Remcos RAT Attack Uses Obfuscated Scripts, Trusted Windows Tools

Remcos RAT operators are abusing obfuscated scripts and trusted Windows binaries to deliver a stealthy, largely fileless infection chain that runs almost entirely in memory and evades traditional defenses.

The attack starts with a phishing email carrying a ZIP archive named “MV MERKET COOPER SPECIFICATION.zip,” designed to resemble a legitimate business specification document and lure a user into opening it.

Inside the archive, attackers hide a heavily obfuscated JavaScript file, MV MERKET COOPER SPECIFICATION.js, which is executed via Windows Script Host when the user double‑clicks the attachment.

Static inspection of the script reveals dense string‑mapping functions and encoded arrays that conceal URLs, commands, and object names, frustrating quick triage and signature-based detection.

At Point Wild, our threat research team recently analyzed a malicious .eml sample that shows how Remcos campaigns are evolving toward multi-stage, script-driven, and fileless operations.

After deobfuscation, the script’s purpose becomes clear: it creates key ActiveX objects such as WScript.Shell for command execution, MSXML2.XMLHTTP for HTTP communications, and Scripting.FileSystemObject for local file operations, then reaches out to download the next-stage PowerShell payload from hxxps://almacensantangel[.]com/ENCRYPT.ps1.

The payload is launched with execution-policy bypass flags (for example, “-nop -ep bypass”), ensuring that even hardened PowerShell configurations cannot easily block the script.

Remcos RAT Attack

The downloaded ENCRYPT.ps1 script implements a layered obfuscation and decryption framework designed to keep the core payload off disk.

First, the main data blob is stored as a large Base64 string in a container variable, masking the underlying code from basic inspection tools and many static scanners.

A reconstruction routine strips newline characters and uses [Convert]:: FromBase64String to turn both the payload and its key material into raw byte arrays, feeding a rotational XOR decryption function that walks the payload byte by byte with a dynamically changing key index.

A dedicated decoder function orchestrates this chain, invoking Base64 reconstruction, applying rotational XOR, and converting the decrypted bytes back into a UTF‑8 script that is never written to disk.

An execution handler then attempts multiple execution paths Invoke‑Expression, inline execution, and ScriptBlock invocation using try‑catch logic to guarantee that the decrypted script runs even if one method fails.

This decrypted script introduces a second execution layer: it contains a large Base64 blob which, once decoded and analyzed, is identified as ALTERNATE.dll, a compiled .NET assembly loaded reflectively in memory using .NET reflection APIs.

By loading ALTERNATE.dll directly into memory and dynamically resolving its methods, the malware avoids creating PE files on disk and hinders both filesystem‑based detection and forensic reconstruction.

The script continuously evaluates runtime conditions and only triggers execution when checks such as the presence or state of aspnet_compiler.exe are satisfied, blending anti‑analysis safeguards with controlled deployment.

LOLBins and C2 Activity

Deeper analysis exposed a second embedded payload stored as a raw byte array whose first bytes decode to “MZ,” confirming a valid Portable Executable, ultimately reconstructed as Cqeqpvzeia.exe.

Instead of launching this binary directly, the operators exploit aspnet_compiler.exe a legitimate Microsoft .NET utility as a Living‑off‑the‑Land Binary to host or proxy the malicious code, a pattern consistent with other modern Remcos Rat campaigns abusing the same binary.

This approach gives the final payload the cover of a trusted process while supporting in‑memory injection and reflective execution techniques.

Network telemetry shows aspnet_compiler.exe repeatedly establishing TCP connections from the victim host to 192[.]3[.]27[.]141:8087, with continuous send/receive operations indicating active C2 communication rather than a one‑off beacon.

Packet captures reveal that this traffic carries Windows PE content, including an MPRESS‑packed executable and references to ProgramData\Remcos\logs.dat, aligning with known Remcos behavior where the RAT creates local logs.dat files to store keylogging and surveillance data prior to exfiltration.

Screenshots and process monitoring confirm active keystroke logging and local data staging, indicating the victim system has transitioned from initial compromise to full remote surveillance under Remcos control.

This campaign underscores how Remcos operators now chain phishing, obfuscated JavaScript, encoded PowerShell, in‑memory .NET loaders, and LOLBins into a cohesive, largely fileless intrusion that sidesteps legacy antivirus focused on single executables.

Effective defense requires visibility into script execution, PowerShell telemetry, LOLBin abuse, and outbound C2 patterns, not just file hashes and on‑access scanning.

UltraAV, powered by Point Wild, targets these weak points by flagging obfuscated script activity, recognizing encoded and packed payload patterns, and blocking known malicious URLs, binaries, and Remcos-specific IOCs across the kill chain.

Even when attackers minimize disk artifacts, they still rely on observable components such as suspicious scripts, encoded blobs, LOLBin misuse, and repeat C2 connections to infrastructure like 192[.]3[.]27[.]141:8087.

Focusing monitoring and detection on these behaviors allows defenders to disrupt Remcos campaigns early ideally at the phishing or loader stage before the RAT can establish persistent, in‑memory control of victim systems.

Indicators of Compromise (IOCs)

Md5/File name	Description
75b7ed9f524cdb1c6f044864c4d3353c	Initial eml file(Phishing email)
a739d0c4821d2bc1b8a226a5d8846c28	MV MERKET COOPER SPECIFICATION.zip
a5c70d896526146238a15a93dfdb2f97	MV MERKET COOPER SPECIFICATION.js
https[:]//almacensantangel[.]com/ENCRYPT[.]Ps1	Malicious payload delivery URL.
d79dbfab8af7a6f19b6abf934a90c1b7	ENCRYPT.Ps1
957b2710fef66141707064c76f1dd1a9	ALTERNATE.dll
508c092eaf1c1a178195aadfa1b7ecae	Cqeqpvzeia.exe
192[.]3[.]27[.]141[:]8087	C2 server
0a9728de22d85c6a2b375924bfb643dc	MPress Packed payload delivered from C2 server

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.