← Back to Pulse Feed
PULSE DETAIL
A phishing campaign using Excel attachments is delivering a new variant of the Remcos RAT. The Excel attachment with an embedded OLE object exploits the remote code execution vulnerability CVE-2017-0199 affecting Microsoft Office and WordPad to download an HTA file. The HTA file downloads an executable, which downloads several files, one of which downloads Remcos RAT.
MITRE ATT&CK & Malware Families
Indicators of Compromise (8 / 15 total)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| URL | http://107.173.4.16:2404 | — | 2024-11-08 | |
| URL | http://192.3.220.22/430/dllhost.exe | 4e11fd9ebcd710646c1c685691837f3e2d4983e9232279ece12a6db9be569ba1 | 2024-11-08 | |
| URL | http://192.3.220.22/430/dllhost.xn--exe-9o0a | — | 2024-11-08 | |
| URL | http://192.3.220.22/hFXELFSwRHRwqbE214.bin | 0f81b5c2a976afdc87df88b780a439deda77708dc9ef74cd726962013d79031f | 2024-11-08 | |
| URL | http://192.3.220.22/xampp/en/cookienetbookinetcahce.hta | — | 2024-11-08 | |
| URL | http://192.3.220.22/xampp/en/cookienetbookinetcahce.xn--hta-9o0a. | — | 2024-11-08 | |
| URL | https://og1.in/2Rxzb3 | — | 2024-11-08 | |
| URL | https://og1.in/2Rxzb3.xn--ivg | — | 2024-11-08 |