{ "Event": { "analysis": "1", "date": "2026-05-29", "extends_uuid": "", "info": "[Threat Intel] Reloaded in a modern Remcos RAT Infection", "protected": false, "publish_timestamp": "1780521441", "published": true, "threat_level_id": "3", "timestamp": "1780521441", "uuid": "8851f4ff-ce5e-4109-a60f-6bdb729a78d5", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6af4de", "local": false, "name": "misp-galaxy:producer=\"G DATA\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780311610", "to_ids": false, "type": "link", "uuid": "90de851a-feb4-4714-b45e-38d02b9725b6", "value": "https://blog.gdatasoftware.com/2026/05/38426-donutloader-remcos-rat" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780311610", "to_ids": false, "type": "text", "uuid": "f67ef4f9-de0e-464d-be7f-fc1df1a7025f", "value": "Analysts discovered a new Remcos RAT infection chain starting with a batch file executing encoded commands that creates hidden directories and retrieves encrypted payloads. Unlike earlier campaigns relying on PowerShell-hosted .NET loaders, this variant incorporates DonutLoader shellcode and AutoIt-based staging for in-memory payload delivery. The infection begins with a phishing email containing a malicious batch file named Bestellung.CMD. The chain abuses legitimate Windows utilities including cscript.exe and SyncAppvPublishingServer.vbs to execute Base64-encoded payloads. Additional components are downloaded from cloud storage, including 7Zip tools and password-protected archives containing obfuscated JScript. The final payload consists of DonutLoader shellcode that injects Remcos RAT version 7.2.1 Pro into colorcpl.exe, enabling remote control, credential harvesting, keystroke logging, and additional payload deployment." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780311610", "to_ids": false, "type": "text", "uuid": "4d3dbdd8-77ba-470c-936e-04d65d3cbe5f", "value": "Name: Reloaded in a modern Remcos RAT Infection\nAuthor: AlienVault\nAdversary: \nTags: [\"shellcode\", \"autoit\", \"process injection\", \"donutloader\", \"lolbins\", \"in-memory execution\", \"phishing\", \"remcos rat\"]\nTgtd countries: []\nMlwr families: [\"Remcos RAT\", \"DonutLoader\"]\nAttack_ids: [\"T1560.001\", \"T1059.007\", \"T1566.001\", \"T1071\", \"T1140\", \"T1219\", \"T1036\", \"T1055\", \"T1218\", \"T1059\", \"T1059.001\", \"T1027\", \"T1564.003\", \"T1059.003\", \"T1059.005\", \"T1105\"]\nIndustries: []" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780497993", "to_ids": true, "type": "sha256", "uuid": "b9bd757f-833a-4357-a59e-9bc8278d065d", "value": "48bd36c3b8d6a3bf5db4e7b0bbc1692e8cb900475dc7ae16e9f1fa7ba97c8adf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780498128", "uuid": "ec769a03-5195-4221-8aad-6dfd46a2cc5d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780498128", "to_ids": true, "type": "md5", "uuid": "d4d5b299-d656-4cea-9b03-00aadac9aba5", "value": "25aef77ec008ed65d513a47352deaa8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780497990", "to_ids": true, "type": "sha1", "uuid": "1066815c-7729-40e2-bbf4-d4c9d774cec1", "value": "6e1062d7b1c241a177509baa8bd7c7381aa6b2a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780497990", "to_ids": true, "type": "sha256", "uuid": "92c0422d-c1de-4aba-9547-d15d4358c1bb", "value": "5b3089eefab0e043af8894de86022bdc6df2f42f7098dbd530f42c0ec861d5d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496211", "to_ids": true, "type": "ssdeep", "uuid": "da03f17b-d4b1-4000-a05b-2eda26f86d8e", "value": "768:mmutiQDifVU+B1zCBa/u3jJQcdEnaszrW3MwG/fieU4T2/ZyfvMNLY5:mprDifVU+GooCcGnXfW3MwQi/Ao0j" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496211", "to_ids": false, "type": "size-in-bytes", "uuid": "5deca5ef-dcb5-4e46-951f-ff0a0657a0ba", "value": "82774" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496211", "to_ids": true, "type": "filename", "uuid": "003ee174-274c-4630-90bb-b5e0a5b44d9c", "value": "Bestellung.CMD" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496211", "to_ids": false, "type": "text", "uuid": "c396b873-551b-4e7a-b661-3b09549ab265", "value": "Type Description: DOS batch file\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:27/61\nFirst Submission:2026-03-23T11:24:52.000000+00:00\nLast Submission:2026-03-30T13:25:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780498149", "uuid": "3f6dd147-a957-4cdf-8d9b-50352dd749d1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780498149", "to_ids": true, "type": "md5", "uuid": "85a59a7b-16b6-45ba-a409-cb6d4f8a6f29", "value": "51000fd9112700f61730ab44e87e772d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780497991", "to_ids": true, "type": "sha1", "uuid": "689a2a2e-d786-4797-b5d5-65b70019dfff", "value": "abf4f61932d3f987d45cdeb28239fb37e57f4bb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780497991", "to_ids": true, "type": "sha256", "uuid": "b9736050-4283-4f8b-a333-5a62c08e77a0", "value": "14a0d7978872a2739ac31ef42539e8c708af6afccc5eb74f22fe2b676bfa2df7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496232", "to_ids": true, "type": "ssdeep", "uuid": "4984cdd6-e96c-4fe0-82e6-61514303904f", "value": "98304:4U75+VfNjMkNnkNtRm1h3QkeDxXoyJcN3bF4I2FeRDv+T0bIxGnFL7w3LYsLwxQg:fkVVjt8QDeKywx7VPBELYkZ0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496232", "to_ids": false, "type": "size-in-bytes", "uuid": "442e6fd0-2c83-432f-b52f-c0bff7dc9739", "value": "5781763" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496232", "to_ids": true, "type": "filename", "uuid": "5b29fed8-9e9c-4ac9-aec7-5395a31cd22a", "value": "iphdcrtj.JS" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496232", "to_ids": false, "type": "text", "uuid": "56cf1ebf-2ec0-47d2-8803-7c168ca42a9d", "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:16/62\nFirst Submission:2026-03-23T15:30:10.000000+00:00\nLast Submission:2026-03-23T15:30:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780498170", "uuid": "aaf66b2d-d7c2-4e5b-81c4-15648a5fa11c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780498170", "to_ids": true, "type": "md5", "uuid": "a3b0faa7-8134-4615-b7c4-69b59d68d000", "value": "0d11bc2325620de8f378e7f2b0fed04f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780497993", "to_ids": true, "type": "sha1", "uuid": "c6d6f064-9cb6-40dc-a81a-ccbcef77bf42", "value": "0e059038ab6aea32a8788fb7ff2b995581a5995d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780497993", "to_ids": true, "type": "sha256", "uuid": "19765cc3-027c-4060-9246-364f328c9e48", "value": "b9da295c34accf3632c2c4b6d9e3c74791b4514d27814f79e9bcb77ce168a347", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496275", "to_ids": true, "type": "ssdeep", "uuid": "78ceeca2-c445-4703-8188-7981717b3b80", "value": "768:FeNtly8QNtYbvYYREYYL5QQNVv9avQZFblQUZdb/QUZdb5QUZdbiOYmezjJDwYN0:FeNtly8QNtYbvYYREYYL5QQNVvQQZFb/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496275", "to_ids": false, "type": "size-in-bytes", "uuid": "490e21f8-1527-4a9f-870d-b3a6ba993e72", "value": "26868" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496275", "to_ids": true, "type": "filename", "uuid": "aaaceca2-0801-4a91-bc82-43dfa0540917", "value": "USCSHBRBWUYUCQNUIBPWLVUFKIAGWBOOAKDDXWTGRUVHWXIHQQRQXJASLKLALICCV.png" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496275", "to_ids": false, "type": "text", "uuid": "8a245c2b-6a72-4f05-ab53-3f37552ca102", "value": "Type Description: Text\nMicrosoft: Trojan:AutoIt/FormBook.VD!MTB\nVT Total Detection:18/62\nFirst Submission:2026-03-23T15:38:11.000000+00:00\nLast Submission:2026-03-23T15:38:11.000000+00:00" } ] } ] } }