Backdoor.Remcos

Short bio

Backdoor.Remcos is Malwarebytes’ detection name for a family of Backdoor Trojans that allow remote access and control over the affected system.

Type and source of the infection

Backdoor.Remcos is a Remote Administration Tool (RAT).
Backdoor.Remcos can arrive as a malicious email attachment or be downloaded by other malware.

Aftermath

Backdoor.Remcos gives the threat actor full control over the infected system and allows them to run keyloggers and surveillance (audio + screenshots) mode. This means:

• Data/information about the system may have been stolen
• User credentials may have been stolen
• Digital coins may have been stolen
• Affected system may be susceptible to further attacks and/or infection due to a backdoor that was opened

Protection

Malwarebytes protects users from Backdoor.Remcos by using real-time protection.

Malwarebytes blocks Backdoor.Remcos

Home remediation

Malwarebytes can detect and remove Backdoor.Remcos without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
3. Then click Finish.
4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
7. Restart your computer when prompted to do so.

Business remediation

To remove Backdoor.Remcos using Malwarebytes business products, follow the instructions below.

How to remove Backdoor.Remcos with Malwarebytes Endpoint Protection

1. Go to the Malwarebytes Cloud console.
2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
3. Under Endpoint Interface Options, turn ON:
   1. Show Malwarebytes icon in notification area
   2. Allow users to run a Threat Scan (all threats will be quarantined automatically)

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Backdoor.Remcos with our Breach Remediation tool (MBBR).

1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
2. Open your Cloud console.
3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
4. Unzip the package.
5. Access a Windows command line prompt and issue the following commands:
   mbbr register –key:<prodkey>
   mbbr update
   Note: You must substitute your license key for <prodkey>.
6. Copy the MBBR folder to a flash drive.
7. From an infected, offline machine, copy the MBBR folder from the flash drive.
8. Start a scan using the following command:
   mbbr scan –full –ark –remove –noreboot
9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove Backdoor.Remcos with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Backdoor.Remcos.

Option 1

1. On the infected machine, right click the system tray icon and click on Start Scanner.
   
2. Select Perform full scan.
   
3. Click on Scan button.

Option 2

1. Open CMD
2. CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
3. Run mbamapi /scan –full –remove -reboot

Traces/IOCs

Folder:

%Appdata%\remcos\logs.dat

C&C:

remcos2.legacyrealestateadvisors.net
remcos.legacyrealestateadvisors.net