Infosecurity Magazinepublished Dec 12, 16:30 UTC (Dec 12, 2024)ingested Sep 10, 06:11 UTCAlessandro Mascellino

Remcos RAT Malware Evolves with New Techniques

criticalMalwareimportance 60CVE-2017-11882

Read the original

Tagscve-2017-11882 malware

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2017-11882	Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens.	7.8	100%	KEV ransomware PoC ×10	Microsoft Office	masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown)	Nov 15, 2017

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2017-11882

Memory Corruption RCE in Microsoft Office via Legacy Equation Editor

CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC.

Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens.

7.8

100%

KEV ransomware PoC ×10

Microsoft Office

masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown)

Nov 15, 2017

Full article346 words · extracted from infosecurity-magazine.com · click to collapse

A sharp increase in cyber-attacks involving the Remcos remote access Trojan (RAT) has been identified in Q3 2024.

The malware, delivered through phishing emails and malicious attachments, enables attackers to control victim machines remotely, steal data and carry out espionage.

Two Key Variants Identified

McAfee Labs researchers have analyzed two distinct Remcos RAT variants, each leveraging unique methods for delivery and execution.

The first variant employs a highly obfuscated PowerShell script triggered by a VBS file. This script downloads files from command-and-control (C2) servers and injects malicious code into RegAsm.exe, a legitimate Microsoft executable. By using multi-layer obfuscation, it avoids detection by mimicking legitimate system paths and directories.

The second variant spreads via spam emails containing malicious Microsoft Office Open XML (DOCX) attachments. These files exploit CVE-2017-11882, a remote code execution vulnerability. Upon execution, an embedded script downloads additional malware payloads, ultimately leading to the deployment of Remcos RAT.

Both variants share several common characteristics that make them highly evasive. They encode data in Base64 format, use reversed URLs and avoid leaving files on disk, effectively bypassing traditional detection systems. Additionally, they inject their final payloads into legitimate processes to evade behavioral detection systems.

To ensure persistence, these variants rely on registry modifications and startup folder entries, guaranteeing their presence even after system reboots.

Mitigating the Threat

McAfee Labs has provided indicators of compromise (IOCs) for these variants, including file hashes and URLs, to aid in threat detection.

The rising threat of Remcos RAT highlights the critical importance of:

Keeping systems up-to-date and patching known vulnerabilities
Employing multi-layered security measures to detect and neutralize malware
Educating users on recognizing and avoiding phishing tactics

“As this remote access Trojan continues to target consumers through phishing emails and malicious attachments, the need for proactive cybersecurity measures has never been more critical,” McAfee warned.

“By understanding the tactics used by cybercriminals behind Remcos RAT and implementing robust defenses such as regular software updates, email filtering and network monitoring, organizations can better protect their systems and sensitive data.”

Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/remcos-rat-malware-evolves-new/