Procedure examples

Remcos can list all windows on victim systems.

Remcos can obtain Registry data from targeted systems.

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths. Remcos can also employ control flow flattening to hinder analysis.

Remcos can use string encryption to hinder analysis.

Remcos can enumerate the username on targeted hosts.

Remcos has a command to hide itself by injecting into another process.

Remcos has a command for keylogging.

Remcos can discover running processes on compromised machines.

Remcos can launch a remote command line to execute commands on the victim’s machine.

Remcos can execute VBS remotely.

Remcos uses Python scripts.

Remcos has the ability to execute JavaScript remotely.

Remcos can clean saved cookies and logins from the web browser.

Remcos can delete files and folders from victim machines.

Remcos can collect the OS version and process architecture of compromised hosts.

Remcos can search for files on the infected machine.

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.

Remcos can upload and download files to and from the victim’s machine.

Remcos has full control of the Registry, including the ability to modify it.

Remcos takes automated screenshots of the infected machine.

Remcos steals and modifies data from the clipboard.

Remcos can capture data from the system’s microphone.

Remcos can access a system’s webcam and take pictures.

Remcos can serialize collected data with Protobuf.

Remcos has been executed by luring victims into opening malicious email attachments including Excel files.

Remcos has the ability to modify the desktop wallpaper.

Remcos searches for Sandboxie and VMware on the system.

Remcos can shutdown and restart remote devices.

Remcos can terminate, suspend, and resume a process by PID.

Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Remcos has a command for UAC bypassing.

Remcos can zip files and folders for upload.

Remcos can modify file attributes to hide the file.

Remcos can set `ProcessWindowStyle.Hidden` to hide windows.

Remcos has been spread through emails containing malicious documents.

Remcos has used dynamic DNS domains in C2 communications.

Remcos can use TLS to encrypt C2 communication.

Remcos can identify the location of targeted devices.