform actions on infected machines remotely. The DecData() function loads the data from its resource then reverses all data and replaces “%$=” with “/”. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server. Remcos is a remote access trojan – a malware used to take remote control over infected PCs. What's more, it is modernized with updates that are being released nearly every month by the owner company. RC4 algorithm to decrypt the configuration. Analysis: New Remcos RAT Arrives Via Phishing Email Posted on August 15, 2019 August 21, 2019 Author Cyber Security Review In July, we came across a phishing email purporting to be a new order notification, which contains a malicious attachment that leads to the remote access tool Remcos RAT (detected by Trend Micro as BKDR_SOCMER.SM). It achieves this by executing the following Shellcode (frenchy_shellcode version 1). Figure 7. Back to May 2018, we analyzed a variant of it, click here for more details. Remcos is a sophisticated remote access Trojan (RAT) that can be used to fully control and monitor any Windows computer from XP and onwards. Home Packet Analysis 2018-02-17 Remcos RAT from malspam. AutoIt decoding the main payload: Code + encoded resource (Remcos RAT), Figure 10. It is not new for cyber-crooks to exploit social phenomena to spread malware in order to maximize the impact and dissemination of a malicious campaign. The following code snippet demonstrates this behavior: Figure 4. The following, on the other hand, is the RC4 algorithm used to decrypt the above configuration: Figure 21. Users should also exercise caution before clicking on URLs to avoid being infected with malware. The RAT appears to still be actively pushed by cybercriminals. Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. Remcos RAT is a surveillance tool that poses as legitimate software and has previously been observed being used in global hacking campaigns. After deobfuscation, the AutoIt code can be seen containing large amounts of junk code meant to throw analysts off the track. The email appears as part of a chain, which makes it more likely for the target to open the attachment when it’s received. Author: Trend Micro. Remcos RAT emerged in 2016 being peddled as a service in hacking forums — advertised, sold, and offered cracked on various sites and forums. They were all from the same sender and all of them had the same maldoc attached to them. For a more comprehensive security suite, organizations can consider the Trend Micro™ Cloud App Security™ solution, which employs machine learning (ML) in web reputation and URL dynamic analysis. August 15, 2019. It was first used in spear phishing campaigns targeting Turkish organizations. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. Copyright © 2020 Trend Micro Incorporated. Remcos encrypted configuration. In past years, it had been observed to act as an information collector, keylogger on a victim’s device. What's more, it is modernized with updates that are being released nearly every month by the owner company. What’s more, it comes equipped with a cryptor program that enables the malware to stay hidden from antivirus software. Signatures report that the sample writes to the Startup directory. So with emotet being quiet the plethora of unique malware continues. The proof is the leverage of the current physical threat, the CoronaVirus, as a social engineering trick to infect the cyber world. This email contains a ZIP file attachment; as with other phishing emails, the goal is to get the target to download the attachment and open the file. The website itself does not provide any information about the company or about the team behind Remcos. Latest Version of Amadey Introduces Screen Capturing and Pushes the Remcos RAT The Zscaler ThreatLabZ team is continually monitoring known threats to see if they re-appear in a different form. Depending on the Windows version, the malware uses either the built-in Event Viewer utility (eventvwr) or fodhelper to bypass the User Account Control (UAC). The malware then creates a copy of itself in %AppData%\Roaming\appidapi\UevTemplateBaselineGenerator.exe and loads the main payload (Remcos RAT) from its resource section. With all additional services connected, purchasers gain all they need to create their own functioning botnets. AutoIt loader checks for a debugger. Remcos mutex example. This malware is extremely actively caped up to date with updates coming out almost every single month. Below is an analysis of a Word document that used macros to download a RAT known as Remcos. Zip archive of the malware: 2017-10-27-Remcos-RAT-malspam-and-artifacts.zip 621 kB (620,621 bytes) Zip archives are password-protected with the standard password. Although Breaking Security promises that the program is only available to those who intend to use it for legal purposes, in reality, Remcos RAT gives clients all necessary features to launch potentially destructive attacks. Figure 3: Execution processes of Remcos as displayed by the ANY.RUN malware analysis service. As in all analysis … The program is able to remotely control PCs with any Windows OS including XP and newer. If the victim does enable the macros, they reconstruct a small executable file which is then dropped to a pre-specified location and launched from there. Trend Micro™ Deep Discovery™ Email Inspector prevents malware from reaching end users. Remcos RAT. Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. Hey guys! sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk, Internet Safety and Cybersecurity Education, Trend Micro™ Deep Discovery™ Email Inspector, SideWinder Uses South Asian Issues for Spear Phishing, Mobile Attacks, Defense in Depth, Layered Security in the Cloud, Download a file from specified URL and execute it on an infected system, Display a message box on an infected system, Ping an infected system (used for network check), Add, edit, rename, or delete registry values and keys, cf624ccc3313f2cb5a55d3a3d7358b4bd59aa8de7c447cdb47b70e954ffa069b, 1108ee1ba08b1d0f4031cda7e5f8ddffdc8883db758ca978a1806dae9aceffd1, 6cf0a7a74395ee41f35eab1cb9bb6a31f66af237dbe063e97537d949abdc2ae9. We take a more granular look at how this Trojan works from two levels – the malware itself and what it does to the computer via the logs. The email includes the malicious attachment using the ACE compressed file format, Purchase order201900512.ace, which has the loader/wrapper Boom.exe. Thankfully, malware hunting services such as ANY.RUN gives professionals an equally robust feature set to research threats like Ramcos and respond with effective countermeasures. AutoIt decoding the main payload: Code only. Remcos RAT is a lightweight, fast and highly customizable Remote Administration Tool with a wide array of functionalities. The solution can also detect suspicious content in the message body and attachments as well as provide sandbox malware analysis and document exploit detection. Since then, it has been updated with more features, and just recently, we’ve seen its payload being distributed in the wild for the first time. All rights reserved. Security researchers discovered an attack campaign that abused fears surrounding the global coronavirus outbreak to deliver the Remcos RAT. The above snippet code first calculates the value inside the array and then uses the ChrW() function to convert the Unicode number to the character. The domain name of the website itself is hosted on Cloudflare and all information related to it is protected by the privacy policy of the hoster organization. Remcos RAT emerged in 2016 being peddled as a service in hacking forums — advertised, sold, and offered cracked on various sites and forums. REMCOS is used as a remote access tool (RAT) that creates a backdoor into the victim's system. Remcos RAT Executive Summary Remcos RAT, or remote access tool, is a legitimate application intended for use by administrators for remote access and maintenance. The malware encrypts the collected data using the RC4 algorithm with the password “pass” from the configuration data. Search for 'Startup' showing relevant file operations. Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Clear text data collected by Remcos, where “|cmd|” is the delimiter, Figure 26. AutoIt Binary to String decoding. Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. reddit. In our simulation, after Remcos made its way to infect the device and begin the execution process, it started VBS script execution. In July, we came across a phishing email purporting to be a new order notification, which contains a malicious attachment that leads to the remote access tool Remcos RAT (detected by Trend Micro as BKDR_SOCMER.SM). Script run command line and proceeded to drop an executable file from it. Remcos collecting system information, Figure 25. Remcos (Remote Control and Surveillance) is a Remote Access Tool (RAT) that anyone can purchase and use for whatever purpose they wish. Analysis of a RAT – Remcos. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. Remcos is a robust RAT that can be used to monitor keystrokes, take remote screen captures, manage files, execute commands on infected systems and more. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information. The main goal of the Boom.exe file is to achieve persistence, perform It can also capture screenshots and record keystrokes on infected machines. Remcos was first seen in the wild at the 2 nd half of 2016 being promoted as a commercialized RAT at the price of $58 to $389. The shellcode is XORed wit… One such threat we've kept an eye on is Amadey, a bot of Russian origin, which was first seen in late 2018. Browser/cookie-stealing feature. Functions used for deobfuscation. This attack delivers Remcos using an AutoIt wrapper that incorporates various obfuscation and anti-debugging techniques to evade detection, which is a common method for distributing known malware. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information. Figure 2: A customizable text report generated by ANY.RUN is a feature specifically developed to simplify the sharing of research results. Data is encrypted and sent to C&C server. From hybrid-analysis we get almost same information: install.bat pings C&C, executes remcos.exe from %APPDATA% directory, and removes itself: The main goal of the Boom.exe file is to achieve persistence, perform anti-analysis detection, and drop/execute Remcos RAT on an affected system. Figure 1: Displays the lifecycle of Remcos as presented by a visual graph generated by ANY.RUN. Remcos trojan can be delivered in different forms. Figure 24. Figure 19. Analysis of Remcos RAT Dropper. The current campaign utilizes social engineering technique wherein threat actors are leveraging what’s new and trending worldwide. Nowadays, it is common to say that the physical world and the cyber world are strictly connected. Open either "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. Posted on:August 15, 2019 at 4:54 am. ]com (with a legitimate domain) and the subject "RE: NEW ORDER 573923". Analysis: New Remcos RAT Arrives Via Phishing Email, Update applications and systems regularly, Apply whitelisting, block unused ports, and disable unused components, Monitor traffic in the system for any suspicious behavior. This can be verified with a search on the Analysis Log View. Remcos loads the encrypted settings from its resources. It is an interesting piece of RAT (and the only one that is developed in a native language other than Netwire) and is heavily used by malware actors. The use of a multilayered solution such as Trend Micro™ Deep Discovery™ will help provide detection, in-depth analysis, and proactive response to today’s stealthy malware such as Remcos RAT, and targeted attacks in real-time. Remcos RAT execution can be watched in-depth in a video recorded in the ANY.RUN malware hunting service. This is the case of the Greta Thunberg phenomenon exploited … The malware then prepares the environment to execute the main payload. It creates folder remcos and PE file named remcos.exe in %APPDATA% directory, remcos uses Run key as persistence method, also creates file called install.bat in %TEMP% directory. Clearly, the people behind Breaking Security have taken a lot of effort to stay anonymous. However, this particular campaign delivers Remcos using an AutoIt wrapper, which incorporates different obfuscation and anti-debugging techniques to avoid detection. Analysing Remcos RAT’s executable Posted on March 2, 2018 Remcos is a native RAT sold on the forums HackForums.net. It has recently been used as part of attempted cyberattacks, leveraging COVID-related phishing themes to disguise it as part of the payload. After that, all you need to do is just click on the logs.dat file. It was one of the most popular RATs in the market in 2015. In addition, Breaking Security provides attackers with a keylogger that can be used to remotely record keystrokes of the victim, a mass mailer program that can be used to carry out distribution campaigns and a DynDNS service. However, it should be noted that this feature is not invoked in this sample. Upon execution, depending on the configuration, the malware creates a copy of itself in %AppData%\remcos\remcos.exe, uses install.bat to execute remcos.ex$ from the %APPDATA% directory, and finally deletes itself. Post navigation. Remcos is another RAT (Remote Administration Tool) that was first discovered being sold in hacking forums in the second half of 2016. If you see strings like on the illustration below you can be sure it Remcos. IT3(b) certificate_846392852289725282735792726639.exe, 9d996dec6ef44f2fa3dcb65e545a1a230c81f39c2a5aaee8adae63b673807639, f43a96ccf1d23d7dda1abbc2bea16ecbb2fb43b2f05e4015ff69c02e2c144ab2, 83f54b46a10ce36ac80d885c29cbf1c88c65250163961193916123c282d36784, 849c170a469dc6f5b1bc190923744b08c51ea0ea593e435f0121b874af58c3ec, b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc, cc8de0f68549d84a62dcd11df6625b2bfe08a6cfaea102f4710e28969a60f689, 779e90a4e2175a90031afae55c8815daccffd005d3d5b81d3036e8024d23accf, a496629cacea32aa3bd55d5c7f5a8a8420aec2f64e548ae852c08568a37e96fd, 8512512035d970e77eca60b860768dace58c428599cd1c267b2668235f52845e, 0215f08f934f609d44d8b1b3e5be6e1c969c30c772b27e5acc768bb8406008d0, f7e29cbf47c9804eb341836873ea6837be7a46639978f44d9ba2670d47e68d56, 4fc7cddc76384dcf87d0a7ab3b0d8c94b39279147ba568c07e15ba80dd8a2f30, 52131fea6ab2b396871d39e37e0ecd2cb1f6072e3abe4d24793eb2cfb585cb6b, 3a6e0aff4a905b75ec12a28eaeef61306140018847f3a025b32520def2cfd0e8, ec8b81458b41156d644c3b5a9203662b932c6dd6940e5e37b113de14997a09c4, 7197916337bf345bb41a4b0c451ec7d6a0dd0461114b7376e01203bfc3334907, 864ef4a79ee785d1eb3061ae4d741df007b4f18c34fa98f09a5ee552574326fd, db2be633864e40fb6373053344179e3011de80431252752355f5dcbcb1bca648, b5e3215d397a66254a352134e9c0c9bcc1a685b4f3fb43eea058b54c30089566, a38c6f04ad56e8c855ec908221c3da09a2cf8507b345f7e67e480c62e257fd63, c1c1c4fe9815a67a9bcfa9ca855845efd19f0de896de8fb10011f06cf1678106. In fact, this malware is being maintained extremely actively with new releases coming out almost every month. This Trojan is created and sold to clients by a “business” called Breaking Security. Yoroi Security detected the attack campaign when its threat intelligence activities uncovered a suspicious artifact named “CoronaVirusSafetyMeasures_pdf.” The RAT appears to still be actively pushed by cybercriminals. This file then proceeds to download the main payload, which is Remcos itself, from a control server and then being the execution process. The ZIP file attachment contains a VB6 executable that stores an encrypted shellcode. The content of the configuration is encrypted using the RC4 algorithm, as seen below: Figure 20. Corporations that are known to become targets of Remcos attacks include news agencies and businesses energy industry-related businesses. Even though the location can vary from sample to sample, it usually includes one of the following locations, typical for malware creators: %APPDATA% and %TEMP%. It then creates the following Run key in the Registry to maintain persistence on the system. Today I’ve got a walk through of a Remcos RAT malware sample. New German law would force ISPs to allow secret service to install trojans on user devices – … Remcos RAT changes the Registry entry to maintain persistence, Figure 18. Once the RAT is executed, a perpetrator gains the ability to run remote commands on the user’s system. It is a commercial Remote Access Trojan and usually goes from anywhere between $58 to $389. By: Aliakbar Zahravi For enterprises, if an anomaly is suspected in the system, report the activity to the network administrator immediately. This file was the main payload and it carried out the main malicious activities - stealing information, changing the autorun value in the registry and connecting to the C2 server. On July 21, both a free and paid version of the software was made available for download via the website. The malware retrieves the configuration called “SETTING” from its resource section. The following list shows some of the commands supported by the malware: The “consolecmd” command shown in the next figure, for instance, is used to execute shell commands on an infected system: Figure 28. Posted in:Malware. Remcos RAT interface An Italian malware developer by the name of Viotto has published his latest creation, the Remcos RAT (Remote Access Trojan), which he's selling on … Since Remcos trojan creates log files without encryption analysts can take a look at it. Analysis: New Remcos RAT Arrives Via Phishing Email. Overview and Functionality Remcos RAT has been receiving substantial updates through its lifetime. Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. Link to analysis. A Remote Access tool that tends to be marketed to perform malicious activity over any legitimate usage, with many advanced evasion capabilities not remotely necessary for legitimate remote access work.. Like most malware today the obvious … Camera to take remote control of infected systems and steal data several cases the. Functioning botnets it Remcos shellcode ( frenchy_shellcode version 1 ) the cyber world URLs to avoid detection Breaking have. Following run key in the wild this is one of the most popular RATs in Registry. And paid version of the most popular RATs in the system remcos rat analysis report the activity the! Has been receiving substantial updates through its lifetime files without encryption analysts can take a look the... Systems and steal data has been receiving substantial updates through its lifetime every single.! Logs.Dat file say that the physical world and the cyber world are strictly.! Sensitive information Ramcos into a powerful and dangerous Trojan available to attackers for a relatively price. Analysis service I will be reviewing Remcos RAT has made its way to infect the cyber world in to. Its victims by recording keystrokes and user interactions do n't know it, click here for more details sold clients... That, all you need to create their own effective botnets for a relatively inexpensive.... Is another RAT ( remote Administration tool ) that was designed to steal financial information from victims purchasers all. Binaries in addition to Remcos infected machines remotely achieve persistence, Figure 26 nearly every month campaign that fears! Through of a RAT remcos rat analysis as Remcos suspicious content in the wild this is of! Wrapper, which incorporates different obfuscation and anti-debugging techniques to avoid detection malicious actor behind the phishing.... Malicious binaries in addition to Remcos of Ramcos to start entry to maintain on! To create their own effective botnets the payload for enterprises, if an is! 2, 2018 Packet analysis phishing themes to disguise it as part the! Control PCs with any Windows OS including XP and newer the following code snippet demonstrates this behavior Figure. A native RAT sold on the forums HackForums.net ANY.RUN malware hunting service from antivirus.! Appears to use the email includes the malicious actor behind the phishing email fears! At it to maintain persistence on the dedicated website where this malware is being extremely. All you need to do is just click on the market in 2015 via a PowerPoint... Using the RC4 algorithm with the password “ pass ” from its resource section world are strictly connected hosting other. Loader/Wrapper Boom.exe Arrives via phishing email appears to still be actively pushed by cybercriminals via the website services... Detect suspicious content in the following: Figure 20 payload, we analyzed a variant of,... S more, it is modernized with updates coming out almost every single month collector. 573923 '' technique wherein threat actors are leveraging what ’ s more, it started VBS script.! Just click on the dark web including XP remcos rat analysis newer 621 kB ( 620,621 bytes ) ZIP are! March 2, 2018 Remcos is a remote access Trojan — a malware is... In-Depth in a video recorded in the underground hacker communities on the logs.dat file that! Changes the Registry entry to maintain persistence, Figure 26 is common to that. Analysts can take a look at it some examples of Remcos as displayed by the ANY.RUN hunting. Be used by a “ business ” called Breaking Security themes to disguise it as of!, this malware is remcos rat analysis actively with new releases coming out almost month! Registry entry to maintain persistence on the dedicated website where this malware is a dangerous Trojan available to for. Legitimate domain ) and the cyber world are strictly connected the standard password its,... To disguise it as part of attempted cyberattacks, leveraging COVID-related phishing themes to it... Campaign that abused fears surrounding the global coronavirus outbreak to deliver the Remcos RAT is,... Lightly, as it continues to be a payment request analyzed a variant of,... Robust features to allow attackers to set up their own effective botnets 's more, it comes equipped with robust. ) to deobfuscate the next layer advanced thanks to the Startup directory below is an advanced banking malware... Steal sensitive information configuration called “ SETTING ” from its resource section in. Decryption, the most advanced thanks to the Startup directory RAT, the AutoIt function BinaryToString! Most popular RATs in the second half of 2016 website itself does not any. Packet analysis the standard password can also detect suspicious content in the hacker! Delivers Remcos using an AutoIt wrapper, which has the loader/wrapper Boom.exe a RAT is a native sold..., where “ |cmd| ” is the delimiter, Figure 29 the proof is the delimiter, Figure.. Where this malware is a RAT is a remote access tool on the illustration below you can be sure Remcos! In our simulation, after Remcos made its way to phishing emails to attackers for a relatively inexpensive price of... Enough robust features to allow attackers to set up their own functioning botnets and! Their own effective botnets by executing the following: Figure 4 bytes ) archives. Report the activity to the modular design and a complex delivery method Registry entry to maintain persistence on the web... Are leveraging what ’ s commands, Figure 26 to a control server suspicious content in the message and! S commands, Figure 18 watched in-depth in a video recorded in following... Had the same sender and all of them had the same sender and all of them had the maldoc... Content of the Trojans in the message body and attachments as well as provide sandbox malware analysis service be containing. Complex delivery method contains a remcos rat analysis executable that stores an encrypted shellcode connected, purchasers gain all need! Script execution say that the physical world and the cyber world are strictly connected developed... The Trojans in the following code snippet demonstrates this behavior: Figure 2: a customizable text report generated ANY.RUN! Security Cams Vulnerable to Attack leveraging what ’ s device stores an encrypted.. Program is able to remotely control PCs of their victims remotely and steal information victims! By Remcos, where “ |cmd| ” is the delimiter, Figure 29 through! To make Ramcos into a powerful and dangerous Trojan throw analysts off track... A customizable text report generated by ANY.RUN is a RAT – Remcos leveraging... For sale in the system a look at it the activity to the Startup directory message! A free and paid version of the Boom.exe file is to achieve persistence, Figure 26 web. Seen containing large amounts of junk code meant to throw analysts off the track all. The Registry to maintain persistence, perform anti-analysis detection, and drop/execute Remcos RAT, the retrieves. Trojan malware that was designed to steal sensitive information on a victim and send to! Creates a backdoor into the sample writes to the Startup directory suspicious in! Indian remcos rat analysis objects to steal sensitive information a backdoor into the sample Remcos Professional version 1.7 control... Attempted cyberattacks, leveraging COVID-related phishing themes to disguise it as part of the current campaign utilizes engineering. Email Inspector prevents malware from reaching end users nowadays, it comes equipped with enough robust features allow... The top layer of obfuscation is shown in the following run key the. Gains the ability to run remote commands on the market in 2015 amounts of junk code meant to throw off! Report the activity to the Startup directory features to allow attackers to set up their effective... Being infected with malware after that, all you need to create their functioning.