Family: Remcos

Remcos is a closed-source remote control and surveillance software.

Suricata alert: REMCOS RAT Malware Inbound C2 Communication

Network activity triggered a Suricata alert

Suricata alert: REMCOS RAT Malware Outbound C2 Communication

Network activity triggered a Suricata alert

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Downloads MZ/PE file