Loading malware…
Remcos (Remote Control & Surveillance) is a commercial Windows remote administration and surveillance tool widely abused as a remote access trojan. Marketed as remote control software, it gives attackers interactive control over compromised computers and supports espionage, information theft, and deployment of additional malware. Its capabilities include command execution, file manipulation, downloading and executing files, keylogging, clipboard collection, screenshot capture, audio recording, and webcam capture. It can also collect credentials and browser-session information and discover local accounts, files, application windows, and victim-location information.
Remcos is frequently distributed through phishing and malicious spam using invoice, payment, procurement, shipping, and other business-themed lures. Delivery chains include malicious Office documents, executable attachments disguised as documents, and specially crafted archives. Document-based campaigns have exploited CVE-2017-0199 and CVE-2017-11882, while archive-based campaigns have exploited WinRAR vulnerability CVE-2023-38831. Attackers have also distributed it through malicious software repositories and fake CrowdStrike recovery packages. Multistage loaders commonly combine obfuscated scripts, PowerShell, legitimate interpreters, encoded payloads, and image-embedded data; GuLoader has also delivered Remcos.
Remcos supports concealment through process injection and has been executed inside legitimate Windows processes. Observed campaigns use memory-resident loading, virtualization and sandbox checks, and startup persistence established by accompanying loaders. Its embedded configuration is RC4-encrypted and contains operational settings for command-and-control communication and surveillance. Remcos has been used by TA558, Gorgon Group, and OPERA1ER. Documented targeting includes manufacturing enterprises, government institutions, and banks in Russia and Belarus, financial organizations in Africa, hospitality organizations, and Ukraine's government sector. Its availability to multiple unrelated operators makes its presence insufficient to establish threat-actor attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-38831, the WinRAR zero-day remote code execution vulnerability, has been exploited in the wild to distribute several malware families.
CVE-2017-0199 is still targeted to allow for execution of remote code from within an XLS file. The campaigns delivered a malicious XLS file with a link from which a remote HTA or RTF file would be executed to download the final payload.
The RTF document has embedded malicious code. It Leverages the Equation Editor Vulnerability (CVE-2017-11882) to trigger the download of the subsequent payloads in the attack chain. The process utilizes the legitimate executable “EQNEDT32.EXE” to initiate the execution of malicious shellcode.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
And sure enough, the MD5 of the file {CACAF1F7-CE7C-4CA2-B9E3-ABBC9F6E965D}.exe maps to a file on VirusTotal named Erlianaw.exe, the filename we saw earlier during the analysis of the LNK file. Figure 5: Erlianaw.exe - Remcos on VirusTotal
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
46 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Analysis of the downloaded file revealed previously undocumented techniques used in the delivery chain for the Remcos implant.
Analysis of the downloaded file revealed previously undocumented techniques used in the delivery chain for the Remcos implant.
Analysis of the downloaded file revealed previously undocumented techniques used in the delivery chain for the Remcos implant.
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.
The Remcos (Remote Control & Surveillance) RAT malware provides attackers with complete control over an infected system. It can be used for data theft, espionage, and other malicious activities.
В результате чего осуществляется создание процесса Regasm.exe, посредством которого происходит заражение устройства трояном Remcos.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon exploiting the successful vulnerability, it leads to BAT file execution, which pretends to be a PDF file.
TA558 использовала команды Windows PowerShell для загрузки данных, обфускации полезной нагрузки и запуска ВПО
TA558 использовали скрипты Visual Basic для запуска ВПО и эксплуатации CVE
The downloaded content undergoes a decoding process involving both reversal and Base64 decoding.
полезная нагрузка размещалась в изображениях и закодированных текстовых файлах
This assembly is a variant of Remcos RAT, which is then injected into the legitimate Windows process ‘RegAsm’ ... for execution.
TA558 использовало команды позволяющее декодировать полезную нагрузку полученную в ходе атаки из изображений и файлов
MSHTA acting as VBScript interpreter ['DefenseEvasion', 'Execution'] ['T1218.005', 'T1059.005']
«Проверка процессов (vmtoolsd, vbox.exe) ... PlugX, Remcos, EvilBunny»; «WMI-запросы ... GravityRAT, OopsIE»; «Ключи реестра ... Smoke Loader, ROKRAT».
Application Windows Discovery (T1010) — Remcos ... осуществляло сбор информации о приложениях установленных в системе
Remcos позволяющее осуществлять поиск файлов в системе, а также имеет возможности файлового менеджера
Remcos которое осуществляло сбор информации о локальной учетной записи устройства
The Remcos RAT grants threat actors’ extensive control, enabling activities such as remote control, keylogging, data theft, screenshot capture, file manipulation, and command execution.
This file records all activities, including keystrokes and data copied to the clipboard.
Remcos которое могло осуществлять снятие информации с аудиовыходов зараженного устройства
1,801 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as a modern RAT used for malicious remote access by criminal groups. The reference provides no Remcos-specific infection chain or technical details.
Commercial C++ Windows remote-control software explicitly described as widely abused in phishing campaigns using Office files and scripts. Listed artifacts include default port 2404 and configuration stored in an encrypted resource. XWorm operators have also deployed it as an additional payload.
A commodity remote-access trojan delivered via SVG-borne malware-delivery campaigns targeting Latin America, particularly Colombia.
Remcos RAT is the final payload delivered through a phishing XLS attachment exploiting CVE-2017-0199. It provides remote command execution and collects system and user data through keylogging, screen capture, and file manipulation, transmitting collected information and command results to its C2 server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.