Analysis of Batch based RemcosRAT Campaign

RemcosRAT is a remote access trojan (RAT) used for unauthorized access and control of a victim’s computer. RATs are malicious software that enable remote attackers to take charge of compromised systems, monitor activities, steal sensitive data, and execute harmful actions undetected.

As a commercial RAT, RemcosRAT is favored by cybercriminals for several malicious purposes, such as remote administration, surveillance, data theft, and facilitating the distribution of additional malware.

Infection Chain:

Sample Information:

Threat Name: RemcosRAT | Category: Injector | Classification: BackDoor

Technical Analysis of Batch Shell Script:

A Batch Shell command, often referred to as a Batch script or Batch file, is a script file in the Windows operating system. It comprises a series of commands written in the Batch Scripting language, designed to automate tasks, execute commands in sequence, and carry out specific operations on a Windows computer. These files have the “.bat” extension.

Batch Shell commands encompass several essential features and examples, including command sequencing, variables, conditionals, loops, and file operations.

Main Context of .bat Shell Script

In the mentioned malware sample, ‘@echo off’ disables command echoing, ‘echo’ displays the message, and ‘pause’ pauses execution until the user presses a key. It is commonly used to prevent the commands within the batch file from being displayed on the screen as they are executed. This can make the execution of the batch file appear cleaner and more professional, as users won’t see each command being echoed to the screen. Malware authors usually employs the “echo off” command for several reasons:

• Stealth: Malware often seeks to operate unnoticed on a victim’s system. By using “echo off,” malware authors can prevent the user from seeing the malicious commands being executed, making it less likely for the user to realize that something malicious is happening.
• Avoid Suspicion: If a user/victim were to see a series of unfamiliar commands running on their system, they might become suspicious and investigate further. “Echo off” helps malware avoid raising such suspicions.
• Cleaner Presentation: Just as with legitimate batch files, “echo off” can make the execution of malicious commands appear more organized and professional, also giving the users a false sense of security.
• Prevent Errors: Some malware might be designed to execute a series of commands, and echoing each command could potentially lead to errors or confusion in the output. By turning off echoing, malware authors can prevent this from happening.
• Batch Shell commands find extensive utility in automating repetitive tasks, configuring systems, and executing multiple commands in a predefined sequence. They are commonly employed for administrative and scripting purposes on Windows machines.

Embedded Obfuscated Powershell Command:

An obfuscated PowerShell command is a script or command intentionally concealed to conceal its actual intent or functionality. Malware authors and attackers use obfuscation to make their malicious PowerShell code harder to detect and analyze by security tools and researchers.

The objective of obfuscation is to make the PowerShell command appear innocuous or legitimate, while, in truth, it could be carrying out harmful actions like downloading and executing malware, pilfering sensitive data, or exploiting vulnerabilities.

Hard – Coded Powershell Command:

Obfuscation techniques applied to PowerShell commands encompass character substitution, string encoding, variable concatenation, code splitting, nested functions, and alterations in whitespace and formatting.

Here they used string encoding technique.

Malicious Communicating Files:

Indicator of Compromises:

The submitted IP address has been blacklisted, indicating that it is a harmful website that hosts malicious payload files.

File hashes:

MITRE ATT&CK Tactics & Techniques: