Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and Trusted Windows Binaries

This report details a stealthy Remcos RAT campaign that begins with a phishing email and ZIP attachment containing heavily obfuscated JavaScript which downloads an obfuscated PowerShell loader; the loader reconstructs and decrypts a .NET assembly loaded into memory and injects a PE into aspnet_compiler.exe, enabling C2 communication to 192.3.27.141:8087 and creation of C:\ProgramData\remcos\logs.dat to capture keystrokes and other data. Recommended detections include monitoring PowerShell Base64/obfuscated executions, suspicious outbound connections from system utilities, and blocking known URLs, hashes, and C2 infrastructure.