← Back to Pulse Feed
PULSE DETAIL
A phishing campaign using Excel attachments is delivering a new variant of the Remcos RAT. The Excel attachment with an embedded OLE object exploits the remote code execution vulnerability CVE-2017-0199 affecting Microsoft Office and WordPad to download an HTA file. The HTA file downloads an executable, which downloads several files, one of which downloads Remcos RAT.
MITRE ATT&CK & Malware Families
Indicators of Compromise (6 / 15 total)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-SHA256 | 24a4ebf1de71f332f38de69baf2da3019a87d45129411ad4f7d3ea48f506119d | — | 2024-11-08 | |
| FileHash-SHA256 | 4a670e3d4b8481ced88c74458fec448a0fe40064ab2b1b00a289ab504015e944 | — | 2024-11-08 | |
| FileHash-SHA256 | 9124d7696d2b94e7959933c3f7a8f68e61a5ce29cd5934a4d0379c2193b126be | — | 2024-11-08 | |
| FileHash-SHA256 | d4d98fdbe306d61986bed62340744554e0a288c5a804ed5c924f66885cbf3514 | — | 2024-11-08 | |
| FileHash-SHA256 | f99757c98007da241258ae12ec0fd5083f0475a993ca6309811263aad17d4661 | — | 2024-11-08 | |
| FileHash-SHA256 | f9b744d0223efe3c01c94d526881a95523c2f5e457f03774dd1d661944e60852 | — | 2024-11-08 |