REMCOS_RAT - description

Source:

Malicious PowerPoint slide show files delivering REMCOS remote access trojan

Attackers distribute phishing emails containing malicious PPSX (PowerPoint Slide Show) file attachments. When opened, the script in these files downloads an additional document from a command and control server. This document executes PowerShell commands that download and run RATMAN.exe, a compromised version of the REMCOS remote access tool. Once installed, this tool grants attackers full access to the victim's computer.

Flowmon ADS detects communication with two separate command and control servers: one that delivers the RATMAN.exe executable and another that provides installation instructions for the malware.