Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally

A suspicious file named “GST Debit Note Apr_26.com,” which triggered a deeper investigation and revealed a polished, multi-stage steganographic loader delivering Remcos RAT and multiple infostealers across a global phishing campaign.

The initial sample arrived as an archive attachment and unpacked to a 32-bit .NET executable that was unsigned and packed, masquerading as a legitimate brick‑building game with Turkish-language artifacts to reduce user suspicion while running a decoy UI in the background.

Static and dynamic reversing showed the loader relies on embedded resources and steganography to conceal its next-stage payload.

One resource (SR1) contained a serialized .NET Bitmap used as a container for hidden data; the actor employs this image‑like object to smuggle a second‑stage loader (Optimax.dll) that is extracted and reconstructed entirely in memory.

The loader performs AppDomain.Load on a byte array (this.pf.ToArray<byte>()), avoiding disk writes and minimizing forensic artifacts.

This fileless, in‑memory chain is completed by a second in‑memory DLL, “[System Optimizer Ultimate.dll],” which in turn reconstructs and executes the final payload: Remcos RAT.

K7 Security labs said in a report shared with GBhackers, revealed that the payload was a variant of the Remcos RAT malware family, distributed via a phishing campaign as an archive attachment. 

At runtime the final Remcos payload uses process hollowing to masquerade as the default browser process chosen by the user, employs sandbox and VM checks (sbiedll.dll and registry markers like hardware/acpi/dsdt/vbox_), and escalates privileges via eventvwr.exe to bypass UAC.

Steganographic Loader Deploys Remcos RAT

The loader creates a randomized, superhidden self‑copy in AppData\Roaming and implements persistence through a Run registry entry, winlogon.exe and userinit modifications.

It also drops an obfuscated PowerShell script and an executable into the temporary directory; the dropped executable is configured for autorun via the Run key to ensure reinfection on logon.

Remcos establishes a mutex named “Remcos_Mutex_Inj” and begins comprehensive data‑gathering and surveillance: monitoring active window titles, tracking user idle time, logging window focus changes, and supporting audio and webcam capture.

It possesses credential theft modules targeting browser artifacts Chrome stored logins and cookies, Firefox stored credentials and writes stolen data into logs.dat.

Exfiltration of captured data occurs to a hardcoded command-and-control IP at 62.102.148.212. The sample also contains a full cleanup routine to remove traces after operations.

Pivoting through VirusTotal and metadata strings exposed a broader loader‑as‑a‑service pattern: the same infrastructure and “TuglaInsaatci” metadata house samples that deliver Agent Tesla, MassLogger variants, Phantom Stealer, RedLine, Formbook, Snake keyloggers, DarkCloud, xworm and commodity stealers.

Filenames using Indian banking and tax terms “NEFT”, “RTGS”, “IMPS”, “GST” indicate targeted lures for Indian recipients and corroborate observed Remcos deployments in the region.

These indicators show the operators rotate final payloads per customer demand, making the infrastructure modular and adaptable.

Defenders should treat this campaign as a high‑risk, fileless steganographic loader leveraging in‑memory .NET assembly loading, resource‑based steganography, and process hollowing to evade detection.

Recommended mitigations include enforcing application control and code signing policies, enabling behavioral EDR with in‑memory execution visibility, blocking known C2 IPs (such as 62.102.148.212) at network edge, and scanning inbound archives and attachments for steganographic artifacts.

Endpoint protections should detect AppDomain.Load patterns and suspicious PowerShell activity, and organizations should educate users to treat archive attachments with caution especially those using tax or banking lures.

IOCs

Names	Hash
Archive file	C2E25ABA8E2AD4CAFDD6C633B8CA0906
Gst debit bill Apr 2026.com	897ABF678EDAD72998554EC18675092F
Optimax.dll	AFE085B7324D72673EEF749FF5F21A49
System Optimizer Ultimate.dll	F3626A38FCF488C9EED54BEB8C7C116F
Remcos payload	4924369C0BDAF73B21EB992EB9DB4DEA
62.102.148.212:37393	Remcos C2
217.138.252.123:42830
146.70.244.90:37393

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.