[ MALWARE MUTEX INTELLIGENCE DATABASE ]

 ███████╗██╗   ██╗██╗██╗         ███╗   ███╗██╗   ██╗████████╗███████╗██╗  ██╗
 ██╔════╝██║   ██║██║██║         ████╗ ████║██║   ██║╚══██╔══╝██╔════╝╚██╗██╔╝
█████╗  ██║   ██║██║██║         ██╔████╔██║██║   ██║   ██║   █████╗   ╚███╔╝
██╔══╝  ╚██╗ ██╔╝██║██║         ██║╚██╔╝██║██║   ██║   ██║   ██╔══╝   ██╔██╗
 ███████╗ ╚████╔╝ ██║███████╗    ██║ ╚═╝ ██║╚██████╔╝   ██║   ███████╗██╔╝ ██╗
 ╚══════╝  ╚═══╝  ╚═╝╚══════╝    ╚═╝     ╚═╝ ╚═════╝    ╚═╝   ╚══════╝╚═╝  ╚═╝

Advanced Malware Analysis & Threat Intelligence

06:17:11

⚠

REMCOS

rat6 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

REMCOS

CATEGORY:

RAT

DESCRIPTION:

REMCOS is a commercial Remote Access Trojan (RAT) that has been sold since 2016. While marketed as a legitimate tool for remote administration, it is widely used by malicious actors for surveillance and unauthorized control of compromised systems.

ALIASES:

REMCOS RATBackdoor:Win32/Remcos

TAGS:

remote_accesscommercial_RATkeylogginginfostealerc2

[MUTEX_SIGNATURES](6)

[MUTEX_01]

MARE_IS_BEAUTIFUL_EX

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.elastic.co/security-labs/dissecting-remcos-rat-part-two

[MUTEX_02]

Rmc-<uniqueid>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-stealthy-stalker-remcos-rat/

[MUTEX_03]

Remcos_Mutex_Inj

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.splunk.com/en_us/blog/security/splunk-fin7-tool-detections-remcos.html

[MUTEX_04]

remcos_<uniqueid>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.trendmicro.com/en_us/research/19/h/analysis-new-remcos-rat-arrives-via-phishing-email.html

[MUTEX_05]

Remcos-<uniqueid>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Remcos

[MUTEX_06]

Mutex_RemWatchdog

ANALYST: @adhikara13 DATE: 2024-12-19

REFERENCES:

https://www.trendmicro.com/vinfo/de/threat-encyclopedia/malware/backdoor.msil.remcos.jcasnr

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2016

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:6

THREAT_ACTORS:1

ALIASES:2

TAGS:5

CATEGORY:RAT

Malware profile loaded successfully