A sophisticated, financially motivated cybercrime campaign is targeting the Indian financial and taxation ecosystem by impersonating the Government of India's GST department. The attack leverages high-pressure social engineering via spoofed emails regarding "GST refund applications" to trick taxpayers into downloading malicious archives. Once executed, the malware initiates a multi-stage .NET infection chain utilizing advanced evasion techniques, including bitmap steganography for payload concealment and in-memory execution via .NET reflection to maintain a fileless footprint. The operation culminates in the deployment of Remcos RAT, granting attackers full remote command and control (C2) for credential theft, surveillance, and data exfiltration, while employing architecture-specific execution paths to ensure successful deployment across x86 and x64 systems.

• Campaign Overview: Target and Vector

  • Target Demographic: Primarily Indian businesses, individual taxpayers, and government-related financial entities.
  • Initial Vector: Spoofed phishing emails (appearing from donotreply.@gst.gov.in) containing malicious .rar archives, such as GST-Refund_July-26_AL27052600952P.rar.
  • Threat Actor Profile: Likely an India-focused Remcos operator or an Initial Access Broker (IAB) utilizing rotating hosting (M247 Europe SRL) and disposable dynamic DNS.

• Technical Deep Dive: The .NET Infection Chain

  • Stage 1 Loader: Utilizes the ServiceChromatic() function to extract a hidden payload from an embedded bitmap via RGB pixel reconstruction.
  • Stage 2 Execution: A secondary DLL, Windows Health Optimizer Plus.dll, performs XOR decryption on a second embedded bitmap to reveal the subsequent stage.
  • Stage 3 Orchestration: The perfgurd.dll module uses .NET reflection and architecture-based method indexing to maintain stability.
  • Architecture Awareness: Employs WaitForAdvancedController for x86 environments and WaitForGlobalAggregator for x64 environments to execute the final payload.

• Evasion and Persistence Mechanics

  • Steganographic Concealment: High-level evasion achieved by hiding malicious code within the RGB values of image pixels.
  • Fileless Execution: Heavy reliance on Assembly.Load and .NET reflection to execute code directly in memory, minimizing the disk footprint.
  • Privilege Escalation: The chain abuses cmstp.exe to facilitate elevation of privileges.
  • Persistence Methods: Established via copying executables to AppData, deploying hidden PowerShell scripts in %TEMP%, and creating HKCU\Run registry keys.

• Impact: Remcos RAT Capabilities

  • Full Remote Access: Deployment of Remcos RAT allows for comprehensive remote command and control (C2) over the victim's machine.
  • Data Theft: Capabilities include keylogging, credential harvesting, and complete file system management (upload/download).
  • Surveillance: Attackers can perform real-time system reconnaissance, screenshot capture, and remote desktop monitoring.

• Indicators of Compromise (IoCs)

  • Network Identifiers: C2 communication directed to IP 185.242.4.122 and domains under *.hath.network and *.synology.me.
  • Malicious Hashes: Notable file hashes include the Remcos RAT (2a34bdd25b404737ee5d3b52bf0b3b70) and the stage 2 DLL (7842D12D9E37C75076133BE5B9904CB2).