# Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign

> An active phishing campaign targeting Indian users distributes a malicious archive whose payload, 'GST Debit Note Apr_26.com', is a 32-bit .NET dropper masquerading as a Turkish-language brick-building game. It launches a fileless, steganographic multi-stage loader chain (Optimax.dll then System Optimizer Ultimate.dll, hidden inside serialized .NET Bitmap resources) that deploys Remcos RAT for remote control, browser credential theft, audio/webcam surveillance, and keylogging. Reported by K7 Security Labs and tracked as part of a loader-as-a-service operation.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0911
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-gst-debit-note-remcos-loader-tl-2026-0911.webp?v=f3cd196f (Threadlinqs threat intel: Remcos RAT via GST Debit Note Lure: Detection & IOCs (TL-2026-0911) — High severity, 31 IOCs, 9 detection rules.)
- **ID:** TL-2026-0911
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

K7 Security Labs documented an active phishing campaign that weaponizes Indian financial-system lures (GST, NEFT, RTGS, IMPS) to deliver Remcos RAT to victims in India. The infection begins with a phishing email carrying an archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906). On extraction it drops 'GST Debit Note Apr_26.com' (MD5 897ABF678EDAD72998554EC18675092F), an unsigned, packed 32-bit .NET executable that masquerades as a brick-building game and carries Turkish-language artifacts (metadata string 'TuglaInsaatci'), displaying a decoy game UI to reduce suspicion while executing malicious code in the background.

The loader operates almost entirely in memory. It conceals next-stage payloads using steganography: resource section SR1 holds a serialized .NET Bitmap object that is actually a container for the hidden second-stage DLL, Optimax.dll (MD5 AFE085B7324D72673EEF749FF5F21A49). The loader extracts the embedded bytes and uses AppDomain.Load on a byte array (this.pf.ToArray<byte>()) to load assemblies reflectively without writing them to disk. Optimax.dll in turn unpacks the third-stage loader, System Optimizer Ultimate.dll (MD5 F3626A38FCF488C9EED54BEB8C7C116F), which finally deploys the Remcos RAT payload (MD5 4924369C0BDAF73B21EB992EB9DB4DEA). The full chain is: archive -> .com dropper -> Optimax.dll -> System Optimizer Ultimate.dll -> Remcos RAT.

Before detonation the malware runs anti-analysis checks, looking for the Sandboxie module sbiedll.dll and VirtualBox artifacts via the registry marker HARDWARE\ACPI\DSDT\VBOX_. It escalates privileges and bypasses User Account Control by abusing eventvwr.exe (the classic Event Viewer / fodhelper-style auto-elevation technique), then performs process hollowing to masquerade as the victim's default web browser process. Persistence is established by dropping a randomized, superhidden self-copy into %AppData%\Roaming and registering a Run key for auto-launch at login, with additional Winlogon (winlogon.exe / Userinit) modifications.

The deployed Remcos RAT confirms infection with the mutex 'Remcos_Mutex_Inj' and beacons to attacker C2 over non-standard TCP ports: primary 62.102.148.212:37393, plus 217.138.252.123:42830 and 146.70.244.90:37393. Capabilities include window-title monitoring, idle-time tracking, audio recording, webcam capture, keystroke logging, and credential/cookie harvesting from Chrome and Firefox, with stolen data written to 'logs.dat' and exfiltrated over the C2 channel. K7 assesses the distribution infrastructure as a loader-as-a-service operation: the same network is rented to deliver other commodity families including Agent Tesla, MassLogger, Phantom Stealer, RedLine Stealer, Formbook, Snake keylogger, DarkCloud, and XWorm. The campaign is currently unattributed to a specific actor.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1010 Application Window Discovery
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1123 Audio Capture
- T1125 Video Capture
- T1056 Input Capture
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GST Debit Note .COM Dropper Execution & Reflective In-Memory .NET Load — Exploitation** (`TL-2026-0911-SPL-001`)

Detects execution of the campaign's initial-access dropper: a 32-bit .NET .com executable launched from a user-writable / archive-extraction path (e.g. 'GST Debit Note Apr_26.com'), correlated with reflective in-memory assembly loading where clr.dll/mscoree.dll is loaded but the staged DLL (Optimax.dll / System Optimizer Ultimate.dll) never appears as a disk image-load. This is the steganographic loader's signature: AppDomain.Load(byte[]) of a stage hidden in a .NET Bitmap resource, with no corresponding file on disk.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1027.003, T1620, T1140
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
```Initial-access dropper: .com (or double-extension) executable from a user-writable / archive-extraction path```
| where (like(img,"%.com") OR match(img,"\.(com|exe)$")) AND (match(img,"\\\\appdata\\\\") OR match(img,"\\\\temp\\\\") OR match(img,"\\\\downloads\\\\") OR like(img,"%gst debit note%") OR like(img,"%tuglainsaatci%"))
| eval is_dotnet=if(match(lower(Description),"\.net|microsoft\.net") OR like(lower(OriginalFileName),"%.com"),1,0)
| table _time host User Image OriginalFileName CommandLine ParentImage Hashes ProcessGuid
| join type=left ProcessGuid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\clr.dll" OR ImageLoaded="*\\mscoree.dll" OR ImageLoaded="*\\mscorlib*")
    | stats values(ImageLoaded) as clr_modules by ProcessGuid ]
| where isnotnull(clr_modules)
```Reflective load tell: CLR present but staged loader DLL never image-loaded from disk```
| search NOT [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\Optimax.dll" OR ImageLoaded="*System Optimizer Ultimate.dll") | fields ProcessGuid ]
| table _time host User Image CommandLine ParentImage clr_modules Hashes
````

### Microsoft KQL

```kql
let window = 1h;
let dropper = DeviceProcessEvents
| where Timestamp > ago(window)
| where FolderPath has_any (@"\AppData\", @"\Temp\", @"\Downloads\") or FileName endswith ".com" or FileName has "GST Debit Note" or ProcessVersionInfoOriginalFileName has "Tugla"
| where FileName endswith ".com" or FileName endswith ".exe"
| project Timestamp, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256, ProcessId;
let clr = DeviceImageLoadEvents
| where Timestamp > ago(window)
| where FileName in~ ("clr.dll","mscoree.dll","clrjit.dll")
| distinct DeviceId, ProcessId;
let stagedLoad = DeviceImageLoadEvents
| where Timestamp > ago(window)
| where FileName in~ ("Optimax.dll","System Optimizer Ultimate.dll")
| distinct DeviceId, ProcessId;
dropper
| join kind=inner clr on DeviceId, ProcessId
| join kind=leftanti stagedLoad on DeviceId, ProcessId
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
```

### Sigma

```yaml
title: GST Debit Note .COM .NET Dropper Execution (Steganographic Remcos Loader)
id: 7b2f1c9a-0d44-4e21-9c3a-1a2b3c4d5e61
status: experimental
description: Detects execution of the TL-2026-0911 initial-access dropper - a 32-bit .NET .com executable themed on Indian GST/financial lures, carrying Turkish 'TuglaInsaatci' artifacts, launched from a user-writable or archive-extraction path.
references:
    - https://cybersecuritynews.com/malicious-gst-debit-note-attachment-deploys-remcos-rat/
    - https://gbhackers.com/steganographic-loader-deploys-remcos-rat/
    - https://attack.mitre.org/techniques/T1204/002/
    - https://attack.mitre.org/techniques/T1620/
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/06/23
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1027.003
    - attack.t1620
    - attack.tool.remcos
logsource:
    product: windows
    category: process_creation
detection:
    selection_ext:
        Image|endswith: '.com'
    selection_path:
        Image|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Downloads\'
    selection_name:
        - Image|contains: 'GST Debit Note'
        - OriginalFileName|contains: 'Tugla'
        - Product|contains: 'Tugla'
    condition: selection_ext and (selection_path or selection_name)
falsepositives:
    - Legitimate .com utilities (rare) executed from temp paths by administrators
level: high
```

**Known false positives:**

- Legitimate .com console utilities run from temp/download paths by administrators
- Self-extracting installers that reflectively load .NET assemblies

**Tuning notes:** Whitelist known-good signed .com utilities and approved installer hashes. If image-load (EventCode 7 / DeviceImageLoadEvents) volume is heavy, scope the CLR correlation to processes whose parent is an archive tool (winrar/7z/explorer). Add the campaign MD5s (897ABF67..., AFE085B7..., F3626A38...) as a high-fidelity boost.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Steganographic .NET-Bitmap Stage Extraction & Reflective In-Memory Load — Exploitation (locked: unlock with TL Creds)
- Anti-Analysis VM/Sandbox Checks + AppData Persistence Drop — Post-Exploitation (locked: unlock with TL Creds)
- Browser Credential/Cookie Theft, [indicator] Staging & Surveillance Capture — C2 / Collection (locked: unlock with TL Creds)
- Steganographic .NET-Bitmap Resource Container — Exploitation Artifact (locked: unlock with TL Creds)
- [indicator] Auto-Elevation Child Process Following ms-settings Hijack — Privilege Escalation (locked: unlock with TL Creds)
- Remcos Infection Mutex & Process Hollowing into Default Browser — C2 / Lateral (locked: unlock with TL Creds)
- Superhidden AppData Run-Key Persistence with eventvwr/fodhelper UAC Bypass — Post-Exploitation (locked: unlock with TL Creds)
- Remcos C2 Beacon — Non-Standard High-Port TCP, Browser Process Hollowing & Infection Mutex — C2 / Lateral (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `62.102.148[.]212`
- File hash: `C2E25ABA8E2AD4CAFDD6C633B8CA0906`
- IP address: `217.138.252[.]123`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malicious GST Debit Note Attachment Deploys Remcos RAT](https://cybersecuritynews.com/malicious-gst-debit-note-attachment-deploys-remcos-rat/)
- [Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally](https://gbhackers.com/steganographic-loader-deploys-remcos-rat/)
- [Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments](https://cyberpress.org/steganographic-loader-delivers-remcos/)
- [K7 Labs: multi-stage fileless Remcos loader campaign using steganography and in-memory DLL loading](https://malwaretips.com/threads/k7-labs-reports-a-multi-stage-fileless-remcos-loader-campaign-using-steganography-and-in-memory-dll-loading-to-evade-detection.141897/)
- [MITRE ATT&CK: Process Hollowing (T1055.012)](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK: Abuse Elevation Control Mechanism - Bypass User Account Control (T1548.002)](https://attack.mitre.org/techniques/T1548/002/)
- [MITRE ATT&CK: Obfuscated Files or Information - Steganography (T1027.003)](https://attack.mitre.org/techniques/T1027/003/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0911