Fileless Remcos RAT Attack Uses JavaScript and PowerShell to Slip Past Detection

A recent Remcos RAT campaign showcases how commodity malware has fully embraced fileless, multi‑stage execution to bypass traditional defenses and remain stealthy on compromised Windows systems.

Instead of dropping a static executable to disk, the operators rely on JavaScript, PowerShell, and a managed .NET injector to execute Remcos entirely in memory, dramatically reducing forensic artifacts and opportunities for signature-based detection.​

The attack begins with procurement‑themed phishing emails posing as request‑for‑quotation (RFQ) correspondence from a supposed marine or industrial vendor.

These emails carry an archived attachment that appears to be a quotation document but actually contains a misleadingly named JavaScript file.

When the victim opens this script, it issues an HTTP request to attacker‑controlled infrastructure and downloads the next stage, keeping the initial logic minimal to avoid drawing attention.​

The downloaded content is an AES‑encrypted PowerShell script that is handled directly in memory instead of being written to disk.

This design reflects a modular approach where the JavaScript delivers the payload, while all heavy‑lifting decryption, loading, and persistence is delegated to subsequent stages.​

Remcos RAT campaign identified during analysis that demonstrates this transition in practice from phishing-based initial access to fully fileless execution using JavaScript, PowerShell, and a managed .NET injector. 

Fileless Remcos RAT

Once decrypted, the PowerShell script acts as a fully fileless loader that reconstructs the payload from multiple encoded fragments and decrypts it in memory using AES‑256 CBC and embedded Base64‑encoded key and IV values.

It then loads two components directly into memory: a Base64‑encoded .NET injector assembly and the Remcos RAT payload provided as raw decimal byte data.​

The payload is reconstructed from multiple encoded fragments and decrypted using AES-256 CBC with PKCS7 padding, with no artifacts written to disk.

The .NET injector is reflectively loaded without touching the file system and is responsible for process hollowing a legitimate Windows binary, aspnet_compiler.exe.

By creating this trusted process in a suspended state, replacing its memory with the Remcos payload, and then resuming execution, the malware hides inside a signed .NET utility and inherits its identity.

This significantly complicates both behavioral and signature‑based detections that rely on process names, paths, or simple parent‑child relationships.​

Inside the hollowed aspnet_compiler.exe process, Remcos RAT runs as a Visual C++ compiled executable of roughly 481.5 KB, operating entirely from memory. The final payload REMCOS RAT is a VisualC++ compiled executable file of size 481.5kb.

Its first step is a runtime initialization routine that dynamically resolves required Windows APIs at execution time, minimizing static imports and hindering signature‑based inspection.​

The malware then decrypts its configuration from an embedded resource named “SETTINGS” using an RC4 key, recovering details such as C2 domains, port 2404, hostname “RemaHost1,” mutex name “Rmc‑ZOCNDU,” and file names used for keylogging data.

It creates the mutex to enforce single‑instance execution and aborts or alters behavior if another active infection with the same campaign ID already exists on the host.

Following this, Remcos profiles the operating system and architecture, distinguishing between Windows 10 and Windows 11 by parsing the CurrentBuildNumber registry value, and appends these details to the system profile for later C2 registration.​

Mitigations

Before contacting its C2, the RAT creates a local log file at C:\ProgramData\rema\logs.dat to buffer surveillance output and runtime events when network exfiltration is not immediately possible.

Observed log entries show offline keylogging activity along with process identifiers, thread context, privilege level, and clipboard capture events stored in plaintext, ready for staged exfiltration.​

Once initialization and profiling are complete, Remcos opens an outbound TCP connection to its configured C2 server encryption, with internal status buffers indicating “Connected | TLS Off,” confirming that transport‑layer encryption is disabled.​ 

It then sends a host registration beacon containing the hostname “RemaHost1,” campaign identifier “Rmc‑ZOCNDU,” OS details (for example, Windows 10 Enterprise 64‑bit), process metadata, privilege level, executable paths, hardware information, and the location of the local log file.​ 

Although the traffic can appear malformed under industrial protocols such as IEC 60870‑5‑104, it is in fact a custom delimiter‑based C2 protocol carried over raw TCP.​

This campaign underlines how everyday threats now use multi‑stage, fileless techniques including layered scripting, in‑memory decryption, process hollowing, and abuse of trusted binaries to evade traditional disk‑based detection.

Defenders should focus on memory‑centric and behavior‑based telemetry: constrained script execution, PowerShell logging, command‑line monitoring, process creation anomalies, and detection of hollowed or injected processes.​

Practical hardening steps include restricting the misuse of native tools such as PowerShell and wscript, enforcing least‑privilege, segmenting networks, and improving phishing resilience through continuous awareness training.

Organizations should also centralize logs from endpoints, email gateways, and network sensors to support proactive threat hunting for fileless malware patterns similar to this Remcos RAT campaign.

Indicators of Compromise (IOCs)

Type	Samples	Description
Email	de59f9c1b237af2b27df59a6cec82fd2	Phishing email – Request for Quotation – Coaxial Cable, Solar, Surge Relay
RAR	47b1603f62306dfa34bd7d52b7159c7f	Price Offer_PT. Asianfast Marine Industries I6799006392.r01
JS	c2b601dc165fa0b4837019f1152d005a	JavaScript downloader attachment
PS1	6f61c2917c7dac70b4703700b3aafb33	PowerShell__script_layer1
PS1	ffe4dc0ebc7b0b76d95dad2f383f6034	PowerShell__script_layer2
DLL	e7983c9dc42001baeafedebdaba8b310	.NET injector (MAFFIA.dll)
EXE	df8a0d943f6df9394f0116521536a938	Remcos RAT payload
IP	91.92.243.550	Command-and-control server
Domain	eaidali[.]ddns[.]net	malicious domain
Domain	www[.]lmfire[.]net	malicious domain
URL	http[:]//eaidali[.]ddns[.]net:2404/	malicious url
URL	http[:]//www[.]lmfire[.]net:2404/	malicious url

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.