Remcos RAT campaign delivers new variant using AutoIt wrapper

guest · Aug 16, 2019

Remcos RAT campaign delivers new variant using AutoIt wrapper
August 15, 2019
https://www.scmagazine.com/home/sec...gn-delivers-new-variant-using-autoit-wrapper/

Researchers have discovered a new Remcos RAT campaign that uses an AutoIt wrapper to deliver a previously unknown variant featuring new obfuscation and anti-debugging techniques.

“The email includes the malicious attachment using the ACE compressed file format, Purchase order201900512.ace, which has the loader/wrapper Boom.exe,” wrote blog author and Trend Micro malware researcher Aliakbar Zahravi, noting that the executable’s chief purpose is to “achieve persistence, perform anti-analysis detection, and drop/execute Remcos RAT on an affected system.”

Zahravi further noted that the AutoIt loader can detect virtual machine environments and debugger programs, and that the malware bypasses User Account Control using one of two tools, depending on the victim’s version of Windows.
Click to expand...

Trend Micro: Analysis: New Remcos RAT Arrives Via Phishing Email

Log in or Sign up

Remcos RAT campaign delivers new variant using AutoIt wrapper

guest Guest

Log in or Sign up

Remcos RAT campaign delivers new variant using AutoIt wrapper

guest Guest

Useful Searches