Malware

VCURMS

VCURMS is a Java-based remote access trojan used in phishing campaigns that deliver a malicious downloader and then deploy additional Java payloads. It has been observed alongside STRRAT in payment-themed lures, with payload staging on public cloud and code-hosting services and multiple layers of obfuscation and commercial protection to hinder detection and analysis. The malware is notable for using email-based command and control, including Proton Mail, rather than a conventional interactive C2 channel.

On Windows systems, VCURMS establishes persistence through the Startup folder. It identifies infected hosts using system-specific information and processes inbound email messages to locate commands intended for a particular victim. Supported operator actions include collecting host details, executing shell commands, uploading and downloading files, and searching the filesystem. VCURMS can also retrieve and launch secondary components, including a keylogger and an infostealer.

The associated infostealer functionality targets browser and application data, including cookies, saved credentials, autofill data, browsing history, and account information from platforms such as Discord and Steam. Observed browser targeting includes Chromium- and Firefox-based browsers. The keylogging component records keystrokes, while exfiltration of collected data is coordinated through the main VCURMS component. The malware has been reported as sharing similarities with Rude Stealer while operating under the VCURMS name.

VCURMS primarily affects environments where Java execution is available, and the observed intrusion chain used phishing to initiate infection. Its combination of Java portability, layered obfuscation, email-driven C2, persistence, remote command execution, file transfer, keylogging, and information theft makes it a flexible post-compromise RAT suited for credential and data theft operations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Recently, FortiGuard Labs uncovered a phishing campaign that entices users to download a malicious Java downloader with the intention of spreading new VCURMS and STRRAT remote access trojans (RAT).

T1566.002Spearphishing LinkEvidence1

The phishing email shown in Figure 2 is part of this attack campaign. It targets staff members, implying that a payment is underway and encourages them to click a button to verify payment information. Upon clicking the button, a harmful JAR file hosted on AWS is downloaded to the victim's computer.

Execution

2 techniques

T1059.001PowerShellEvidence1

The keylogger and password recovery malware are also hosted on AWS and disguised with a .jpg extension. They are downloaded using a PowerShell command.

T1059.003Windows Command ShellEvidence1

shell Obtain the command and execute it through cmd.exe /c; the result is sent back to the attacker via email.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

During the initialization step, the program replicates itself into the Startup folder to ensure that it runs automatically when Windows starts.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

During the initialization step, the program replicates itself into the Startup folder to ensure that it runs automatically when Windows starts.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The attackers stored malware on public services like Amazon Web Services (AWS) and GitHub, employing a commercial protector to avoid detection of the malware.

T1036MasqueradingEvidence1

The keylogger and password recovery malware are also hosted on AWS and disguised with a .jpg extension.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

This file is responsible for recording keystrokes.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

get information Retrieve system details such as the operating system version, memory capacity, computer name, volume ID, username, country, and the files in the Desktop and Documents folders.

T1083File and Directory DiscoveryEvidence1

search Look for file names containing keywords specified by the attacker.

Collection

2 techniques

T1056.001KeyloggingEvidence1

This file is responsible for recording keystrokes.

T1560Archive Collected DataEvidence1

upload Compress the file at the specified location and then send it as an attachment.

Command and Control

1 technique

T1071.003Mail ProtocolsEvidence1

We observed an unusual RAT that communicates with its command and control through email.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

The attacker follows the same path as the main program and sends the stolen information through the same email address.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cert 360 cnNews

Mar 18, 2024

安全事件周报 2024-03-11 第11周

VCURMS is a Java-based remote access trojan (RAT) distributed via phishing, notable for using Proton Mail addresses for C2 communication.

fortinet threat researchNews

Mar 12, 2024

VCURMS: A Simple and Functional Weapon | FortiGuard Labs

A newly observed Java-based remote access trojan that uses email for command-and-control, persists via the Startup folder, identifies victims by computer name and volume ID, executes shell commands, uploads/downloads files, searches for files, and deploys secondary credential theft and keylogging components. It also includes a modified infostealing component that collects browser data, app account data, system information, screenshots, and sends stolen data back via email.

the hacker newsNews

Dec 4, 2025

Amazon Web Services — Latest News, Reports & Analysis | The Hacker News

VCURMS is a remote access trojan (RAT) delivered via phishing campaigns, capable of establishing communication with a command-and-control server and providing remote access to compromised systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

VCURMS