Remcos
Remcos RAT
- 10 paths
logs*.dat*- Version 1
- CERT CWATCH - ALMOND
Paths on disk
10 paths
Notes
Remcos RAT is a lightweight, fast, and highly customizable Remote Administration Tool with a wide array of functionalities.
This tool permits keylogging and surveillance (including audio recording and screenshots) and is frequently used by threat actors such as FIN7.
This target collects all known path where this tool was installed during previous campaigns.
References
6 links
- splunk.com/en_us/blog/security/splunk-fin7-tool-detections-remcos.html(opens in new tab)
- redcanary.com/threat-detection-report/trends/rmm-tools/(opens in new tab)
- cyfirma.com/research/exploiting-document-templates-stego-campaign-deploying-remcos-rat-and-agent-tesla/(opens in new tab)
- wazuh.com/blog/using-wazuh-to-detect-remcos-rat/(opens in new tab)
- uptycs.com/blog/threat-research-report-team/remcos-rat-uac-0500-pipe-method(opens in new tab)
- elastic.co/security-labs/dissecting-remcos-rat-part-one(opens in new tab)