TF-1821431
medium
📛 Threat Title
Remcos: Domain that is used for botnet Command&control (C&C) lmat.sa.com
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 50. First seen: 2026-06-02 14:34:21 UTC. Reporter: juroots. Tags: c2, remcos.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
34.76.205.124
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
IOC database
- Type
- ipv4
- Value
34.76.205.124- First seen
- Last seen
- Attached to this threat
- Appears in
- 27 threats
- Description
- Resolved from domain xpch.sa.com
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
domain
lmat.sa.com
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
lmat.sa.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 50. First seen: 2026-06-02 14:34:21 UTC. Reporter: juroots. Tags: c2, remcos.
Remediations (10)
-
web:attack.mitre.org
Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.
-
web:censys.com
Executive Summary Remcos is a commercial remote access tool distributed by Breaking-Security and marketed as "Remote Administration Software." It supports remote command execution, file transfer, screen capture, keylogging, and credential collection over an HTTP or HTTPS command-and-control (C2) channel. Public reporting places initial development in the mid-2010s. Recent versions use a ...
-
web:cybersecuritynews.com
The servers typically operated on port 2404, the default choice for Remcos , with additional activity observed on ports 5000, 5060, 5061, 8268, and 8808, showing operators' flexibility in deployment strategies. Remcos persistence configuration (Source - Censys) Understanding C2 Communication Networks reveals how Remcos maintains control.
-
web:gbhackers.com
A concerning subset of Remcos C2 hosts exposed additional services including Server Message Block (SMB) and Remote Desktop Protocol (RDP), suggesting operators maintain direct control infrastructure alongside automated deployment mechanisms. Threat Assessment and Recommendations The combination of remote command execution, file transfer, keylogging, and credential collection capabilities makes ...
-
web:github.com
This repository details the findings from a recent incident response engagement involving a Remcos Remote Access Trojan (RAT) infection. My analysis focused on network traffic captured in a Packet Capture (PCAP) file to identify the malware's communication patterns, Command & Control (C2) infrastructure, and exfiltration activities.
-
web:www.aryaka.com
How does Unified SASE as a Service help mitigate Remcos Infections? A Unified SASE framework integrates network security and zero-trust access controls to defend against threats like Remcos RAT, which uses command-and-control (C2) channels for data exfiltration and remote operations.
-
web:www.elastic.co
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team dove into the REMCOS execution flow. In this article, you'll learn more about REMCOS configuration structure and its C2 commands.
-
web:www.ethicalhackinginstitute.com
Full 2025 technical analysis of Remcos RAT - the most abused Remote Access Trojan in India right now. Infection vectors, persistence tricks, C2 communication, surveillance features, real IOCs, and enterprise-grade detection & removal methods taught at Ethical Hacking Training Institute, Webasha Technologies, and Cybersecurity Training Institute.
-
web:www.mcafee.com
In Q3 2024, McAfee Labs identified a sharp rise in the Remcos RAT threat. It has emerged as a significant threat in the world of cybersecurity, gaining traction with its ability to infiltrate systems and compromise sensitive data. This malware, often delivered through phishing emails and malicious attachments, allows cybercriminals to remotely control infected machines, making it a powerful ...
-
web:www.pointwild.com
Remcos is a Remote Access Trojan (RAT) originally a commercial remote management tool that threats actors increasingly abuse to gain unauthorized remote control of Windows systems. It provides capabilities such as credential theft, keylogging, screen capture, webcam/microphone control, and persistent command and control (C2) access. Infection ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.