Remcos Trojan: Analyzing the Attack Chain

This infection contains many stages and largely depends on the C2 server, which stores the required files for each stage. The attacker also uses a password-protected .xls file to lower the detection rate.