Malware Analysis For Remcos Remote Access Trojan (RAT)

Introduction

Palo Alto Networks has published an in-depth malware analysis tutorial that dissects a highly obfuscated .NET-based loader delivering the Remcos Remote Access Trojan (RAT). The tutorial breaks down the infection chain and explains the technical sophistication behind the malware, making it a valuable learning resource for analysts and reverse engineers.

The attack begins with an innocuous-looking .NET executable, heavily obfuscated to conceal its intent. The loader fetches an online payload disguised as a PDF file from a compromised Bitbucket repository. Instead of carrying legitimate document data, the file contains Donut-generated shellcode, designed to execute entirely in memory and bypass disk-based antivirus detection. Once retrieved, the payload is decoded from ASCII-hexadecimal format and written into memory using Windows API functions.

One of the loader’s most notable techniques is its dynamic resolution of Windows API calls at runtime. By avoiding static imports in the Portable Executable (PE) header, the malware evades traditional signature-based and heuristic detection. Using .NET interop services, it allocates executable memory with VirtualAlloc and injects the decoded payload.

To further enhance stealth, the malware alters Windows security defenses in memory. Antimalware Scan Interface (AMSI) functions are patched so they always return “clean,” while Event Tracing for Windows (ETW) logging calls are disabled. As a result, endpoint detection systems are blinded and malicious behavior appears harmless.

The malware also instantiates a new Common Language Runtime (CLR) instance from unmanaged shellcode, enabling execution of an obfuscated .NET assembly via reflection. This assembly injects the decrypted Remcos RAT into a suspended legitimate process, commonly InstallUtil.exe, using WriteProcessMemory and VirtualProtectEx. Once memory permissions are changed, the process resumes and the RAT runs stealthily.

Injection is performed in multiple chunks, reducing detection likelihood by memory scanners. Analysts confirmed the campaign’s objective when the embedded Remcos RAT ASCII banner was observed in the injected process.

By documenting every stage, Palo Alto Networks provides both a forensic case study and a hands-on lab guide. This equips analysts with repeatable methods for dissecting hybrid-runtime malware while showing defenders how trusted frameworks like .NET are exploited in modern attacks.

Author Profile

Nickajay

Latest entries

• Tips & TricksNovember 7, 2025master_not_discovered_exception in Palo Alto Networks Log Collector
• Tech NewsAugust 17, 2025Malware Analysis For Remcos Remote Access Trojan (RAT)
• Tech NewsJune 10, 2025How to register and install iOS 26, iPadOS 26, and macOS Tahoe
• Tech NewsJune 1, 2025How to Install Cisco and Juniper Images in EVE-NG