Remcos RAT Malware Disguised as Major Carrier’s Waybill

**Executive Summary:** AhnLab ASEC reports a phishing campaign distributing Remcos RAT through a malicious HTML attachment that generates obfuscated JavaScript and AutoIt components; the chain decodes an embedded Remcos binary, achieves persistence via autorun registry entries, and injects the RAT into a legitimate RegSvcs.exe process for remote access and data theft. The analysis includes technical details of the injection sequence, persistence and evasion checks, and provides MD5 hashes and a C2 URL as IOCs.