Malware
Remcos
Also known as: RemcosRAT · Remvio · Socmer
Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers. Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns. Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user. Remcos is developed by the cybersecurity company BreakingSecurity.
Indicators of Compromise 26
Domain gitcode[.]com Domain muckcoding[.]com Domain muckdeveloper[.]com Domain pastebin[.]com Domain rlim[.]com Domain t[.]me Filename 7zrr.exe Filename AVSync Filename L.ps1 Filename Microsoft.exe Filename api.db GitHub Repo elastic/kremlin-iocs GitHub Repo github.com/LastWer/MicrosoftCur GitHub Repo github.com/kaleidora/dnsub-scanning-tool GitHub Repo github.com/tb78/expresso SHA-256 129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff SHA-256 4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4 SHA-256 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 SHA-256 57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629 SHA-256 73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2 SHA-256 86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c SHA-256 969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe SHA-256 a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4 SHA-256 e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63 Registry User ethereum_wallet_0x5a7c8e4b3d9f1d5a7c8e4b3d9f1d5a7c8e4b3d9f Registry User [email protected]
MITRE ATT&CK TTPs 31
T1003 T1012 T1027 T1027.013 T1036.005 T1053.005 T1055 T1057 T1059.001 T1070.004 T1071.001 T1074 T1082 T1090 T1102.001 T1105 T1112 T1113 T1133 T1140 T1190 T1195.001 T1204.002 T1490 T1543.003 T1548.002 T1555.003 T1564.003 T1566 T1608.001 T1685
OS Credential Dumping
Credential Access
Query Registry
Discovery
Obfuscated Files or Information
Defense Evasion
Encrypted/Encoded File
Defense Evasion
Match Legitimate Name or Location
Defense Evasion
Scheduled Task
Execution
Process Injection
Defense Evasion
Process Discovery
Discovery
PowerShell
Execution
File Deletion
Defense Evasion
Web Protocols
Command And Control
Data Staged
Collection
System Information Discovery
Discovery
Proxy
Command And Control
Dead Drop Resolver
Command And Control
Ingress Tool Transfer
Command And Control
Modify Registry
Defense Evasion
Screen Capture
Collection
External Remote Services
Persistence
Deobfuscate/Decode Files or Information
Defense Evasion
Exploit Public-Facing Application
Initial Access
Compromise Software Dependencies and Development Tools
Initial Access
Malicious File
Execution
Inhibit System Recovery
Impact
Windows Service
Persistence
Bypass User Account Control
Privilege Escalation
Credentials from Web Browsers
Credential Access
Hidden Window
Defense Evasion
Phishing
Initial Access
Upload Malware
Resource Development
T1685
Source Articles
Malware bypasses browser checks to force install Chrome, Edge extensions
A banking malware operation active since mid-2025, dubbed KREMLIN, has been force-installing malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The malware bypasses Chromium's integrity checks by copying extensions into browser profile directories and modifying Secure Preferences using extracted encryption keys and regenerated HMACs. The infection begins via malicious JavaScript files disguised as financial documents, establishes persistence through scheduled tasks, downloads Node.js, and retrieves payloads from Ethereum smart contracts or images hosted on the Internet Archive.
bleeping-computer ·1mo ago
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories
A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.
socket-dev