Any[.]run identified a multi-stage phishing campaign using a Google Drive-themed lure and delivering Remcos RAT. Attackers place the HTML on storage[.]googleapis[.]com, abusing trusted infrastructure instead of hosting the phishing page on a newly registered domain.
The chain leverages RegSvcs.exe, a legitimate signed Microsoft/.NET binary with a clean VirusTotal hash. Combined with trusted hosting, this makes reputation-based detection unreliable and lowers alert priority during triage. File reputation alone is not enough. Detection depends on behavioral analysis and sandboxing.
The page mimics a Google Drive login form, collecting email, password, and OTP. After a “successful login,” the victim is prompted to download Bid-Packet-INV-Document.js, triggering a multi-stage delivery chain:
S (WSH launcher + time-based evasion) -> VBS Stage 1 (download + hidden execution) -> VBS Stage 2 (%APPDATA%\WindowsUpdate + Startup persistence) -> DYHVQ.ps1 (loader orchestration) -> ZIFDG.tmp (obfuscated PE / Remcos payload) -> Textbin-hosted obfuscated .NET loader (in-memory via Assembly.Load) -> %TEMP%\RegSvcs.exe hollowing/injection -> Partially fileless Remcos + C2
Analysis session: https://app.any.run/tasks/0efd1390-c17a-49ce-baef-44b5bd9c4a97
TI Lookup query: domainName:www.freepnglogos.com and domainName:storage.googleapis.com and threatLevel:malicious
IOCs
Phishing URLs:
hxxps://storage[.]googleapis[.]com/pa-bids/GoogleDrive.html
hxxps://storage[.]googleapis[.]com/com-bid/GoogleDrive.html
hxxps://storage[.]googleapis[.]com/contract-bid-0/GoogleDrive.html
hxxps://storage[.]googleapis[.]com/in-bids/GoogleDrive.html
hxxp://storage[.]googleapis[.]com/out-bid/GoogleDrive.html
Credential exfiltration domains:
usmetalpowders[.]co
iseeyousmile9[.]com
Credential exfiltration path:
/1a/uh.php
Malware staging host:
brianburkeauction[.]com
Source: r/ANYRUN