---
title: "Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering Remcos RAT to a Ukraine Entity in Finland"
description: Analysis and prevention of attempted attacks by threat actor UAC-0184 delivering Remcos RAT via an IDAT loader, using steganographic techniques.
image: https://www.morphisec.com/hubfs/Morphisec_Blog.banner_Remcos%20RAT_v.2.4.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering Remcos RAT to a Ukraine Entity in Finland

Posted by [Michael Dereviashkin](https://1534169.hs-sites.com/author/michael-dereviashkin) on February 26, 2024

- [Tweet](https://twitter.com/share)

Morphisec Threat Labs recently discovered multiple indicators of attacks leading to threat actor, UAC-0184. This discovery sheds light on the notorious IDAT loader delivering the Remcos Remote Access Trojan (RAT) to a Ukrainian entity based in Finland.   

# Introduction

This blog explores the broader execution course of the attack, emphasizing key unique aspects including usage of the IDAT loader and targeting of the Ukraine entity in Finland.  Detailed technical findings of associated Remcos RAT attacks have been previously reviewed by [CERT-UA](https://cert.gov.ua/article/6276988) (written in Ukraine), and [Uptycs](https://www.uptycs.com/blog/remcos-rat-uac-0500-pipe-method), describing Indicators of Compromise (IoCs), and detailed TTPs.   

![The Remcos Rat Steganography Saga](https://www.morphisec.com/hubfs/Morphisec_Blog.banner_Remcos%20RAT_800x400_v.2.4%20_lowrez.png)

## **Targeting Ukraine Entities, in Finland** 

While the adversary strategically targeted Ukraine-based entities, they apparently sought to expand to additional entities affiliated with Ukraine. Morphisec findings brought to the forefront a more specific target—Ukraine entities based in Finland (Note: Technical information of the targets cannot be disclosed due to confidentiality).  

 

## **Usage of Steganography (MITRE ID: **[**T1001.002**](https://attack.mitre.org/techniques/T1001/002/)**) ** 

The attack, as part of the IDAT loader, used steganography as a technique.  While steganographic, or “Stego” techniques are well-known, it is important to understand their roles in defense evasion, to better understand how to defend against such tactics. 

Steganography is used to obfuscate malicious code or files within an image or video, distributing the payload within the media’s pixel data, making it difficult to detect.  

For example, an image with a pixel depth of 24 bit (16.7 million colors) may contain embedded code in the least significant bits (LSB) of each pixel, without changing how the picture looks.  

While the media file may be scanned, since the malicious payload is obfuscated, it can evade signature-based detection, allowing a malware loader to successfully drop the media, extract the malicious payload, and execute it in memory. In this the case, the image looked visibly distorted, however the obfuscation was sufficient for defense evasion.  

 ![Image of a Cat with text "This Image Can Hack Your Computer"](https://www.morphisec.com/hubfs/hack-computer.webp)Steganographic techniques are used for payload obfuscation (Image credit: [The Hacker News](https://thehackernews.com/2015/06/Stegosploit-malware.html)) 

 

# **Remcos RAT**

![Remcos Logo](https://www.morphisec.com/hubfs/Remcos_RAT_Horizontal_Logo.webp)

[Remcos](https://breakingsecurity.net/remcos/) is a commercial remote access trojan (RAT). Morphisec previously described the [Remcos trojan](https://1534169.hs-sites.com/remcos-trojan-analyzing-attack-chain), which allows attackers to quickly and easily control an infected computer, steal personal information, and surveil a victim’s activity. All this without investing time or developing a tool with remote administrative capabilities. Morphisec additionally covered Remcos as a payload in [Guloader](https://1534169.hs-sites.com/guloader-the-rat-downloader), and the payload in the [Babadeda crypter](https://1534169.hs-sites.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities). 

Morphisec's commitment to proactive defense was pivotal in shielding its customers from this highly sophisticated threat, with our protection mechanisms kicking in at an early stage of the attack.   

 

## **Detection Timeline Insights** 

While Morphisec prevented multiple attacks, a specific incident can be highlighted. During the first weeks of January 2024, Morphisec's [proactive defense mechanisms](https://www.morphisec.com/moving-target-defense) prevented the execution of this malicious campaign; early detection played a pivotal role, providing crucial time for containment and incident response measures. The official UA Cert security alert (which validated the threat) was released several days later. Morphisec’s research revealed this, and subsequent attacks shared common artifacts with the UA Cert’s alerts, yet with multiple differences.  

This timeline underscores Morphisec's proactive stance, as the security alert confirmed that Morphisec had addressed the threat. 

 

**The following screenshot demonstrates the event timeline:**

**![Remcos Rat Attack Trajectory, showing it was stopped by Morphisec](https://www.morphisec.com/hubfs/Attack_Trajectory-1.png)***Morphisec’s mechanism prevented the threat several days before public disclosure by CERT-UA* 

 

### **Delivery Insights** 

The screenshot below provides additional details, based on information provided by the Ukrainian CERT (UA CERT). These details describe the deceptive recruitment tactics used under the guise of soliciting for the 3rd Separate Assault Brigade and the Israel Defense Forces (IDF). 

![Phising Email sent by Remcos, posing as an Email from IDF](https://www.morphisec.com/hubfs/Remcos_Phishing_IDF-ezgif.com-optiwebp.webp)

*A related Remcos RAT attack was delivered as a phishing email claiming to be from an Israel Defense Forces consultant (source: *[*Uptcycs*](https://www.uptycs.com/blog/remcos-rat-uac-0500-pipe-method)*)* 

 

### **Payload Delivery Flow Chart** 

This flow chart offers more clarity on the attempted delivery of the Remcos RAT by the IDAT loader. It illustrates the key stages of the attack throughout the main execution course. 

![Remcos delivery flow chart, showing the journey to injection into explorer.exe](https://www.morphisec.com/hubfs/Remcos_RAT_diagram_3-ezgif.com-optiwebp.webp)

### **IDAT Loader Overview** 

IDAT is an advanced loader that loads various malware families, including Danabot, SystemBC, and RedLine Stealer. Distinguished by its modular architecture, IDAT employs unique features like code injection and execution modules, setting it apart from conventional loaders.  

It employs sophisticated techniques such as dynamic loading of Windows API functions, HTTP connectivity tests, process blocklists, and syscalls to evade detection. The infection process of IDAT unfolds in multiple stages, each serving distinct functionalities.  

The initial stage downloads or loads the second stage, housing a module table and the primary instrumentation shellcode. The second stage injects this shellcode into a legitimate DLL or a new process. Subsequently, the main instrumentation shellcode decrypts and executes the final payload, adapting its injection or execution based on file type and configuration flags.  

Interestingly, in this case the IDAT modules were embedded within the primary executable, which is commonly downloaded from a remote server. 

The code of the analyzed IDAT is responsible for loading IDAT modules, has been observed by other security researchers, including [HijackLoader | ThretLabz (zscaler.com)](https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader).

 

### **IDAT Loader TTPs **  

IDAT Loader is a cyber threat that reveals a distinctive array of Tactics, Techniques, and Procedures (TTPs). This exploration analyzes the IDAT Loader with respect to this current campaign, and intentionally avoids explicit connections to prior campaigns to spotlight its strategic position within the current frame of IDAT Loader operations.   

Note: The usage of the IDAT loader to deliver Remcos RAT was previously described by threat researcher Yoroi, [Innovation in Cyber Intrusions: The Evolution of TA544](https://yoroi.company/en/research/innovation-in-cyber-intrusions-the-evolution-of-ta544/) . 

The following screenshot looks at the primary executable, focusing on the malicious-oriented code. In the code, it can be observed that a connection is made, and subsequently, a download is initiated from 'hxxps://aveclagare[.]org/wp-content/plugins/wpstream/public/js/youtube.min.js.'  

The code uses a distinctive user-agent ***‘racon’***, which serves multiple purposes.  

Firstly, it plays a role as the key in the campaign delivery chain, additionally checking connectivity and alleged analytics for the campaign. 

![Code snippet from UAC-0184](https://www.morphisec.com/hubfs/Code_Image_02.png)

This code’s purpose is to decrypt the API name ‘***InitOnceExecuteOnce’*** (used to transfer the execution point to the next stage in malware code) and resolve it during runtime to succeed. The URL download needs to return ***'(func'*** as the content response to be used as the key for decryption. 

In the subsequent code block, the primary objective is the decryption of the code block using the same key as before: ***‘(func’***. Following this, the code will dynamically resolve ***VirtualProtect*** to use it and modify the ***.text*** section rights to ***RWX***.  

Subsequently, it copies the following stage code to a predefined function location in the ***.text*** section and transfers the execution point to the just copied code through a regular call, deviating from the usage of ***'InitOnceExecuteOnce***.' 

 

![Code_Image_03](https://www.morphisec.com/hubfs/Code_Image_03.png)

### **Leveraging Steganography for defense evasion** 

As previously noted, the IDAT loader operates on a modular basis. Its configuration involves the utilization of an embedded steganographic PNG to locate and extract the payload, identified by the value ***0xEA79A5C6*** as the starting point. 

 ![Code snippet from UAC-0184](https://www.morphisec.com/hubfs/Code_Image_05-Stego.png)

*The extracted code * 

 

![Hex code snippet from UAC-0184](https://www.morphisec.com/hubfs/Code_Image_06b-Stego.png)

*The image pixel data showing the encoding of the IDAT loader* 

 

![Altered image from UAC-0184](https://www.morphisec.com/hubfs/Code_Image_06-Stego-ezgif.com-png-to-webp-converter.webp)

*The original image containing the embedded code * 

 

### **Code Injection** 

In the following stage, the goal is to load a legitimate library named— ***’PLA.dll’*** (Performance Logs and Alerts), which was chosen for this attack to inject the succeeding stage code to the loaded legitimate library, otherwise popularized as ‘Module Stomping’, a technique known for evading security solutions.  

 

![Screenshot2024-02-26at8.46.19AM-ezgif.com-png-to-webp-converter](https://www.morphisec.com/hubfs/Screenshot2024-02-26at8.46.19AM-ezgif.com-png-to-webp-converter.webp)

## **Indicators of Compromise (IOCs)** 

Due to customer confidentiality, below is a summary of IOCs for these prevented attacks.   

An extensive list of IOCs can be found in the [CERT-UA](https://cert.gov.ua/article/6276988) bulletin. 

| **Indicator** | **Details** |
| --- | --- |
| **Remcos C2** | 194.87.31[.]181 |
| **DockerSystem_Gzv3.exe** | 4b36a82e1781ffa1936703971e2d94369e3059c8524d647613244c6f9a92690b   |

 

# **How Morphisec helps** 

Morphisec’s [**Automated Moving Target Defense (AMTD)**](https://www.morphisec.com/moving-target-defense) stops attacks like IDAT Loader and Remcos RAT across the attack chain, detecting hidden malicious code (as was the case in this attack), and the payload malware itself. Morphisec doesn’t rely on signature or behavioral patterns. Instead, it uses patented moving target defense technology to prevent the attack at its earliest stages, preemptively blocking attacks on memory and applications, effectively remediating the need for response. 

[**Schedule a demo**](https://www.morphisec.com/schedule)** today to see how Morphisec stops this and other new emerging threats.**   
 

**[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/2b183160-ef94-4b88-9912-f90c274320d9.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/2b183160-ef94-4b88-9912-f90c274320d9)** 

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/unveiling-uac-0184-the-remcos-rat-steganography-saga#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Michael Dereviashkin",
    "url" : "https://1534169.hs-sites.com/author/michael-dereviashkin"
  },
  "dateModified" : "2024-12-19T16:11:39.614Z",
  "datePublished" : "2024-02-26T15:00:00.000Z",
  "headline" : "Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering Remcos RAT to a Ukraine Entity in Finland",
  "image" : [ "https://www.morphisec.com/hubfs/Morphisec_Blog.banner_Remcos%20RAT_v.2.4.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/unveiling-uac-0184-the-remcos-rat-steganography-saga",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```