Malware

Remcos

Also known as: RemcosRAT · Remvio · Socmer

Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers. Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns. Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user. Remcos is developed by the cybersecurity company BreakingSecurity.

Indicators of Compromise 23

Domain gitcode[.]com Domain muckcoding[.]com Domain muckdeveloper[.]com Domain pastebin[.]com Domain rlim[.]com Domain t[.]me Filename 7zrr.exe Filename L.ps1 Filename Microsoft.exe Filename api.db GitHub Repo github.com/LastWer/MicrosoftCur GitHub Repo github.com/kaleidora/dnsub-scanning-tool GitHub Repo github.com/tb78/expresso SHA-256 129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff SHA-256 4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4 SHA-256 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 SHA-256 57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629 SHA-256 73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2 SHA-256 86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c SHA-256 969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe SHA-256 a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4 SHA-256 e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63 Registry User [email protected]

MITRE ATT&CK TTPs 24

T1012
Query Registry
Discovery
 T1027
Obfuscated Files or Information
Defense Evasion
 T1027.013
Encrypted/Encoded File
Defense Evasion
 T1036.005
Match Legitimate Name or Location
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1057
Process Discovery
Discovery
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1102.001
Dead Drop Resolver
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1112
Modify Registry
Defense Evasion
 T1113
Screen Capture
Collection
 T1140
Deobfuscate/Decode Files or Information
Defense Evasion
 T1195.001
Compromise Software Dependencies and Development Tools
Initial Access
 T1204.002
Malicious File
Execution
 T1490
Inhibit System Recovery
Impact
 T1543.003
Windows Service
Persistence
 T1548.002
Bypass User Account Control
Privilege Escalation
 T1555.003
Credentials from Web Browsers
Credential Access
 T1564.003
Hidden Window
Defense Evasion
 T1608.001
Upload Malware
Resource Development
 T1685
T1685

Source Articles

Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories
A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.
socket-dev