Analysis of Remcos JS Campaign

Remcos is a remote access trojan malware which is used to take remote control over infected PCs. Once Remcos RAT infects the system, a threat actor has the ability to execute remote commands on the user’s system. Also, Remcos RAT gives them an option to run a keylogger and/or conduct surveillance (audio + screenshots) activity on the system.

Infection Chain

Remcos RAT infects its victims by initial infection vectors of spam emails. This kind of email file comes with password-protected archives format attachments, which contains the JavaScript file. Usually, these .JS files are embedded with malicious URL to download the payload file, likewise it uses known infection from [tgc8x.XX] domain in-order to download the payload files.

The initial vectors may vary depending on their targets and we all know that the threat actors perform basic reconnaissance methodologies to decide their infection vector.

Sample Information

Technical Analysis of Javascript loader

This sample is a plain text file that contains JavaScript code and executes JS instructions on a webpage. JavaScript files can contain variables, operators, functions, conditions, loops, arrays, objects, etc. Given below is a brief overview of the syntax of JavaScript.

• Each command ends with a semicolon(;).
• Use the var keyword to declare variables.
• Supports arithmetic operators ( + – * / ) to compute values.
• Single line comments are added with // and multiline comments are surrounded by /* and */.
• All identifiers are case-sensitive i.e., modelNo and modelno are two different variables.
• Functions are defined by using the function keyword.
• Arrays can be defined using square brackets [].
• JS supports comparison operators like ==, != , >=, !==, etc.
• Classes can be defined using the class keyword.

The above-mentioned snapshot shows the entire content in the JS file, here the codes are encoded. If we decode it, we will get the decoded values.

Embedded Functions

The decodeURIComponent() function is used to decode URI components. In other words, it is useful when you want a quick URL decode.

Get-Special folder specifications

Dropped PE File

Once the C2 (command and control) server is connected or tunnelled, it proceeds to drop a payload file in the %Appdata%. From there, it will start the system infection and data exfiltration.

C2 Look-up in the Application Layer

Once the system is infected, the following action will be performed

• Contextual System Data/User Information about the system may have been stolen.
• Using Brute forcing attack, the user credentials can be stolen.
• Keylogging and surveillance can be initiated by threat actor.
• Digital coins may have been stolen.
• The affected system may be susceptible to further attacks and/or infection due to a backdoor that gets executed.

Indicators of Compromise