Seqrite Details GST Phishing Chain Delivering Remcos RAT Through .NET Loaders
Summary
Seqrite analyzed a GST-themed phishing campaign targeting Indian businesses and taxpayers. Its multi-stage .NET chain concealed payloads in bitmap pixels and delivered Remcos RAT, with fileless execution and persistence techniques.
Key points
- The campaign used a fake Government of India GST refund email and a matching malicious archive to lure recipients into opening an executable.
- The initial .NET loader reconstructed a hidden payload from bitmap RGB values and loaded the next-stage assembly in memory.
- A later loader used XOR-based decryption to recover perfgurd.dll, then selected methods through reflection based on system architecture.
- The analysis describes attempted privilege elevation using cmstp.exe and persistence through a PowerShell script launched by a user Run registry key.
- The final payload was identified as Remcos RAT, with capabilities including remote command execution, keylogging, credential harvesting and screenshot capture.
- Seqrite reported C2 infrastructure including 185.242.4.122 and randomized subdomains under aofmokighoig[.]hath[.]network, alongside dynamic DNS services hath[.]network and synology[.]me.
- Seqrite said the evidence was insufficient to confidently identify a publicly tracked threat actor; it assessed the activity as possibly involving an India-focused Remcos operator or an initial access broker.
Article Details
- Attack Vectors
- A GST refund-themed phishing email impersonated Government of India communications, using a spoofed sender, refund-related subject, and matching identifiers to encourage recipients to open its attachment.
- The RAR attachment contained a .NET executable disguised as a GST refund document or application.
- The executable extracted payload bytes concealed in bitmap pixels; staged .NET loaders reconstructed and decrypted payloads in memory before deploying Remcos RAT.
- The third-stage loader used cmstp.exe in an attempt to obtain elevated execution and established logon persistence through a hidden PowerShell script and an HKCU Run entry.
- Remcos RAT communicated with C2 infrastructure associated with aofmokighoig.hath.network and an IP address identified in the article.
- Defensive Notes
- Scrutinize unexpected GST refund emails and archive attachments; the analyzed phishing message used government impersonation and a malicious RAR attachment.
- Monitor for the described execution and persistence behaviors, including cmstp.exe activity, hidden PowerShell launches, copies in AppData\Roaming, and HKCU Run entries.
- Inspect suspicious .NET binaries for bitmap-embedded payloads, in-memory Assembly.Load() execution, and XOR-based payload reconstruction.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aofmokighoig[.]hath[.]network | Dynamic DNS domain identified as supporting Remcos RAT C2 activity. |
| IPV4 | 185[.]242[.]4[.]122 | IP address identified as command-and-control infrastructure for the campaign. |
| MD5 | 07d7d21c2c0920d198efb9ea54900a80 | MD5 of the malicious GST refund RAR attachment. |
| MD5 | 20476f3a51dfddf3dc0603fc7858d894 | MD5 associated with the extracted GST-Refund_July-26_AL27052600952P.com payload. |
| MD5 | 2a34bdd25b404737ee5d3b52bf0b3b70 | MD5 associated with the RemcosRAT payload. |
| MD5 | 3757dccb2adae65ccdf8d5e5c948b927 | MD5 identified as a campaign sample; the IOC list pairs it with “Eml.” |
| MD5 | 7842d12d9e37c75076133be5b9904cb2 | MD5 associated with the Windows Health Optimizer Plus.dll staged loader. |
| MD5 | cc34d9760394104ad47877a0d57e9c63 | MD5 associated with the PerfGuard.dll loader artifact. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe article reports that the malware gathered network-related details during reconnaissance.T1027 · Obfuscated Files or InformationThe loaders concealed payload bytes in bitmap pixel values and used obfuscating code.T1027.013 · Encrypted/Encoded FileThe loader used a custom XOR-based routine to decrypt an extracted payload.T1036 · MasqueradingThe executable was disguised as a GST refund document, and the campaign used GST-related filenames to appear legitimate.T1056.001 · KeyloggingThe article reports that the deployed Remcos RAT provided keystroke monitoring.T1059.001 · PowerShellThe loader created a PowerShell script to launch a copied executable in hidden mode.T1082 · System Information DiscoveryThe article reports collection of system information from compromised hosts.T1113 · Screen CaptureThe article reports screenshot capture among the Remcos RAT capabilities.T1140 · Deobfuscate/Decode Files or InformationThe loaders decoded hexadecimal strings and reconstructed payload bytes from bitmap data.T1204.002 · Malicious FileInfection required the recipient to open and execute the disguised attachment.T1218.003 · CMSTPThe malware abused the legitimate cmstp.exe utility during its privilege-elevation attempt.T1547.001 · Registry Run Keys / Startup FolderThe malware created an HKCU Run entry pointing to the PowerShell persistence script.T1548.002 · Bypass User Account ControlThe loader attempted to use cmstp.exe to spawn its main process with elevated privileges.T1566.001 · Spearphishing AttachmentThe campaign delivered a malicious RAR attachment in a GST-themed phishing email.T1620 · Reflective Code LoadingThe hidden .NET assembly was loaded from a reconstructed byte array using Assembly.Load() without being written to disk.
Malware
Vendors
M247 Europe SRLservices, including hath.network and synology.me, together with rotating infrastructure hosted by M247 Europe SRL, is consistent with commodity malware operations and financially motivated cybercrime.MicrosoftInitial examination revealed that the payload is a .NET-based executable, indicating that it was developed using the Microsoft .NET framework.
Products
Microsoft Windows[T1036] Masquerading – The malware disguised files as GST-related documents and used a legitimate-looking filename (‘masquerading as a GST refund-related document’ and ‘Windows Health Optimizer Plus.dll’).PowerShell[T1059.001] PowerShell – A .ps1 script was created to launch the copied executable in hidden mode (‘generates a PowerShell script (.ps1) in the temporary directory’).