Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. Remcos

Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.Remcos has been observed being used in malware campaigns.[1][2]

ID: S0332
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Version: 1.3
Created: 29 January 2019
Last Modified: 16 April 2025
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1548.002Abuse Elevation Control Mechanism:Bypass User Account Control

Remcos has a command for UAC bypassing.[3]

EnterpriseT1123Audio Capture

Remcos can capture data from the system’s microphone.[3]

EnterpriseT1547.001Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder

Remcos can add itself to the Registry keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.[3]

EnterpriseT1115Clipboard Data

Remcos steals and modifies data from the clipboard.[1]

EnterpriseT1059.003Command and Scripting Interpreter:Windows Command Shell

Remcos can launch a remote command line to execute commands on the victim’s machine.[3]

.006Command and Scripting Interpreter:Python

Remcos uses Python scripts.[1]

EnterpriseT1083File and Directory Discovery

Remcos can search for files on the infected machine.[1]

EnterpriseT1105Ingress Tool Transfer

Remcos can upload and download files to and from the victim’s machine.[1]

EnterpriseT1056.001Input Capture:Keylogging

Remcos has a command for keylogging.[3][2]

EnterpriseT1112Modify Registry

Remcos has full control of the Registry, including the ability to modify it.[1]

EnterpriseT1027Obfuscated Files or Information

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.[2]

EnterpriseT1055Process Injection

Remcos has a command to hide itself through injecting into another process.[3]

EnterpriseT1090Proxy

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.[1]

EnterpriseT1113Screen Capture

Remcos takes automated screenshots of the infected machine.[1]

EnterpriseT1125Video Capture

Remcos can access a system’s webcam and take pictures.[3]

EnterpriseT1497.001Virtualization/Sandbox Evasion:System Checks

Remcos searches for Sandboxie and VMware on the system.[2]

Groups That Use This Software

Campaigns

IDNameDescription
C0005Operation Spalax

[7]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp