Loading malware…
Remcos RAT is a Windows remote access trojan that originated as a commercial remote administration tool and has been widely abused by criminal and intrusion operators since at least 2016. It provides interactive remote control of infected systems and supports surveillance, credential collection, and general post-compromise activity. Documented capabilities include keylogging, automated screenshot capture, clipboard monitoring, microphone recording, registry manipulation, hidden-window execution for defense evasion, persistence through Windows autorun mechanisms, and commands associated with User Account Control bypass. Remcos stores operational configuration in encrypted settings data and has been observed using process hollowing or similar injection workflows in multi-stage delivery chains to launch its payload inside legitimate Windows processes.
Remcos is commonly delivered through phishing campaigns, including malicious Office documents with macros and other socially engineered attachments, and it is also distributed by loader ecosystems and staged script-based infection chains. Observed delivery patterns include archive attachments, malicious virtual disk images, and multi-stage PowerShell, VBScript, and .NET loaders that retrieve and execute the final RAT. Similar campaigns have used lures such as employment-related messages and financial or payment-themed documents. Remcos has also appeared as a secondary payload delivered by malware distribution services and downloaders such as GuLoader, and it has been associated with crypter or packer services used to facilitate commodity malware deployment.
The malware is used by a range of financially motivated and regional threat actors rather than a single exclusive operator. Public reporting has linked its use to actors including APT-C-36 and TAG-144, and it has also been observed on infrastructure supporting broader criminal ecosystems. Victim sectors observed in related activity have included government, healthcare, banking, education, and information technology, with notable reporting on campaigns affecting South American organizations. Remcos remains a prevalent commodity RAT in phishing and malware-as-a-service style operations because it combines broad remote administration features with straightforward deployment and flexible staging.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Actors (TAs) leveraging a Remote Code Execution (RCE) vulnerability, identified as CVE-2023-38831, to deliver their payload on compromised systems... The aforementioned vulnerability allows the WinRAR application to extract and execute the malicious script when a user tries to open a benign file within the archive. | Moreover, they observed that several other malware families, including GuLoader and Remcos RAT, were also utilizing the same exploit as a means of delivery.
In 2017, we reported spotting Remcos being delivered via a malicious PowerPoint slideshow, embedded with an exploit for CVE-2017-0199. | In July, we came across a phishing email purporting to be a new order notification, which contains a malicious attachment that leads to the remote access tool Remcos RAT... This attack delivers Remcos using an AutoIt wrapper that incorporates various obfuscation and anti-debugging techniques to evade detection.
The malicious Excel file exploits a vulnerability in Microsoft Office Equation editor called CVE-2017-11882. It downloads an executable from http://136[.]144[.]41[.]109/HRE[.]exe. Finally, this executable file downloads the final payload, which is Remcos. | Finally, this executable file downloads the final payload, which is Remcos. Remcos is a remote access Trojan (RAT) that can give an attacker full control over its target’s system.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
And sure enough, the MD5 of the file {CACAF1F7-CE7C-4CA2-B9E3-ABBC9F6E965D}.exe maps to a file on VirusTotal named Erlianaw.exe, the filename we saw earlier during the analysis of the LNK file. Figure 5: Erlianaw.exe - Remcos on VirusTotal
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
52 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
No less than 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, and artifacts bearing HiddenTear ransomware signatures, have communicated with Sable Squirrel's infrastructure.
APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.
Later, on November 12th, 2024, another spam campaign was launched ... Inside this RAR archive could be found a 32-bit executable Remcos payload that would communicate with its C2 on IP ‘111.90.140[.]65:2404’ and botnet ID “hstnw”.
The campaign included the use of a variant of AZORult, an information-stealing malware; as well as the RAT Remcos; the DarkVNC backdoor trojan; and a clipboard cryptocurrency stealer.
To give an overview, here is a list of all observed tools and malware types the actor has been using in recent years: Remcos RAT
Remcos communicates over non-HTTP/S channels/ports on custom protocols. The bot can be configured to communicate in plain text... however, in most cases, the communication is encrypted using the RC4 algorithm with a key present in the configuration.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
The ransomware campaign crafted a malicious website mimicking the IFP site, along with a slight variation of the IFP site domain name.
Remote Shell Access Establish a remote shell and execute system commands on the infected machine | Script Execution Execute JavaScript, VBS, or batch scripts remotely for additional malicious operations
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
This Remcos sample loader starts with a simple VBScript that attempts to download the second VBScript from paste.ee. The script on paste.ee is the main loader of Remcos. | if it is an x64 host, it will run the VBScript using the following command format “wscript /b /e:vbscript <vbscript filename>”
LoadDllFromC2 ... LoadDllFromURL ... REMCOS uses an external module for webcam recording. This module is a DLL that must be received and loaded from its C2
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
さらにこの PowerShell スクリプトは、変数 codigo に格納された難読化された文字列に対して、文字列 DgTre を文字 A に置換する処理を行った後、Base64 デコードして PowerShell スクリプトを実行します。
We discuss two prevalent such packers used to distribute a wide variety of malware but hiding the intended payload in images. | In a recent variation of this packer, the first stage payload is actually stored in a second PNG image extracted from the least significant bits of the Red, Green, and Blue channels in the first image.
The PNG file is a VB script file base64 encoded file which is decoded... From this URL we are able to get the base64 encoded VB script... After decoding it we came to know that it was a PE file.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
The covered campaigns have primarily been engineered for credential harvesting. Some utilize commodity malware, where others simply redirect to weaponized phishing sites.
The covered campaigns have primarily been engineered for credential harvesting. Some utilize commodity malware, where others simply redirect to weaponized phishing sites.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
1,484 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan operated through command-and-control infrastructure on expired domains controlled by the actor discussed in the report.
Remote access trojan using the expired-domain infrastructure as command-and-control.
Remote access trojan observed communicating with Sable Squirrel infrastructure.
Remote access trojan observed leveraging Sable Squirrel-associated domains as C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.