Remcos RAT: Malicious Invoice Attachment

An accounts-payable employee receives a phishing email carrying a password-protected ZIP that bypasses gateway sandboxing. Inside is a VBScript loader that chains through wscript and a hidden PowerShell cradle to drop the Remcos remote-access trojan. Walk the email gateway, file artifacts, and endpoint process tree step by step from the spoofed sender to the C2 beacon.