Remcos RAT campaign uses obfuscated scripts and trusted Windows tools to stay hidden
5 min. read 
Published on
A newly detailed Remcos RAT campaign uses a layered infection chain built to hide behind normal Windows activity. Researchers at Point Wild’s LAT61 Threat Intelligence Team say the attack starts with a phishing email, then moves through obfuscated JavaScript, PowerShell, in-memory loading, and abuse of legitimate Windows binaries before it reaches the final remote access stage.
The goal is stealth, not speed. Instead of dropping one obvious malware file, the chain uses trusted Windows components and memory-based execution to reduce visible disk traces and make detection harder for file-focused defenses.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
That matters because Remcos remains a capable remote access trojan used for surveillance, credential theft, keylogging, and full remote control of infected systems. Point Wild’s analysis says this campaign maintained command-and-control communications and created a logs.dat file under C:\ProgramData\remcos\, suggesting active collection of keystrokes or system data.
How the attack starts
According to the researchers, the chain begins with a phishing email carrying a ZIP archive named MV MERKET COOPER SPECIFICATION.zip. Inside sits an obfuscated JavaScript file, MV MERKET COOPER SPECIFICATION.js, designed to look harmless while quietly launching the first execution stage through Windows Script Host.
Once it runs, the JavaScript creates ActiveX objects for HTTP communication, command execution, and file operations. Point Wild says the script then reaches out to almacensantangel[.]com to fetch a remote PowerShell script called ENCRYPT.Ps1.
That PowerShell loader adds another layer of concealment. The report says it stores payload data in a large Base64-encoded blob, reconstructs it into raw bytes, then decrypts it with a rotational XOR routine before executing the recovered code with Invoke-Expression.
How Remcos gets loaded
Point Wild says the decrypted content reveals a .NET assembly named ALTERNATE.dll, which gets loaded directly into memory through .NET reflection. That step helps the attackers avoid writing the full payload to disk, which cuts down on traditional forensic artifacts.
The researchers also say a second payload, Cqeqpvzeia.exe, appears as a raw byte array beginning with the MZ PE header and then gets injected into aspnet_compiler.exe, a legitimate Microsoft .NET utility. That technique fits the living-off-the-land pattern because it hides malicious behavior inside a trusted Windows binary.
Once that process injection completes, the compromised aspnet_compiler.exe handles outbound command-and-control traffic, which can make malicious network activity look like ordinary system behavior. In the observed case, the infrastructure included the IP 192[.]3[.]27[.]141:8087.
Why this infection chain is hard to catch
This campaign does not rely on one flashy trick. It stacks several quieter ones together. The attackers use a phishing lure, script obfuscation, remote payload fetching, in-memory execution, and a legitimate Windows binary for process abuse. That mix can slip past defenses that focus too narrowly on standalone malware files.
The use of PowerShell and trusted binaries also gives defenders a narrower detection window. Suspicious behavior may only become obvious when teams correlate several events, such as JavaScript execution from a ZIP, PowerShell reconstruction of encoded data, outbound traffic from aspnet_compiler.exe, and the appearance of C:\ProgramData\remcos\logs.dat.
Point Wild’s findings also fit a broader 2026 pattern around Remcos delivery. Other recent research described multi-stage Windows attack chains that abused scripting, PowerShell, and living-off-the-land binaries like MSBuild.exe to deploy the same RAT family while evading defenses.
What defenders should watch
- ZIP attachments that contain JavaScript or script-based launchers instead of business documents.
- PowerShell execution that uses Base64-encoded content, decryption routines, or execution-policy bypass behavior.
- Unexpected outbound connections from trusted Windows or .NET utilities such as
aspnet_compiler.exe. - The file path
C:\ProgramData\remcos\logs.dat, which Point Wild flagged as an indicator tied to data collection. - Network traffic or blocks related to the observed host
192[.]3[.]27[.]141:8087and the download domainalmacensantangel[.]com.
Attack chain summary
| Stage | What happens | Why it matters |
|---|---|---|
| Initial lure | Phishing email delivers MV MERKET COOPER SPECIFICATION.zip | Looks like a routine business file and encourages user interaction. |
| First execution | Obfuscated JavaScript runs via Windows Script Host | Launches the infection while hiding its true purpose. |
| Remote retrieval | Script downloads ENCRYPT.Ps1 from almacensantangel[.]com | Pulls in the next stage without embedding everything in one file. |
| Payload rebuild | PowerShell reconstructs and decrypts Base64/XOR-protected content | Keeps core malware concealed until runtime. |
| In-memory load | ALTERNATE.dll loads through .NET reflection | Reduces disk artifacts and hinders file-based detection. |
| LOLBin abuse | Cqeqpvzeia.exe gets injected into aspnet_compiler.exe | Makes malicious activity blend into a trusted Windows process. |
| C2 and logging | Remcos connects to 192[.]3[.]27[.]141:8087 and writes logs.dat | Enables remote control and possible data theft. |
FAQ
Remcos is a remote access trojan that attackers use for surveillance and system control. Researchers say it can support keylogging, credential theft, data collection, and persistent command-and-control access.
This chain uses several layers of obfuscation and trusted Windows components instead of relying on one obvious malware executable. That design helps it stay hidden longer on infected systems.
Point Wild says the final payload abused aspnet_compiler.exe, a legitimate Microsoft .NET binary, to handle malicious outbound communications after injection.
One strong host-level indicator is C:\ProgramData\remcos\logs.dat. Point Wild said that file appeared during the campaign and likely stored captured keystrokes or other collected information.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages