Remcos RAT
This intelligence analysis details a malicious campaign involving Remcos RAT, a commercially available remote access trojan. The attack chain begins with a weaponized Excel spreadsheet (Remittance Advice.xlsm) that executes VBA macros. Upon opening, PowerShell retrieves remote scripts (edi.vbs/firewall.vbs) from a malicious domain. The execution progresses through multiple stages, ultimately deploying the Remcos RAT payload. Command and control infrastructure utilizes domains at dvrlists[.]com and lbl[.]support. The threat demonstrates typical social engineering tactics using financial-themed lures to entice victims into enabling macros and initiating the infection chain.
Pulse ID: 6aedb6df481d077141e5e5e4
Pulse Link: https://otx.alienvault.com/pulse/6aedb6df481d077141e5e5e4
Pulse Author: AlienVault
Created: 2026-11-06 11:15:43
Be advised, this data is unverified and should be considered preliminary. Always do further verification.