VHDX-Based ZIP Campaign Delivers Remcos RAT via JavaScript, PowerShell, and .NET Loader

A malicious ZIP archive has been observed delivering Remcos RAT through a multi-stage infection chain that starts with a VHDX disk image instead of a more common document or executable. When opened on modern Windows systems, the embedded VHDX auto-mounts and exposes an obfuscated JavaScript file, Partnerschaft_fur_neue_Angebotsanfrage.js, suggesting possible targeting of German-speaking users. Researchers said the use of a mountable virtual disk reduces user friction and helps the malware bypass some first-line security controls; the ZIP sample was identified with SHA-256 a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094.

The JavaScript launches PowerShell through WMI to make process relationships less suspicious, after which additional PowerShell stages use string pollution, selective character extraction, Base64 decoding, and XOR decryption with the key Identificational. The chain then retrieves follow-on payloads from cembusconfort[.]ro, uses a reflective .NET loader and shellcode to fetch the final malware, injects it into backgroundTaskHost.exe, and establishes persistence with an HKCU Run key that re-executes the PowerShell loader. The final payload communicates with animal342[.]duckdns[.]org:53552, and multiple stages reportedly showed weak antivirus detection, including the JavaScript sample, which had only 5/57 detections on VirusTotal.