Distribution of Remcos RAT Disguised as Payslip

AhnLab Security Emergency response Center (ASEC) has discovered circumstances of the Remcos remote control malware being distributed through an email disguised as a payslip.

As shown in Figure 1, the identified Remcos RAT was distributed under an email subject that read ‘This is a confirmation document for your payment transfer’, deceiving the readers. The attached compressed cab file contains an EXE file (Remcos RAT) disguised with a PDF file icon as shown in Figure 2.

ahnlab asec center control distributed distribution document email emergency malware malware analysis payment rat remcos remcos rat remote control response security transfer under