Fake OnlyFans MALWARE: Remcos Infostealer VBScript Stager

The video analyzes a malware sample delivered via a fake photo archive that contains Visual Basic scripts designed to drop Remcos RAT (Remote Access Trojan) 0:00-0:03.

Key Takeaways:
• The "vb.trogen.zip" file contains directories that appear to hold photos but actually contain malicious Windows executables 0:08-0:15
• The malware uses extensive Visual Basic scripts with obfuscation techniques like string manipulation and hex encoding to hide malicious code 1:01-1:06
• After deobfuscation, the malware checks system architecture and registers a DLL to drop Remcos RAT, which connects to a command-and-control server 12:12-12:25
• This malware campaign appears to be part of a larger scheme using fake adult content (Lana Rhodes/OnlyFans) to lure victims into executing the malware 15:04-15:19

The analyst demonstrates how dynamic sandboxing tools like Any.Run can quickly reveal malware behavior that might be missed in static analysis alone 5:38-5:40.

Sources:

• 0:00-0:03 Introduction to the malware sample
• 0:08-0:15 Malware directory structure analysis
• 1:01-1:06 Visual Basic script obfuscation techniques
• 12:12-12:25 Remcos RAT execution and connection
• 15:04-15:19 Campaign context and lure tactics
• 5:38-5:40 Dynamic analysis with sandbox tools