Full Report
Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys security researcher Akshay Thorve said in a technical report. "The attack chain leverages mshta.exe for
Analysis Summary
# Tool/Technique: Remcos RAT
## Overview
Remcos RAT is a well-known Remote Access Trojan that provides threat actors with full control over compromised systems, frequently used for cyber espionage and data theft. This specific campaign utilizes a fileless execution method involving a PowerShell-based shellcode loader.
## Technical Details
- Type: Malware Family (RAT)
- Platform: Windows
- Capabilities: Full remote control, system metadata gathering, keystroke logging, screenshot capture, clipboard monitoring, installed programs/running process listing, persistent C2 communication.
- First Seen: Not specified, but an actively evolving variant is described.
## MITRE ATT&CK Mapping
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell
- T1027 - Obfuscated Files or Information
- T1027.004 - Fallback Encoding
- T1547 - Boot or Logon Autostart Execution
- T1547.001 - Registry Run Keys / Startup Folder
- T1071 - Application Layer Protocol
- T1071.001 - Web Protocols (Implied by TLS connection)
## Functionality
### Core Capabilities
- Establishes a persistent C2 connection via TLS.
- Gathers system information (metadata, installed programs, running processes).
- Captures sensitive user data (keystrokes, clipboard content, screenshots).
### Advanced Features
- Deployed filelessly using a PowerShell-based shellcode loader executed entirely in memory, aimed at evading disk-based detection.
- Achieves persistence via Windows Registry modification to ensure an HTA file autoloads upon startup.
## Indicators of Compromise
- File Hashes: N/A (Fileless execution primary focus)
- File Names: xlab22.hta, 311.hta (Decoy PDF mentioned)
- Registry Keys: Keys modified to ensure "311.hta" autostarts (Specific keys not detailed).
- Network Indicators: readysteaurants[.]com (C2 server)
- Behavioral Indicators: Execution of MSHTA.exe to run obfuscated HTA files; decoding and reconstruction of shellcode in memory by PowerShell.
## Associated Threat Actors
Threat actors utilizing sophisticated fileless delivery methods (implied general threat actors exploiting commodity malware methods). Associated with campaigns using LNK/ZIP/mshta.exe delivery chains.
## Detection Methods
- Signature-based detection: Less effective against fileless/in-memory execution.
- Behavioral detection: Essential for detecting suspicious PowerShell command-line arguments, HTA execution via mshta.exe, and shellcode loading behavior.
- YARA rules: Could be developed for patterns within the in-memory shellcode or the obfuscated scripts.
## Mitigation Strategies
- Advanced email security capable of detecting and blocking malicious LNK attachments within archives before they reach users.
- Real-time scanning of PowerShell commands for suspicious behaviors (e.g., decoding/deobfuscation, memory injection patterns).
- Application whitelisting or constraints on mshta.exe execution from unusual parent processes.
## Related Tools/Techniques
- **Loading Mechanism:** PowerShell-based shellcode loader; MSHTA.exe proxy execution; LNK files delivered via ZIP archives.
- **Associated Payload Delivery Systems:** .NET multi-stage loader (capable of delivering Remcos RAT along with Agent Tesla, NovaStealer, etc.) which uses encrypted bitmap resources for staging.
***
# Tool/Technique: PowerShell-based Shellcode Loader
## Overview
A method used in the Remcos RAT campaign that executes malicious code entirely in memory. It leverages PowerShell to decode and reconstruct a shellcode loader, which subsequently launches the final Remcos RAT payload without writing significant traces to disk.
## Technical Details
- Type: Technique/Loader Framework
- Platform: Windows
- Capabilities: In-memory execution, shellcode reconstruction, bypassing disk-based security controls.
- First Seen: Not specified for this exact variant, but fileless PowerShell execution is an established technique.
## MITRE ATT&CK Mapping
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell
- T1204 - User Execution
- T1204.002 - Malicious File
- T1620 - System Command Discovery (Implied by reconnaissance needed for deployment)
## Functionality
### Core Capabilities
- Decodes and reconstructs malicious shellcode.
- Executes the shellcode loader directly in memory.
- Deploys the final-stage malware payload (Remcos RAT).
### Advanced Features
- Highly effective in achieving fileless execution.
## Indicators of Compromise
- File Hashes: N/A
- File Names: N/A (Operates via recalled script/in-memory artifacts)
- Registry Keys: N/A
- Network Indicators: N/A (Execution phase is internal to memory)
- Behavioral Indicators: Unusual PowerShell command-line arguments indicating decoding or injection; presence of injected code in legitimate process memory space.
## Associated Threat Actors
Threat actors employing advanced techniques to avoid traditional endpoint detection and response (EDR) systems.
## Detection Methods
- Behavioral detection focusing on PowerShell attempting memory injection or suspicious process hollowing.
- Memory forensics and analysis.
## Mitigation Strategies
- Constraining PowerShell logging/transcription capabilities to capture executed commands.
- Reducing the attack surface by restricting how applications like MSHTA can invoke PowerShell.
## Related Tools/Techniques
- MSHTA.exe execution chain.
- .NET multi-stage loaders.
***
# Tool/Technique: MSHTA.exe Proxy Execution
## Overview
The use of `mshta.exe` (Microsoft HTML Application Host) as a proxy or initial execution vector to launch malicious content, specifically an obfuscated HTA file (`xlab22.hta`) which further downloads subsequent malicious components.
## Technical Details
- Type: Technique/Living off the Land Binary (LOLBin) Abuse
- Platform: Windows
- Capabilities: Executing HTML Applications from a remote source; initiating downloads of subsequent stages (VBScript/PowerShell).
- First Seen: Leveraged by numerous threats historically.
## MITRE ATT&CK Mapping
- T1218 - Signed Binary Proxy Execution
- T1218.005 - MSHTA
## Functionality
### Core Capabilities
- Executes HTA files that are hosted remotely.
- Acts as a legitimate process bypassing certain application controls.
### Advanced Features
- Used in conjunction with obfuscated VBScript/HTML application code (in `xlab22.hta`) to retrieve and execute a secondary malicious payload (PowerShell script).
## Indicators of Compromise
- File Hashes: N/A
- File Names: xlab22.hta
- Registry Keys: N/A
- Network Indicators: Connection to retrieve xlab22.hta.
- Behavioral Indicators: mshta.exe spawning processes or downloading files, especially when launched via an LNK shortcut.
## Associated Threat Actors
Threat actors leveraging common Windows tool features for initial access/execution.
## Detection Methods
- Monitoring the invocation of mshta.exe, especially when paired with suspicious command-line arguments or launched from user download directories.
- Analyzing the code embedded in downloaded HTA files.
## Mitigation Strategies
- Restricting the execution parameters or contexts allowed for mshta.exe via application control policies (e.g., AppLocker, WDAC).
## Related Tools/Techniques
- LNK file delivery mechanism.
- VBScript execution.
***
# Related Campaign/Tool Details Mentioned
The article also references several contemporary threat activities:
| Tool/Technique | Type | Primary Function | Delivery/Context |
| :--- | :--- | :--- | :--- |
| **.NET Multi-Stage Loader** | Loader Framework | Stages encrypted payloads (includes Remcos, Agent Tesla, etc.) using a bitmap resource for concealment (steganography). | Dropped by a multi-stage .NET executable/DLL chain. |
| **KeeLoader** | Malware | Trojanized KeePass installer used to drop Cobalt Strike and steal KeePass database data/credentials. | Distributed via Bing ads pointing to KeePass typosquat domains. |
| **Lumma Stealer** | Malware (Information Stealer) | Deployed via ClickFix lures and URLs embedded in PDF documents. | Multi-stage dropper URLs used for final delivery. |
| **Formbook** | Malware (Information Stealer) | Deployed via document exploits protected by Horus Protector. | Booby-trapped Microsoft Office documents. |
| **Blob URIs Abuse** | Technique | Used in phishing emails to locally load credential phishing pages using abused trusted domains (e.g., onedrive[.]live[.]com). | Bypassing security segments/evasion. |
| **NetSupport RAT** | Malware (RAT) | Distributed via RAR archives masquerading as setup files. | Targeting Ukraine and Poland. |
| **HTML Attachments (Telegram Bot)** | Payload/Delivery | Phishing emails delivering HTML attachments that steal Outlook/Gmail/Hotmail credentials sent to "Blessed logs" Telegram bot. | Credential harvesting via Telegram exfiltration. |
| **AI-Powered Campaigns** | General Trend | Used to automate malware dev and personalize polymorphic phishing content (mutating subjects/senders) to bypass filters. | Evasion of signature-based and perimeter defenses. |