{
  "Event": {
    "uuid": "ab0fd8fb-928e-585f-95d1-5a7f9983eacf",
    "info": "Remcos RAT OpenDirectory Campaign",
    "date": "2026-02-10",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791706631,
    "publish_timestamp": 1791706631,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"RAT\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Cred Theft\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Persistence\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Evasion\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1123\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Winlogon Helper DLL - T1547.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "b71c41a7-3814-53ec-8e0e-7d2dee888bf2",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791706631
      },
      {
        "uuid": "af24a407-a3e6-5784-87c6-373c2c595f2c",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/remcos-opendirectory-campaign.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791706631
      },
      {
        "uuid": "6ede0e8e-43d3-5999-99b9-2225037133f1",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/remcos-opendirectory/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791706631
      },
      {
        "uuid": "012d3b38-7962-5d48-b09b-8989e0670ade",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/remcos-opendirectory.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791706631
      },
      {
        "uuid": "478b9c41-2b92-5aae-b9ff-47af3bc4b4e0",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "db218dd5f53fbcf39a6db043c8455667c3dbef44abe14865e8b962b4c676372e",
        "to_ids": true,
        "comment": "sha256: db218dd5f53fbcf39a6db043c8455667c3dbef44abe14865e8b962b4c676372e [confidence 95/100]",
        "timestamp": 1791706631
      },
      {
        "uuid": "ba27ec12-56b0-5979-bc89-7d3ae9f86d7b",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82",
        "to_ids": true,
        "comment": "sha256: ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82 [confidence 95/100]",
        "timestamp": 1791706631
      },
      {
        "uuid": "c30bbb4d-e04b-5104-9e9b-aaf218dd6d9c",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: EnableLUA Registry Value Set to Disable User Account Control\nid: 0ce7475a-f0d5-48fe-bd80-629f9df689aa\nstatus: experimental\ndescription: >-\n  Detects the EnableLUA registry value under the system UAC policy key\n  being set to 0 (disabled), regardless of which process performs the\n  write. Complements the reg.exe process-creation detection for the\n  same Remcos RAT UAC-bypass technique by catching the resulting\n  registry state change if a different mechanism (e.g. PowerShell\n  Set-ItemProperty) performs the write.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\nmodified: '2026-10-11'\ntags:\n    - attack.privilege-escalation\n    - attack.t1548.002\n    - detection.emerging-threats\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\Policies\\System\\EnableLUA'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 0\n    condition: selection\nfalsepositives:\n    - Legitimate system administration (rare)\n    - Enterprise management tools (SCCM, Intune, Group Policy) disabling UAC for legacy application compatibility\nlevel: high",
        "to_ids": true,
        "comment": "EnableLUA Registry Value Set to Disable User Account Control (Registry State) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1548.002 | rule hash ee8ab0f5 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "958a7fdc-5b09-5a5d-a4db-83984692d3b8",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Non-Browser Process Accessing Chrome or Firefox Credential Store Files\nid: 27e252f6-c5d9-4545-ab96-b180ab116a88\nstatus: experimental\ndescription: >-\n  Detects access to Chrome (default profile Login Data and Cookies) or\n  Firefox (logins.json and cookies.sqlite under a Profiles folder)\n  credential and cookie database files by a process other than chrome.exe,\n  firefox.exe or msedge.exe - the technique used by the Remcos RAT\n  credential-theft module in this campaign. This is a family-agnostic\n  technique detector with no Remcos-specific test; legitimate password\n  managers and backup software are known to trigger it, so it is tiered for\n  hunting rather than direct alerting.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.credential-access\n    - attack.t1555.003\n    - attack.t1539\n    - detection.emerging-threats\nlogsource:\n    category: file_access\n    product: windows\n    definition: 'Requires file read-access telemetry for the browser profile files, for example Security EID 4663 with an audit SACL on them or an EDR file-access sensor; stock Sysmon does not log file reads.'\ndetection:\n    selection_chrome:\n        TargetFilename|endswith:\n            - '\\Google\\Chrome\\User Data\\Default\\Login Data'\n            - '\\Google\\Chrome\\User Data\\Default\\Cookies'\n    selection_firefox:\n        TargetFilename|contains: '\\Mozilla\\Firefox\\Profiles\\'\n        TargetFilename|endswith:\n            - '\\logins.json'\n            - '\\cookies.sqlite'\n    filter_legitimate:\n        Image|endswith:\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n            - '\\msedge.exe'\n    condition: (selection_chrome or selection_firefox) and not filter_legitimate\nfalsepositives:\n    - Password managers (1Password, Bitwarden, LastPass) importing saved browser credentials\n    - Backup software performing full user-profile backups\nlevel: medium",
        "to_ids": false,
        "comment": "Non-Browser Process Accessing Chrome or Firefox Credential Store Files | TIER: Hunting | robustness 3 | confidence MODERATE | ATT&CK T1555.003, T1539 | rule hash cc916051 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ac437791-deb4-560b-95be-f21dcd8f55dc",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Remcos RAT Execution from Default AppData Install Path\nid: 412f0f16-665a-4623-9e3c-92d98012f77b\nstatus: experimental\ndescription: >-\n  Detects process execution from the default Remcos RAT install folder\n  (AppData\\Roaming\\remcos\\). This is a path-based indicator, not a\n  mutex check - the malware's mutex Remcos_Mutex_Inj cannot be detected\n  via standard Sysmon/EDR process telemetry, only via YARA memory\n  scanning or EDR-native mutex enumeration. The install folder name is\n  configurable in the Remcos builder, so this indicator is brittle\n  against operator customization.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.stealth\n    - attack.t1036\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|contains: '\\AppData\\Roaming\\remcos\\'\n    condition: selection\nfalsepositives:\n    - >-\n      Any software that happens to install into a folder literally\n      named \"remcos\" (coincidental collision)\n    - >-\n      Brittle by design - operators can trivially rename this folder\n      via the Remcos builder, evading this indicator entirely on the\n      next build\nlevel: medium",
        "to_ids": false,
        "comment": "Remcos RAT Execution from Default AppData Install Path | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1036 | rule hash eddc1b24 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "df3d36ec-17eb-5c9f-a0ac-4b5bce1f3d23",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Remcos RAT Inline Self-Deletion cmd.exe Command Line (PING, DEL, Start and Remcos Folder)\nid: 62f7d36c-2d5d-4f21-a6c9-71589b95ddb0\nstatus: experimental\ndescription: >-\n  Detects a cmd.exe command line that itself contains a PING 127.0.0.1\n  delay, a DEL, a start and the AppData\\Roaming\\remcos folder, the form of\n  the Remcos RAT self-deletion (\"file melting\") sequence in which the\n  commands are passed on the command line. The report records the sequence\n  as the content of the %TEMP%\\install.bat staging script and does not say how\n  cmd.exe was started, so a run that executes install.bat from a file shows\n  only the script path on the command line and does not match. The rule does\n  not test install.bat.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.stealth\n    - attack.t1070.004\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith: '\\cmd.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'PING 127.0.0.1'\n            - 'DEL'\n            - 'start'\n            - 'AppData\\Roaming\\remcos'\n    condition: all of selection_*\nfalsepositives:\n    - Custom administrative scripts referencing the same folder name (very rare pattern)\nlevel: high",
        "to_ids": true,
        "comment": "Remcos RAT Inline Self-Deletion cmd.exe Command Line (PING, DEL, Start and Remcos Folder) | TIER: Detection | robustness 2 | confidence MODERATE | ATT&CK T1070.004 | rule hash 19c99239 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ed5bf9fc-7304-5bd7-b9c0-448abb9d3208",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Suspicious Process Access from AppData to Browser or Explorer Process\nid: 320eaf61-97be-4fc8-bee0-cab1d45aba05\nstatus: experimental\ndescription: >-\n  Detects a process running from a user-writable %AppData% location\n  opening a handle with broad or write-capable access rights to\n  explorer.exe or a major browser process - a generic\n  process-injection telemetry pattern observed in the Remcos RAT\n  process-injection module used against this campaign, but not\n  anchored to any Remcos-specific string. The %AppData% source\n  location is common to a large amount of legitimate consumer\n  software.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.stealth\n    - attack.privilege-escalation\n    - attack.t1055\n    - detection.emerging-threats\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection_source:\n        SourceImage|contains: '\\AppData\\'\n    selection_target:\n        TargetImage|endswith:\n            - '\\explorer.exe'\n            - '\\msedge.exe'\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n    selection_access:\n        GrantedAccess:\n            - '0x1F0FFF'\n            - '0x1FFFFF'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate software updates from AppData\n    - Development/debugging tools\nlevel: medium",
        "to_ids": false,
        "comment": "Suspicious Process Access from AppData to Browser or Explorer Process | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1055 | rule hash 3cea196a | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "81ef2800-63dd-5d36-b398-63fe10348d03",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: UAC Disabling Attempt by reg.exe Setting EnableLUA to 0 From cmd.exe\nid: 482a813a-346e-450c-8ff7-4b449a26ad7d\nstatus: experimental\ndescription: >-\n  Detects reg.exe, launched by cmd.exe, adding the HKLM Policies\\System\n  EnableLUA value as REG_DWORD with data 0 (the value written as /d 0 followed\n  by a space or ending the line), an attempt to disable User Account Control (the event is the command line, not the resulting registry state; see the companion registry-state rule). The\n  report records Remcos doing this ahead of persistence installation. The\n  rule has no Remcos-specific test: any cmd.exe-launched reg.exe that turns\n  UAC off matches, and so does the same change made by an administrator or a\n  management tool.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.privilege-escalation\n    - attack.t1548.002\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'ADD'\n            - 'HKLM'\n            - 'REG_DWORD'\n    selection_key:\n        CommandLine|contains:\n            - '\\Policies\\System /v EnableLUA '\n            - '\\Policies\\System\" /v EnableLUA '\n    selection_value_mid:\n        CommandLine|contains: '/d 0 '\n    selection_value_end:\n        CommandLine|endswith: '/d 0'\n    selection_parent:\n        ParentImage|endswith: '\\cmd.exe'\n    condition: selection_img and selection_cli and selection_key and (selection_value_mid or selection_value_end) and selection_parent\nfalsepositives:\n    - Legitimate system administration (rare)\n    - Enterprise management tools (SCCM, Intune) - verify digital signature\nlevel: high",
        "to_ids": true,
        "comment": "UAC Disabling Attempt by reg.exe Setting EnableLUA to 0 From cmd.exe | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1548.002 | rule hash 3e055762 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "485cd2c2-7f54-5878-864a-871f582fec40",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Winlogon Userinit Registry Value Changed From the Default\nid: 208b4736-f00a-44bd-b71e-1230ece13876\nstatus: experimental\ndescription: >-\n  Detects a write to the Winlogon Userinit registry value whose data is\n  anything other than the default C:\\WINDOWS\\system32\\userinit.exe, (with\n  the trailing comma). The report records Remcos RAT appending its own\n  executable path after the default, a rare persistence technique that runs\n  the payload at every user logon before the desktop loads. The rule tests\n  only that the value differs from the default, so an appended path, a\n  replaced value and any other change all match.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.004\n    - detection.emerging-threats\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n    filter_legitimate:\n        Details: 'C:\\WINDOWS\\system32\\userinit.exe,'\n    condition: selection and not filter_legitimate\nfalsepositives:\n    - Administrators or management tools that rewrite the Userinit value\n    - A legitimate spelling of the default that differs from the filtered string (case, or a missing trailing comma)\nlevel: high",
        "to_ids": true,
        "comment": "Winlogon Userinit Registry Value Changed From the Default | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1547.004 | rule hash 16647587 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "b8682be1-da09-54ff-9d3e-e1bb46611c4a",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: winlogon.exe Child Process Running From an AppData Path (Userinit Hijack Pattern)\nid: 78fef00f-cd92-4dcd-8413-c3ed49b56aab\nstatus: experimental\ndescription: >-\n  Detects a child process of winlogon.exe whose image path contains \\AppData\\,\n  other than userinit.exe, LogonUI.exe and dwm.exe. The report records Remcos\n  RAT launching its AppData copy through a hijacked Winlogon Userinit value,\n  but the rule has no Remcos-specific test: it matches any AppData-sourced\n  winlogon.exe child that is not on the three-name filter list\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-02-04'\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.004\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\winlogon.exe'\n        Image|contains: '\\AppData\\'\n    filter_legitimate:\n        Image|endswith:\n            - '\\userinit.exe'\n            - '\\LogonUI.exe'\n            - '\\dwm.exe'\n    condition: selection and not filter_legitimate\nfalsepositives:\n    - Unlikely\nlevel: high",
        "to_ids": true,
        "comment": "winlogon.exe Child Process Running From an AppData Path (Userinit Hijack Pattern) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1547.004 | rule hash 6a429b62 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "5b3a3f27-00ef-5914-a150-de9052a18a55",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: Remcos RAT OpenDirectory Campaign (203.159.90.147)\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule RAT_Remcos_Family_Detection {\n   meta:\n      description = \"Detects Remcos RAT via its mutex, C2 protocol banner, and internal log/command strings - a multi-branch fingerprint of the Remcos family's mutex, banner, C2, keylogging, credential and command strings, which matches only while at least one branch's strings survive in the build\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"32642d64-41b4-5b64-801e-c295f9bfe4a9\"\n   strings:\n      $mutex = \"Remcos_Mutex_Inj\" ascii wide\n      $banner = \" * REMCOS v\" ascii\n      $developer = \"Breaking-Security.Net\" ascii\n\n      $c2_1 = \"Connected to C&C!\" ascii\n      $c2_2 = \"[KeepAlive]\" ascii\n      $c2_3 = \"[DataStart]\" ascii\n\n      $keylog_1 = \"onlinelogs\" ascii\n      $keylog_2 = \"offlinelogs\" ascii\n      $keylog_3 = \" [Ctrl + V]\" ascii\n      $keylog_4 = \"[Following text has been copied to clipboard:]\" ascii\n      $keylog_5 = \"[Following text has been pasted from clipboard:]\" ascii\n\n      $cred_1 = \"[Chrome StoredLogins found, cleared!]\" ascii\n      $cred_2 = \"[Firefox StoredLogins cleared!]\" ascii\n      $cred_3 = \"[Chrome Cookies found, cleared!]\" ascii\n\n      $persist_1 = \"Userinit\" ascii\n      $persist_2 = \"install.bat\" ascii\n      $persist_3 = \"EnableLUA\" ascii\n\n      $cmd_1 = \"consolecmd\" ascii\n      $cmd_2 = \"remscriptexecd\" ascii\n      $cmd_3 = \"getproclist\" ascii\n\n      $api_inject_1 = \"VirtualAllocEx\" ascii\n      $api_inject_2 = \"WriteProcessMemory\" ascii\n      $api_screen = \"GdipSaveImageToStream\" ascii\n      $api_audio = \"waveInOpen\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      (\n         $mutex or\n         ($banner and $developer) or\n         (3 of ($c2_*)) or\n         (2 of ($keylog_*) and 2 of ($api_*)) or\n         (2 of ($cred_*)) or\n         (8 of them and 3 of ($mutex, $banner, $developer, $c2_*, $keylog_*, $cred_*, $cmd_*))\n      )\n}",
        "to_ids": true,
        "comment": "Remcos RAT Family Detection | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1219, T1056.001, T1555.003, T1113 | rule hash ecb7984e | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "10817d60-6d5c-5528-9370-0e5ec9cf0d5a",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_OpenDirectory_Mutex_Install {\n   meta:\n      description = \"Detects Remcos RAT samples from the OpenDirectory 203.159.90.147 campaign via the family mutex Remcos_Mutex_Inj combined with one of the campaign's UAC-bypass, browser-credential-path, or install/melt artifact combinations\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"393268d2-7545-5cea-ab00-81267cc5747f\"\n   strings:\n      $mutex = \"Remcos_Mutex_Inj\" ascii wide\n      $uac_cmd = \"EnableLUA /t REG_DWORD /d 0 /f\" ascii wide\n      $chrome_path = \"\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\User Data\\\\Default\\\\Login Data\" ascii wide\n      $firefox_path = \"\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\\" ascii wide\n      $install_path = \"\\\\AppData\\\\Roaming\\\\remcos\\\\remcos.exe\" ascii wide\n      $temp_dll = \"\\\\Temp\\\\0.dll\" ascii wide\n      $install_bat = \"install.bat\" ascii wide\n      $ping_delay = \"PING 127.0.0.1 -n 2\" ascii wide\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 2MB and\n      $mutex and\n      (\n         $uac_cmd or\n         ($chrome_path and $firefox_path) or\n         ($install_path and $temp_dll) or\n         ($install_bat and $ping_delay)\n      )\n}",
        "to_ids": true,
        "comment": "Remcos OpenDirectory Campaign Mutex and Install Artifacts | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1548.002, T1555.003, T1070.004 | rule hash d32137eb | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "21440dfa-921f-5d86-a30a-8fce5a91c2dc",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_Process_Injection_Generic_APIs {\n   meta:\n      description = \"Broad hunting rule for a classic process-injection API cluster (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread/GetThreadContext/SetThreadContext/ResumeThread) combined with references to explorer.exe/msedge.exe or desktop.ini-triggered injection timing; observed in Remcos RAT samples from this campaign but not anchored on a family-specific string, so it will also match unrelated injection-capable software\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"e3bbbd84-7fb8-5d24-bb57-90ba103a749a\"\n   strings:\n      $api_1 = \"VirtualAllocEx\" ascii\n      $api_2 = \"WriteProcessMemory\" ascii\n      $api_3 = \"CreateRemoteThread\" ascii\n      $api_4 = \"GetThreadContext\" ascii\n      $api_5 = \"SetThreadContext\" ascii\n      $api_6 = \"ResumeThread\" ascii\n      $target_1 = \"explorer.exe\" ascii wide\n      $target_2 = \"msedge.exe\" ascii wide\n      $desktop_ini = \"desktop.ini\" ascii wide\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      (\n         (5 of ($api_*) and 2 of ($target_*)) or\n         ($desktop_ini and 4 of ($api_*) and $target_1)\n      )\n}",
        "to_ids": false,
        "comment": "Remcos Process Injection (Generic API Cluster) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1055 | rule hash c5cad351 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "897e4aea-71ab-50e5-93e2-4c3ceb95b860",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_Process_Injection_Mutex_Anchored {\n   meta:\n      description = \"Detects the Remcos RAT process-injection module via the family mutex Remcos_Mutex_Inj combined with 4 or more of its classic injection API imports (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, GetThreadContext, SetThreadContext, ResumeThread)\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"111690c6-c6a5-50fa-8f4b-1ea9c431e4f6\"\n   strings:\n      $api_1 = \"VirtualAllocEx\" ascii\n      $api_2 = \"WriteProcessMemory\" ascii\n      $api_3 = \"CreateRemoteThread\" ascii\n      $api_4 = \"GetThreadContext\" ascii\n      $api_5 = \"SetThreadContext\" ascii\n      $api_6 = \"ResumeThread\" ascii\n      $remcos_mutex = \"Remcos_Mutex_Inj\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      $remcos_mutex and\n      4 of ($api_*)\n}",
        "to_ids": true,
        "comment": "Remcos Process Injection (Mutex-Anchored) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1055 | rule hash 46c4ee81 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "c0e9bac3-c028-5826-8324-50db33cc0347",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_Surveillance_Generic_API_Cluster {\n   meta:\n      description = \"Broad hunting rule for the combined presence of keyboard-hook, screen-capture, and audio-recording APIs (SetWindowsHookExA, GdipSaveImageToStream/BitBlt, waveInOpen/waveInAddBuffer) in one binary; observed in Remcos RAT samples from this campaign but the API combination alone is also used by legitimate remote-support and employee-monitoring software\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"5525c61f-9bf0-55ef-b6d0-0b15660eef3a\"\n   strings:\n      $keylog_api_1 = \"SetWindowsHookExA\" ascii\n      $screen_api_1 = \"GdipSaveImageToStream\" ascii\n      $screen_api_2 = \"BitBlt\" ascii\n      $audio_api_1 = \"waveInOpen\" ascii\n      $audio_api_2 = \"waveInAddBuffer\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      $keylog_api_1 and\n      1 of ($screen_api_*) and\n      1 of ($audio_api_*)\n}",
        "to_ids": false,
        "comment": "Remcos Surveillance Module (Generic API Cluster) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1056.001, T1113, T1123 | rule hash 22ce8b21 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d19c1136-7c55-5a24-ba7e-87a520e28045",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_Surveillance_LogStrings_Anchored {\n   meta:\n      description = \"Detects the Remcos RAT surveillance module via its distinctive internal log-folder naming (onlinelogs/offlinelogs) and clipboard-annotation string combined with keyboard-hook, clipboard, or idle-detection APIs\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"679e4b7b-2853-544e-9fad-c4c867973d02\"\n   strings:\n      $keylog_api_1 = \"SetWindowsHookExA\" ascii\n      $clip_api_1 = \"GetClipboardData\" ascii\n      $activity_1 = \"GetLastInputInfo\" ascii\n      $surv_str_1 = \"onlinelogs\" ascii\n      $surv_str_2 = \"offlinelogs\" ascii\n      $surv_str_3 = \"[Ctrl + V]\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      (\n         ($keylog_api_1 and $clip_api_1 and 2 of ($surv_str_*)) or\n         (3 of ($surv_str_*) and $activity_1)\n      )\n}",
        "to_ids": true,
        "comment": "Remcos Surveillance Module (Log-String Anchored) | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1056.001, T1115 | rule hash 1d808fc6 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ae674770-12a3-5ca0-93c2-7498af8540d5",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_Remcos_UAC_Bypass_Persistence {\n   meta:\n      description = \"Detects Remcos RAT UAC-bypass and persistence mechanisms via reg.exe EnableLUA modification, Winlogon/Run-key persistence paths, and the mutex Remcos_Mutex_Inj, each branch anchored on the campaign's default install path or the family mutex\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/\"\n      date = \"2026-02-04\"\n      hash1 = \"ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82\"\n      hash2 = \"45aa592f3b30ef526e380978338718f540cff5d2\"\n      hash3 = \"04693af3b0a7c9788daba8e35f429ba6\"\n      family = \"Remcos\"\n      malware_type = \"RAT\"\n      campaign = \"OpenDirectory-203.159.90.147-Remcos\"\n      id = \"e53a05eb-deea-575f-bb7d-2a97e8d63bf0\"\n   strings:\n      $uac_cmd_1 = \"reg.exe ADD HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System /v EnableLUA\" ascii wide\n      $uac_cmd_2 = \"EnableLUA /t REG_DWORD /d 0 /f\" ascii wide\n      $persist_1 = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" ascii wide\n      $persist_2 = \"Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit\" ascii wide\n      $persist_3 = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\" ascii wide\n      $install_path = \"AppData\\\\Roaming\\\\remcos\\\\remcos.exe\" ascii wide\n      $melt_1 = \"PING 127.0.0.1 -n 2\" ascii wide\n      $melt_3 = \"install.bat\" ascii wide\n      $remcos_mutex = \"Remcos_Mutex_Inj\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      (\n         (any of ($uac_cmd_*) and $install_path) or\n         (3 of ($persist_*) and $install_path) or\n         ($persist_2 and $install_path and $remcos_mutex) or\n         ($remcos_mutex and 2 of ($persist_*) and any of ($uac_cmd_*)) or\n         ($melt_1 and $melt_3 and $install_path)\n      )\n}",
        "to_ids": true,
        "comment": "Remcos UAC Bypass and Persistence | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1548.002, T1547.001, T1547.004 | rule hash e801af75 | https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/",
        "timestamp": 1791706631,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}