RemcosRAT Distributed Using Steganography

AhnLab ASEC details an active campaign delivering Remcos RAT via Word template injection and an RTF exploit of the Equation Editor (EQNEDT32.EXE). The chain uses obfuscated VBScript and PowerShell to extract a Base64-encoded .NET DLL embedded in a JPEG (steganography), which is reflectively loaded and executed via process hollowing (RegAsm.exe), resulting in RemcosRAT execution; the report includes file detections, behavior signatures, MD5 hashes, C2 URLs and IPs.