A new phishing campaign has emerged, leveraging a combination of obsolete file types, User Account Control (UAC) bypass, and advanced obfuscation techniques to deploy the Remcos Remote Access Trojan (RAT) on Windows endpoints.
The attack chain, recently analyzed in-depth using ANY.RUN’s interactive sandbox, reveals a multi-stage infection campaign engineered to avoid detection and establish persistence using legitimate Windows features.
Phishing Campaign Employs Obsolete File Types
According to Any.Run Report, the infection begins with a phishing email containing an archive file.
Inside the archive, users find a malicious executable typically disguised with business-related names like “FAKTURA” which, when launched, initiates the DBatLoader dropper.
Notably, DBatLoader utilizes .pif (Program Information File) files, a format originally intended for DOS applications but now largely obsolete.
Despite their age, .pif files remain executable on modern Windows systems, which allows attackers to exploit them for stealthy malware delivery without raising user suspicion.
In this campaign, attackers further obscure their activities by creating directories with trailing spaces (e.g., “C:\Windows ”), taking advantage of how Windows interprets folder names to facilitate UAC bypass and privilege escalation.
Once executed, the loader triggers a sequence of commands aimed at evasion and persistence.
The malware uses the Windows PING.EXE utility to introduce artificial execution delays by sending repeated ICMP echo requests to the local loopback address (127.0.0.1).
While this is a common method for malware to evade dynamic analysis and sandbox detection, it also serves to disrupt timing-based analysis routines.
Additionally, the attack abuses Windows’ scheduled task functionality to establish persistence; a scheduled Cmwdnsyn.url file launches the .pif dropper on every reboot, ensuring that the malicious payload survives system restarts.
Advanced Evasion Tactics
For further stealth, the malicious code deploys obfuscated .cmd scripts often protected with BatCloak to download and execute Remcos RAT.
The loader uses extrac32.exe, a legitimate Windows utility, to add malware-related directories to Windows Defender’s exclusion list, effectively neutralizing stock endpoint protection defenses.
Once installed, Remcos injects itself into trusted system processes such as SndVol.exe and colorcpl.exe, masking its presence and making manual detection by analysts more challenging. The injection points vary between infections, complicating static detection efforts.
ANY.RUN’s sandbox analysis highlights the sophistication and evasiveness of this campaign, capturing every stage of execution and mapping observed behaviors to the MITRE ATT&CK framework.
The multi-stage strategy and use of Living Off the Land Binaries and Scripts (LOLBAS) render conventional signature-based defenses inadequate.
Proactive sandbox analysis employing virtualized, isolated environments to execute suspicious files in real time remains a critical tool for threat detection and incident response.
By monitoring unusual file paths, tracking process behavior, and analyzing network communications, security analysts can extract vital indicators of compromise (IOCs) for use in updating detection rules and strengthening endpoint defenses.
As malware authors continue to innovate, leveraging outdated but still functional file types and abusing legitimate Windows features, organizations are urged to adopt dynamic analysis solutions and reinforce user awareness training.
Rapid, in-depth threat analysis not only shortens incident response times but also mitigates the risk of system compromise, data loss, and the lateral spread of advanced threats like Remcos RAT within corporate environments.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
