Loading malware…
CNCMachineRMS is a Windows remote access trojan used as a flexible post-compromise implant that provides attackers with persistent, hands-on-keyboard control of infected systems. It has been observed in a ClickFix-style social-engineering chain in which victims are tricked into executing a malicious command. The intrusion sequence abuses a legitimately signed IBM SPSS WinWrap Basic IDE executable to activate scripting through COM, chains through multiple decoy DLLs, and ultimately executes shellcode via the Windows EnumTimeFormatsEx API before loading the final implant from an obfuscated configuration container.
The malware is designed for stealth and operator flexibility. Reported samples use memory-resident stages, decoy DLLs, runtime-built strings, and a custom binary container format for both local state and command traffic. It also supports a custom scripting language that allows operators to modify behavior and re-establish persistence without rebuilding the implant. Observed persistence options include registry- and scheduled-task-based mechanisms, and the malware has been reported to support multiple persistence methods overall.
CNCMachineRMS provides broad remote administration and follow-on intrusion capability. Documented functions include an interactive shell, file management, screenshot capture, host profiling, retrieval and execution of additional payloads, and creation of local account backdoors including privileged-group assignment. On initial contact it can collect system and environment details such as domain context, SID, privilege status, hardware serial information, and installed antivirus products. Its behavior and command support indicate it is intended as an access platform for subsequent operator actions rather than a single-purpose stealer.
The malware targets Windows systems and has been associated with beaconing behavior and use of DNS-over-HTTPS to help obscure network resolution activity. Detections should be treated as likely evidence of an active intrusion with potential persistence, privilege manipulation, and secondary payload deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The pattern echoes other RATs where persistence supports silent access through registry entries and scheduled tasks.
Scheduled-task command /SC ONLOGON /RU SYSTEM /F /RL HIGHEST Task creation parameters associated with persistence
The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
It passes the shellcode through EnumTimeFormatsEx, a harmless Windows date-formatting interface, so Windows itself calls the code.
From there, a run of four decoy DLLs loads through ordinary import resolution, with no suspicious API calls and no odd LoadLibrary to flag.
The pattern echoes other RATs where persistence supports silent access through registry entries and scheduled tasks.
Scheduled-task command /SC ONLOGON /RU SYSTEM /F /RL HIGHEST Task creation parameters associated with persistence
It creates local accounts and adds them to privileged groups.
Its built-in functions include an interactive shell, file manager, screen capture, local account backdoor, seven persistence methods, and 20 typed commands for retrieving and running further payloads.
The pattern echoes other RATs where persistence supports silent access through registry entries and scheduled tasks.
Scheduled-task command /SC ONLOGON /RU SYSTEM /F /RL HIGHEST Task creation parameters associated with persistence
The last decoy fills a buffer with random data, places shellcode inside it, and makes the memory executable.
It has no imports. Every string is built on the stack at runtime instead of sitting in the binary. Its config and its command and control (C2) traffic travel in the same custom binary container... That file, HelperStandardizationApplication.bin, looks like an encrypted blob at 8 bits of entropy per byte. It is not encrypted. It is a configuration tree under two layers of obfuscation...
On first contact, the RAT takes a screenshot and gathers details including the domain, SID, privilege status, motherboard and BIOS serials, and installed antivirus products.
Its built-in functions include an interactive shell, file manager, screen capture...
It then beacons every 600 seconds. | Indicators of compromise (IoCs):- Type Indicator Description Domain notepadreleased[.]com CNCMachineRMS command-and-control host over TCP/443
Domain notepadreleased[.]com CNCMachineRMS command-and-control host over TCP/443
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously undocumented remote access trojan used in ClickFix campaigns. It provides lasting control of Windows systems, including an interactive command shell, file browsing/management, screenshots, creation of new local accounts, persistence, host reconnaissance, beaconing, and the ability to retrieve and execute additional payloads via a custom scripting language.
A previously undocumented remote access trojan delivered via a ClickFix chain that abuses signed IBM SPSS WinWrap Basic IDE. It provides lasting remote control of Windows systems, including an interactive shell, file browsing/manager, screenshots, creation of new local accounts, persistence, beaconing, and the ability to retrieve and run additional payloads via a custom scripting language.
A 1.14 MB x64 remote administration implant that provides hands-on-keyboard access. It supports an interactive shell, file management, screen capture, local account backdoor creation, seven persistence mechanisms, and scripted tasking via a custom scripting language. It stores config/state/C2 data in a custom binary container and beacons to C2 every 600 seconds.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.