TF-1821426
medium
📛 Threat Title
Remcos: Domain that is used for botnet Command&control (C&C) coinduit.io
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 50. First seen: 2026-06-02 14:34:21 UTC. Reporter: juroots. Tags: c2, remcos.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
34.76.205.124
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
IOC database
- Type
- ipv4
- Value
34.76.205.124- First seen
- Last seen
- Attached to this threat
- Appears in
- 27 threats
- Description
- Resolved from domain xpch.sa.com
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/34.76.205.124
domain
coinduit.io
UrlVoid 5 / 36
IOC database
- Type
- domain
- Value
coinduit.io- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 50. First seen: 2026-06-02 14:34:21 UTC. Reporter: juroots. Tags: c2, remcos.
Remediations (10)
-
web:censys.com
Executive Summary Remcos is a commercial remote access tool distributed by Breaking-Security and marketed as "Remote Administration Software." It supports remote command execution, file transfer, screen capture, keylogging, and credential collection over an HTTP or HTTPS command-and-control (C2) channel. Public reporting places initial development in the mid-2010s. Recent versions use a ...
-
web:gbhackers.com
A concerning subset of Remcos C2 hosts exposed additional services including Server Message Block (SMB) and Remote Desktop Protocol (RDP), suggesting operators maintain direct control infrastructure alongside automated deployment mechanisms. Threat Assessment and Recommendations The combination of remote command execution, file transfer, keylogging, and credential collection capabilities makes ...
-
web:github.com
This repository details the findings from a recent incident response engagement involving a Remcos Remote Access Trojan (RAT) infection. My analysis focused on network traffic captured in a Packet Capture (PCAP) file to identify the malware's communication patterns, Command & Control (C2) infrastructure, and exfiltration activities.
-
web:www.aryaka.com
How does Unified SASE as a Service help mitigate Remcos Infections? A Unified SASE framework integrates network security and zero-trust access controls to defend against threats like Remcos RAT, which uses command-and-control (C2) channels for data exfiltration and remote operations.
-
web:www.cyberdefensemagazine.com
The discovery of multiple IPs hosting the Remcos RAT underscores the widespread reach of this threat: these IPs serve as conduits for delivering malicious payloads, and the dynamic nature of the infrastructure presents an intricate challenge for mitigation efforts.
-
web:www.cyfirma.com
The discovery of multiple IPs hosting the Remcos RAT underscores the widespread reach of this threat: these IPs serve as conduits for delivering malicious payloads, and the dynamic nature of the infrastructure presents an intricate challenge for mitigation efforts.
-
web:www.elastic.co
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team dove into the REMCOS execution flow. In this article, you'll learn more about REMCOS configuration structure and its C2 commands.
-
web:www.fortinet.com
The setting values tell Remcos how to do its work on the victim's device, including the C&C server IP address and port, Remcos' name, Remcos' mutex name (also registry key name), a Remcos license number, the keylogger's local log file, a couple of certificates used to verify and communicate with the C&C server, and several switch flags ...
-
web:www.malwarebytes.com
Backdoor. Remcos is Malwarebytes' detection name for a family of Backdoor Trojans that allow remote access and control over the affected system.
-
web:www.pointwild.com
Remcos RAT initializes by decrypting its configuration, setting persistence, and dynamically loading APIs to evade detection before establishing command-and-control (C2) communication. Its initialization sequence is designed to hide its true capabilities until runtime, making it more difficult. Remcos stores its configuration in encrypted or compressed form inside the binary.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.