Risk actors have given the commercially out there Remcos distant entry software a brand new malicious makeover, wrapping its malware code in a number of layers of various script languages, together with JavaScript, VBScript, and PowerShell, to keep away from detection and evaluation and obtain full takeover of Microsoft Home windows units.
New findings from Fortinet researcher Xiaopeng Zhang warn Microsoft Home windows customers a few new marketing campaign utilizing this new-and-improved model of Remcos RAT that exploits a recognized distant code execution (RCE) vulnerability arising from how unpatched Microsoft Workplace and WordPad cases parse recordsdata.
The assault chain begins with a phishing electronic mail meant to lure customers into clicking an Excel file disguised as a enterprise order, in line with the report. As soon as the file is activated it exploits the bug (CVE-2017-0199) and downloads the malware payload.
Remco’s New Model Is Good at Avoiding Evaluation
“Its code is wrapped in a number of layers utilizing totally different script languages and encoding strategies, together with JavaScript, VBScript, Base64-encoded, URL-encoded, and PowerShell, to guard itself from detection and evaluation,” in line with the researcher. “As soon as the downloaded exe file, dllhost.exe, begins, it extracts a batch of recordsdata into the %AppData% folder. A number of the key information are hidden in these recordsdata.”
From there, the host runs a bit of closely obfuscated PowerShell code that, importantly, works solely on the 32-bit PowerShell course of, the report added.
Subsequent, the malware runs self-decryption code hidden beneath a rat’s nest (pun meant) of pointless code to keep away from evaluation. However that is not the solely subtle evasion method utilized by the most recent model of malicious Remcos RAT. In accordance with the report, the marketing campaign throws up a number of evaluation street blocks all through the assault chain, together with putting in a vectored exception handler, and gaining and calling system APIs in an inconsistent, arduous to trace method. It additionally makes use of a software referred to as “ZwSetInformationThread()” to verify for a debugger, the report added.
“The malicious code calls API ZwSetInformationThread() with the argument ThreadHideFromDebugger (0x11) and the present thread (0xFFFFFFFE). This mechanism in Home windows can conceal a thread’s existence from debuggers,” defined Zhang. “If a debugger is connected to the present course of, it exits instantly as soon as the API known as.”
The malware additional makes use of an API hooking method to keep away from detection.
“The malicious code simulates executing a number of API directions (say, two directions) at the start after which jumps to the API to execute the remainder of the directions (starting with the third instruction),” in line with the report. “At any time when any … detection circumstances are triggered, the present course of (PowerShell.exe) can turn into unresponsive, crash, or exit unexpectedly.”
As soon as prepared, the risk actors obtain an encrypted file with the malicious model of Remcos RAT that’s run in present course of’s reminiscence, successfully making this newest variant fileless, the report identified.
Defend With Patching, Coaching, and Endpoint Safety
“Remcos collects some fundamental info from the sufferer’s system,” Zhang added. “It then encrypts and sends the collected information to its C2 server to register that the sufferer’s system is on-line and able to be managed.”
Anti-analysis and tough obfuscation strategies apart, Darren Guccione, CEO and founding father of Keeper Safety, famous in an emailed assertion that low-tech phishing and social engineering that stay among the many very most harmful enterprise cybersecurity threats.
“Stopping these assaults requires a mix of technical defenses and worker consciousness,” he wrote. “Recognizing crimson flags, corresponding to uncommon senders, pressing requests and suspicious attachments, may also help cut back human error. Common coaching and strong safety measures empower staff to behave as the primary line of protection.”
Sturdy endpoint safety must also be a precedence to defend in opposition to these kinds of assaults, in addition to a fundamental patch administration technique, in line with an announcement from Stephen Kowski, area CTO for SlashNext E-mail Safety+.
“Safety requires a multi-faceted method: conserving Microsoft Workplace absolutely patched, implementing superior electronic mail safety to detect and block malicious attachments in actual time, and deploying fashionable endpoint safety to establish suspicious PowerShell behaviors,” Kowski commented. “Most critically, since this assault depends on social engineering via phishing emails, organizations ought to guarantee their staff obtain common safety consciousness coaching centered on figuring out suspicious attachments and buying order-themed lures.”
