Loading story…
A multistage .NET malware loader protected with KoiVM resurfaced in spam campaigns using ZIP attachments disguised as invoices or order documents. K7 Labs reported that the first-stage downloader decoded Hastebin-based C2 URLs, fetched a Base64-encoded and Deflate-compressed second-stage payload, and then XOR-decoded it with the hardcoded key M4use to reconstruct a KoiVM-virtualized dropper. The second stage was heavily obfuscated with ConfuserEx, an open-source .NET protector, complicating analysis and detection.
Depending on the command-and-control endpoint reached, the dropper unpacked and deployed either Agent Tesla or Remcos RAT, using XOR keys Jus3ify and Monito3 respectively; the Agent Tesla sample was also protected with .NET Reactor. The final payloads enabled keystroke logging, browser cookie theft, cryptocurrency wallet theft, screenshot capture, and remote command execution, giving operators broad surveillance and control over infected systems. The report also published supporting indicators of compromise, including file hashes, Hastebin C2 URLs, and a Remcos-linked IP address.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The analysis found the stage-1 downloader decoded Hastebin C2 URLs, retrieved and XOR-decoded a KoiVM-virtualized stage-2 dropper, and then unpacked a final payload from resources. Depending on the retrieved payload, the malware deployed either Agent Tesla, which exfiltrated data via email, or Remcos RAT, which used an RC4-encrypted configuration and a listener at 172.111.234[.]110:5888.
K7 Labs published analysis of a multistage .NET malware loader delivered through spam ZIP attachments masquerading as invoices or orders. The campaign used Hastebin-hosted stage-2 payloads and ultimately deployed either Agent Tesla or Remcos RAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers documented multiple malware delivery chains using PowerShell-based loaders to fetch and execute credential theft and remote access payloads. In one campaign tied to **NullMixer**, a 32-bit loader masquerading as `sqlcmd.exe` pulled a script from a compromised WordPress site, decrypted an embedded .NET assembly, and launched the **Koi** stealer. Koi targeted credentials and data from browsers, **FileZilla**, **Discord**, **Telegram**, VPN clients, cryptocurrency wallets, and **Twilio Authy**, while also checking for **Trezor** hardware wallets; it used anti-analysis, anti-reinfection, and geofencing logic to avoid systems configured for several CIS countries. A separate PowerShell dropper hosted on `fancysunshine[.]top` was used to deploy **SectopRAT** and **HiJack Loader** while attempting to weaken defenses and erase evidence. The script added Windows Defender exclusions for the `C:` drive and selected processes, downloaded `NC.zip` and `RD.zip`, unpacked them into fake Chrome cache directories under `%TEMP%`, and executed `S-D.exe` from both locations. It also gathered the victim's external IP address and username, checked for a scheduled task named `MSSecurity`, exfiltrated results to `upload.php` over HTTP POST, and then deleted the archives, extracted files, output data, and the dropper itself to reduce forensic visibility.
Jun 29, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Researchers and incident reports show **Remcos RAT** continuing to spread through multiple delivery channels, including business-themed phishing emails, fake cryptocurrency software, and multi-stage script loaders. Trend Micro documented a phishing campaign using an ACE archive attachment and an AutoIt-based loader to install **Remcos Professional 1.7**, while ESET reported a spoofed SafeMoon application that delivered Remcos to cryptocurrency users. SonicWall later identified a newer infection chain using VBScript, batch files, PowerShell, and a .NET loader to deploy Remcos after patching **AMSI** and **ETW** for defense evasion, with observed targeting of European institutions. Technical analysis from Elastic Security Labs found that modern Remcos samples retain extensive remote-access and surveillance functions, including **keylogging, screenshots, audio capture, webcam access, shell command execution, password theft, browser-history collection, persistence, process injection, and UAC bypass**. Elastic recovered most of the malware’s configuration structure and command set, showing that Remcos stores encrypted settings, supports TLS-enabled command-and-control, can masquerade as legitimate processes such as `explorer.exe`, and can clean browser artifacts or uninstall itself on command. The reporting underscores how a tool originally marketed for red teaming has become a widely abused malware family with increasingly evasive delivery chains and mature post-compromise control features.
Aug 14, 2026