Remcos

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Total Surveillance and Keylogging: Remcos features a highly effective, persistent keylogger. It also allows the attacker to secretly view the victim's screen in real-time, activate the webcam, record audio from the microphone, and steal saved passwords from web browsers and FTP clients.
• Advanced Evasion (Process Injection): The builder allows attackers to easily pack the payload. Upon execution, Remcos utilizes process hollowing, decrypting its core payload directly into the memory of a legitimate Windows process (like `svchost.exe` or `explorer.exe`), completely evading file-based antivirus scanning.
• System Administration and Lateral Movement: The attacker has full GUI-based control over the file system, registry, and running processes. Remcos provides a remote command shell, allowing attackers to utilize PowerShell to move laterally across the corporate network.

Threat Assessment

Incident Response and Remediation

• Immediate Network Severance: The endpoint must be physically disconnected from the network instantly to terminate the attacker's interactive session and halt any ongoing data exfiltration or lateral pivoting.
• Hunt for Lateral Movement: Incident responders must assume the attacker has used Remcos to steal local credentials and move laterally. Scrutinize Active Directory authentication logs and internal network traffic for anomalous administrative activity originating from the compromised host.
• Total Re-imaging and Credential Wipe: The machine cannot be trusted and must be wiped to bare metal. Every single credential (user, service accounts, domain admin) that was exposed to the compromised machine must be immediately reset globally.

Known aliases

Threat reports may refer to this family under multiple names:

• RAT.Remcos
• Backdoor.Win32.Remcos
• RemcosRAT

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1071.001 T1056.001 T1055

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REMCOS {
    meta:
        description = "Detects Remcos (rat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "remcos" ascii wide nocase
        $s2 = "rat.remcos" ascii wide nocase
        $s3 = "backdoor.win32.remcos" ascii wide nocase
        $s4 = "remcosrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Remcos Activity
id: cae8a30912dca6afdb1cf79734265504
status: experimental
description: Detects generic indicators of the remcos malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*remcos*"
            - "*rat.remcos*"
            - "*backdoor.win32.remcos*"
            - "*remcosrat*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: Remcos (S0332)
• Search "remcos" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: rat)

Explore other malware families in the same category:

• Farfli
• Xtrat
• Nanocore
• Poison
• Spygate

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/remcos.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.