Remcos RAT Masquerade as VeraCrypt Installers Steals Users Login Credentials
A malware campaign has been identified targeting South Korean users, utilizing the Remcos remote access trojan (RAT) through installers posing as the legitimate VeraCrypt encryption software.
A malware campaign has been identified targeting South Korean users, utilizing the Remcos remote access trojan (RAT) through installers posing as the legitimate VeraCrypt encryption software.
This campaign primarily targets individuals associated with illegal online gambling platforms. However, it could also affect users downloading encryption tools.
The operation employs two distribution methods:
Fake database lookup programs that appear to check blocklists for gambling site accounts. Installers masquerading as genuine VeraCrypt utility installers.
The malware is distributed via web browsers and messaging platforms like Telegram, using deceptive filenames such as "*****usercon.exe" and "blackusernon.exe".
This campaign primarily targets individuals associated with illegal online gambling platforms.
ASEC analysts identified that the fake installers execute malicious VBS scripts within their resource sections. These scripts are written to the system's temporary directory with randomized filenames before being activated.
The infection chain involves multiple stages of obfuscated VBS and PowerShell scripts, ultimately delivering the Remcos RAT payload that provides attackers remote control over compromised systems.
Remcos RAT possesses extensive data theft capabilities, including keylogging, screenshot capture, and credential extraction from web browsers. Infected users are at risk of having their sensitive personal information compromised.
Multi-Stage Infection Chain and Payload Delivery
The attack uses an eight-stage infection process to evade detection. The initial dropper leads to five scripted downloader stages using obfuscated VBS and PowerShell scripts , embedding Base64-encoded malicious payloads.
The infection chain concludes with a .NET-based injector communicating via Discord webhooks. This injector downloads the final Remcos RAT payload from remote servers, decrypts it, and injects it into the AddInProcess32.exe process for persistence.
Some variants use Korean-language strings in their configuration settings and registry keys, indicating a targeted approach toward Korean-speaking users.
Based on reporting by Cyber Security News.