Watch out, that Excel document could be infected with dangerous malware

• A new phishing campaign was recently spotted, distributing an Excel file
• The file drops a fileless version of the Remcos RAT on the device
• Remcos can steal sensitive files, log keys, and more

Hackers have been seen distributing a fileless version of the Remcos Remote Access Trojan (RAT), which they then use to steal sensitive information from the target devices using hijacked spreadsheet software.

In a technical analysis, researchers from Fortinet said they observed threat actors sending out phishing emails with the usual purchase order theme. Attached with the email is a Microsoft Excel file, built to exploit a remote code execution vulnerability found in Office (CVE-2017-0199). When triggered, the file will download an HTML Application (HTA) file from a remote server, and launch it via mshta.exe.

The downloaded file will pull a second payload from the same server, which will run the initial anti-analysis and anti-debugging, after which it will download and run Remcos RAT.

Remcos returns

For its part, Remcos was not always considered malware. It was built as a legitimate, commercial software, used for remote administration tasks. However, it was hijacked by cybercriminals, in the same way Cobalt Strike was hijacked, and is nowadays mostly used for unauthorized access, data theft, and espionage. Remcos can log keystrokes, capture screenshots, and execute commands on infected systems.

But this version of Remcos gets dropped directly into the device’s memory: “Rather than saving the Remcos file into a local file and running it, it directly deploys Remcos in the current process’s memory,” Fortinet explained. “In other words, it is a fileless variant of Remcos.”

Phishing via