Rescoms

Overview

Backdoor:Win32/Rescoms (also commonly known as Remcos RAT) is a highly capable, commercially available Remote Access Trojan marketed as legitimate remote administration software, but heavily utilized by cybercriminal syndicates and APT groups for espionage, data theft, and lateral movement.

Understanding Rescoms (Remcos RAT)
To the victim, Rescoms operates completely invisibly. For threat intelligence analysts, Rescoms is a formidable Initial Access Broker (IAB) and espionage tool. Because the core software is commercially developed and regularly updated by its creators (BreakingSecurity), it boasts a highly stable, feature-rich C++ codebase that easily bypasses many legacy AV solutions. Attackers simply purchase a license, pack the binary in a crypter, and deploy it maliciously.

Execution and Evasion Strategies
Rescoms is typically delivered via spearphishing campaigns containing weaponized Office documents or embedded in malicious ZIP/ISO files. Upon execution, the malware establishes persistence by creating a hidden scheduled task (`T1053.005`) or modifying the Registry Run keys. It is infamous for its aggressive process injection (`T1055`), often hollowing out legitimate processes like `vbc.exe` (Visual Basic Compiler) or `RegAsm.exe` to execute its core payload in memory. It provides the attacker with full C2 capabilities: live remote desktop (VNC), a hidden command shell, a highly effective keylogger (`T1056.001`), and microphone/webcam recording (`T1123`).

Indicators of Compromise & Impact
The impact is total endpoint compromise and severe data exfiltration. EDR platforms must alert on the process hollowing of native Windows utilities. Network logs will reveal encrypted TCP traffic communicating with a remote C2 server, often masked behind dynamic DNS providers. The presence of hidden keylog files (often saved as `.dat` files in `%AppData%`) is a strong IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_RESCOMS {
    meta:
        description = "Detects Rescoms (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "rescoms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Rescoms Activity
id: 9f2b05c21955121594212ce25471426e
status: experimental
description: Detects generic indicators of the rescoms malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*rescoms*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session (VNC/Shell).
2. Capture a full forensic memory image of the machine to extract the decrypted Remcos payload and its C2 configuration (often stored in the resource section).
3. Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Rescoms persistence mechanisms.
4. Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.
2. Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries.

References & External Analysis

• Search "rescoms" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Smshoax
• Emgfamt7Gjgi
• Rasoon
• Deceptpcclean
• Wswhacker

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/rescoms.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.