TF-1920518
high
📛 Threat Title
Remcos: Domain that is used for botnet Command&control (C&C) c2.digitalwala.in.net
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 100. First seen: 2026-09-15 20:37:27 UTC. Last seen: 2026-09-15 20:37:29 UTC. Reporter: dyingbreeds_. Tags: remcos.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
34.76.205.124
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
IOC database
- Type
- ipv4
- Value
34.76.205.124- First seen
- Last seen
- Attached to this threat
- Appears in
- 27 threats
- Description
- Resolved from domain xpch.sa.com
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
domain
c2.digitalwala.in.net
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
c2.digitalwala.in.net- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to Remcos
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 100. First seen: 2026-09-15 20:37:27 UTC. Last seen: 2026-09-15 20:37:29 UTC. Reporter: dyingbreeds_. Tags: remcos.
- External reference ThreatFox IOCs
Remediations (10)
-
web:censys.com
Executive Summary Remcos is a commercial remote access tool distributed by Breaking-Security and marketed as "Remote Administration Software." It supports remote command execution, file transfer, screen capture, keylogging, and credential collection over an HTTP or HTTPS command-and-control (C2) channel. Public reporting places initial development in the mid-2010s. Recent versions use a ...
-
web:cybersecuritynews.com
Remcos , a commercial remote access tool distributed by Breaking-Security and marketed as administrative software, has become a serious threat in the cybersecurity landscape. Developed in the mid-2010s, this malware enables attackers to execute remote commands, steal files, capture screens, log keystrokes, and collect user credentials through command-and-control servers using HTTP or HTTPS ...
-
web:gbhackers.com
A concerning subset of Remcos C2 hosts exposed additional services including Server Message Block (SMB) and Remote Desktop Protocol (RDP), suggesting operators maintain direct control infrastructure alongside automated deployment mechanisms. Threat Assessment and Recommendations The combination of remote command execution, file transfer, keylogging, and credential collection capabilities makes ...
-
web:github.com
Initial Reconnaissance Analysis: Identifying calls to external geolocation services (geoplugin.net), which is a common first step for many RATs to gather victim context. C2 Channel Identification: Pinpointing the Command & Control server's IP address and domain , along with the specific ports and protocols used for communication.
-
web:www.aryaka.com
How does Unified SASE as a Service help mitigate Remcos Infections? A Unified SASE framework integrates network security and zero-trust access controls to defend against threats like Remcos RAT, which uses command-and-control (C2) channels for data exfiltration and remote operations.
-
web:www.checkpoint.com
As a RAT, command and control (C2) is a core capability of Remcos malware. The malicious traffic is encrypted en route to the C2 server, and the attacker uses Distributed DNS to create a variety of domains for C2 servers. This makes it possible for the malware to defeat protections that rely on filtering traffic to known malicious domains .
-
web:www.elastic.co
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team dove into the REMCOS execution flow. In this article, you'll learn more about REMCOS configuration structure and its C2 commands.
-
web:www.elastic.co
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three In previous articles in this multipart series, malware researchers on the Elastic Security Labs team dove into the REMCOS execution flow. In this article, you'll learn more about REMCOS configuration structure and its C2 commands.
-
web:www.ethicalhackinginstitute.com
Full 2025 technical analysis of Remcos RAT - the most abused Remote Access Trojan in India right now. Infection vectors, persistence tricks, C2 communication, surveillance features, real IOCs, and enterprise-grade detection & removal methods taught at Ethical Hacking Training Institute, Webasha Technologies, and Cybersecurity Training Institute.
-
web:www.pointwild.com
Remcos RAT initializes by decrypting its configuration, setting persistence, and dynamically loading APIs to evade detection before establishing command-and-control (C2) communication. Its initialization sequence is designed to hide its true capabilities until runtime, making it more difficult. Remcos stores its configuration in encrypted or compressed form inside the binary.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.