Detonate the ‘Refund’ RAT in a Sandbox, Not on Grandma’s Laptop

the “microsoft refund department” does not email you a form. it emails you a signed remote-support client with a relay baked in, and once you run it, the nice man in the call center owns your desktop. good news: you can watch the whole thing happen inside a disposable vm instead of on a victim’s real machine, and come out the other side with iocs instead of a drained bank account.

why you detonate at all

the fake-refund and fake-support crews almost never ship bespoke malware. why bother writing a rat when connectwise will sell you a perfectly good one with a code-signing cert and an uptime SLA. the “virus” your relative almost installed is usually a legitimate remote monitoring and management (RMM) tool: screenconnect (connectwise), anydesk, teamviewer, or a thin loader that fetches one. that is the whole trick. it is signed, it looks boring, and your edr might wave it through because it is technically allowed software.

detonating it in a controlled lab tells you three things a static look cannot: what it actually connects to, how it stays resident, and what the operator can do once they are in. that becomes a blocklist, an edr rule, and a report that a hosting provider cannot wave away.

step 1: build a room with no doors

the whole point is containment. take a clean snapshot first so you can roll back instantly, put the vm on a host-only network so nothing escapes to your lan, and stand up fake internet so the malware gets answers (and shows you what it wants) without ever reaching a real server.

inetsim (or fakenet-ng) answers dns, http, https and smtp with its own services, so the sample resolves its domains and gets a reply. you log every request. a remnux box makes a lovely analysis workstation next to the victim vm if you want full packet inspection and yara on tap.

step 2: arm the cameras, then double-click

before you run anything, start the recorders. tcpdump on the host-only interface for packets, procmon (process monitor) inside the vm for process, file, registry and network events. then, and only then, detonate.

the process tree is the confession. a document, a form, a “security tool,” anything that quietly spawns powershell -w hidden -enc and then drops a remote-support client is not what it claims. watch for the run key or scheduled task that makes it survive a reboot. that persistence entry is both a detection and a cleanup checklist for later.

step 3: read the network, find the relay

packets do not lie and they do not care about the operator’s feelings. pull dns queries and tls sni out of the capture and you will usually see the rmm vendor’s relay hostnames plus whatever cheap domain the crew registered last tuesday.

screenconnect’s relay rides 8041/tcp by default, anydesk has its own ranges and ports, teamviewer too. the instance id in the hostname (the instance-xxxxxx bit) is gold: it identifies the specific tenant the crew is renting, which is exactly what the vendor’s abuse team needs to kill it.

what defenders and victims can do

• victim, right now: if you let someone “connect” to you, power the machine off the network, then from a clean device change passwords (email first), call the real bank on the number on your card, and uninstall the remote tool. assume they saw whatever was on screen.
• defender: alert on rmm installers that no one in it deployed. connectwise, anydesk and teamviewer all publish guidance on locking down or detecting unauthorized use. unexpected 8041/tcp egress, a fresh ScreenConnect service, or an rmm client with a run key on a user endpoint is a page-someone event.
• everyone: the real microsoft, the real bank, and the real irs do not cold-call to install software. that is the entire scam in one sentence.

sloth take

the scariest malware of 2026 is a legitimate, signed, well-documented remote-support tool pointed at someone who trusts the voice on the phone. you cannot patch trust. but you can detonate the loader in a box with no doors, read the relay off the wire, and hand a hosting provider something they have to act on. do that instead of arguing about whether edr “should have caught it.”

want the boring, careful version of malware detonation and IR runbooks for your team? Book Dark Edge Consulting.

sources

• INetSim network simulation documentation (inetsim.org)
• REMnux malware analysis toolkit (remnux.org)
• ConnectWise ScreenConnect security and abuse guidance (connectwise.com)
• CISA guidance on protecting against malicious use of remote monitoring and management software
• Lab artifacts generated on-box 2026-10-17 (synthetic sample, capture, and terminal captures)