S0332 - Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.

Author
agomez
Created
2023-03-27 16:16:01
Last updated
2026-02-07 18:55:46
Downloads
441484
IPv4 indicators
434
Hostname indicators
3132
URL indicators
201
Sample indicators
12293

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

ascoitaliasa.duckdns.org Hostname

modified 2026-10-18 07:26:20
Remcos (ThreatFox Abuse.ch)

safer.ddns.net Hostname

modified 2026-10-18 07:21:24
Remcos (ThreatFox Abuse.ch) · AIT:Trojan.GenericTKA (Hybrid-Analysis) · Gen:Variant.Razy (Hybrid-Analysis)

harveyautos112.ddns.net Hostname

modified 2026-10-18 06:57:47
Remcos (ThreatFox Abuse.ch)

iniiivan.ydns.eu Hostname

modified 2026-10-18 06:43:30
Remcos (ThreatFox Abuse.ch)

agronewbk.duckdns.org Hostname

modified 2026-10-18 06:32:53
Remcos (ThreatFox Abuse.ch)

brucebaner2031.duckdns.org Hostname

modified 2026-10-18 06:31:18
Remcos (ThreatFox Abuse.ch) · Remcos (Maltiverse Threat Observatory)

185.140.53.9 IPv4

modified 2026-10-18 06:27:47
Remcos (ThreatFox Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · AGEN.1131750 (Hybrid-Analysis) · MSIL_Kryptik.AWS.gen (Hybrid-Analysis) · GenKryptik.EMOR (Hybrid-Analysis)

304fcfbf513be129159e9dee829aa8c1e92c3bbae2584c082fa0a3502763b674 Sample

modified 2026-10-18 06:05:55
Remcos (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

HEHE.exe Sample

modified 2026-10-18 05:45:04
Remcos (Triage) · Generic Malware (Hybrid-Analysis)

nhin cai lon ma may 9999.exe Sample

modified 2026-10-18 05:42:14
Remcos (Triage)

nhin cai lon ma may 999.exe Sample

modified 2026-10-18 05:40:57
Remcos (Triage)

986cf1b80dfcaa2813043a6d627ccd558250037d98418d28e75fd91832f55026.bin Sample

modified 2026-10-18 04:53:06
Remcos (Triage) · Generic Malware (Hybrid-Analysis)

eddy2025.ddns.net Hostname

modified 2026-10-18 04:40:35
Remcos (ThreatFox Abuse.ch)

rasuljon.ydns.eu Hostname

modified 2026-10-18 04:40:30
Remcos (ThreatFox Abuse.ch)

disnotavalidmeantocommunicatemkidlydothe.duckdns.org Hostname

modified 2026-10-18 04:40:21
Remcos (ThreatFox Abuse.ch)

favournwa.ddns.net Hostname

modified 2026-10-18 04:40:10
Remcos (ThreatFox Abuse.ch) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

ms60tzel1.hopto.org Hostname

modified 2026-10-18 04:40:09
Remcos (ThreatFox Abuse.ch)

5932ec3f-83d8-43b6.duckdns.org Hostname

modified 2026-10-18 04:40:05
Remcos (ThreatFox Abuse.ch)

blackwealth001.duckdns.org Hostname

modified 2026-10-18 04:40:05
Remcos (ThreatFox Abuse.ch)

know-damages.gl.at.ply.gg Hostname

modified 2026-10-18 04:40:05
Remcos (ThreatFox Abuse.ch)

pavementmg.duckdns.org Hostname

modified 2026-10-18 04:40:05
Remcos (ThreatFox Abuse.ch)

blessed.mypsx.net Hostname

modified 2026-10-18 04:40:05
Remcos (ThreatFox Abuse.ch)

fmanslaq9t1.duckdns.org Hostname

modified 2026-10-18 04:40:03
Remcos (ThreatFox Abuse.ch)

19slotwallet.co Hostname

modified 2026-10-18 04:39:58
Remcos (ThreatFox Abuse.ch)

123but.com Hostname

modified 2026-10-18 04:39:56
Remcos (ThreatFox Abuse.ch)

chengzhi888.co Hostname

modified 2026-10-18 04:39:56
Remcos (ThreatFox Abuse.ch)

rem.aaahorneswll.com Hostname

modified 2026-10-18 04:39:55
Remcos (ThreatFox Abuse.ch)

osiris8612.duckdns.org Hostname

modified 2026-10-18 04:39:55
VHO:Backdoor.MSIL.Remcos (Hybrid-Analysis) · Remcos (ThreatFox Abuse.ch)

dominoduck2098.duckdns.org Hostname

modified 2026-10-18 04:39:55
Malware site (Hybrid-Analysis) · Remcos (ThreatFox Abuse.ch)

fifa55poipet.pro Hostname

modified 2026-10-18 04:39:55
Remcos (ThreatFox Abuse.ch)

casino-igrice.me Hostname

modified 2026-10-18 04:39:55
Remcos (ThreatFox Abuse.ch)

honeyportsecurityresearchteam.duckdns.org Hostname

modified 2026-10-18 04:39:53
Remcos (ThreatFox Abuse.ch)

www.ekramsales.org Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

nomass2024.duckdns.org Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

avira-antivirus.duckdns.org Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

brasilselectbackup.ddns.net Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

almacenoporto.com.co Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

popbaggy.ignorelist.com Hostname

modified 2026-10-18 04:39:49
Remcos (ThreatFox Abuse.ch)

janbours92harbu03.duckdns.org Hostname

modified 2026-10-18 04:39:44
Remcos (ThreatFox Abuse.ch)

api.qh88eu.com Hostname

modified 2026-10-18 04:39:33
Remcos (ThreatFox Abuse.ch)

robertmoore.hopto.org Hostname

modified 2026-10-18 04:39:31
Remcos (ThreatFox Abuse.ch)

sweet1617181920.duckdns.org Hostname

modified 2026-10-18 04:39:31
Remcos (ThreatFox Abuse.ch)

serverupdatemarch353.duckdns.org Hostname

modified 2026-10-18 04:39:30
Remcos (ThreatFox Abuse.ch)

acttwindows.duckdns.org Hostname

modified 2026-10-18 04:39:30
Remcos (ThreatFox Abuse.ch) · Remcos (Maltiverse Threat Observatory)

gros59kalmso1.duckdns.org Hostname

modified 2026-10-18 04:39:30
Remcos (ThreatFox Abuse.ch)

2025keeptring.gotdns.ch Hostname

modified 2026-10-18 04:39:28
Remcos (ThreatFox Abuse.ch)

boss.noip.at Hostname

modified 2026-10-18 04:39:26
Remcos (ThreatFox Abuse.ch)

youngboss1994.ddns.net Hostname

modified 2026-10-18 04:39:19
Remcos (ThreatFox Abuse.ch)

sls.in.net Hostname

modified 2026-10-18 04:39:17
ClearFake (ThreatFox Abuse.ch) · Remcos (ThreatFox Abuse.ch)

mpannukwummadunawaoo.duckdns.org Hostname

modified 2026-10-18 04:39:14
Remcos (ThreatFox Abuse.ch)

fb88.style Hostname

modified 2026-10-18 04:39:11
Remcos (ThreatFox Abuse.ch)

22wizz.duckdns.org Hostname

modified 2026-10-18 04:39:11
Remcos (ThreatFox Abuse.ch)

pruebatreinai1087182364.duckdns.org Hostname

modified 2026-10-18 04:39:09
Remcos (ThreatFox Abuse.ch)

relentlesswicked.myvnc.com Hostname

modified 2026-10-18 04:39:04
Remcos (ThreatFox Abuse.ch)

jamourtg6hansit1.duckdns.org Hostname

modified 2026-10-18 04:38:57
Remcos (ThreatFox Abuse.ch)

cannonistanbulsskys.duckdns.org Hostname

modified 2026-10-18 04:38:50
Remcos (ThreatFox Abuse.ch)

rambolastblood.ddns.net Hostname

modified 2026-10-18 04:38:49
Remcos (ThreatFox Abuse.ch)

red64.duckdns.org Hostname

modified 2026-10-18 04:38:45
Remcos (ThreatFox Abuse.ch)

johnhoff.hopto.org Hostname

modified 2026-10-18 04:38:40
Remcos (ThreatFox Abuse.ch)

api.go8.plus Hostname

modified 2026-10-18 04:38:38
Remcos (ThreatFox Abuse.ch)

wassimaldo.hopto.org Hostname

modified 2026-10-18 04:38:10
Remcos (ThreatFox Abuse.ch)

bio4kobs.geekgalaxy.com Hostname

modified 2026-10-18 04:38:09
Remcos (ThreatFox Abuse.ch) · nanocore,rat (Maltiverse) · AutoIt.Gen (Hybrid-Analysis) · HEUR:Backdoor.Androm (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis)

baddieszn.duckdns.org Hostname

modified 2026-10-18 04:37:59
Remcos (ThreatFox Abuse.ch)

tamar.ydns.eu Hostname

modified 2026-10-18 04:37:59
Remcos (ThreatFox Abuse.ch)

buildagent.duckdns.org Hostname

modified 2026-10-18 04:37:53
Remcos (ThreatFox Abuse.ch)

bxtg888.com Hostname

modified 2026-10-18 04:37:53
Remcos (ThreatFox Abuse.ch)

remoo7.theworkpc.com Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

ngo999.com Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

www.albader-group.cam Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

kristal777.com.co Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

wowslot567.bet Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

kuwin686.com Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

ptzhc3.pw Hostname

modified 2026-10-18 04:37:52
Remcos (ThreatFox Abuse.ch)

houmakoskg.com Hostname

modified 2026-10-18 04:37:50
Remcos (ThreatFox Abuse.ch)

nzobaku.ddns.net Hostname

modified 2026-10-18 04:37:49
Remcos (ThreatFox Abuse.ch)

gugrant11.duckdns.org Hostname

modified 2026-10-18 04:37:49
Remcos (ThreatFox Abuse.ch)

www.remoteiconnect.com Hostname

modified 2026-10-18 04:37:49
Remcos (ThreatFox Abuse.ch)

subwaymoney.flashhub.net Hostname

modified 2026-10-18 04:37:41
Remcos (ThreatFox Abuse.ch)

newpat4.duckdns.org Hostname

modified 2026-10-18 04:37:38
Remcos (ThreatFox Abuse.ch)

isp.remcosagent.dns-cloud.net Hostname

modified 2026-10-18 04:37:38
Remcos (ThreatFox Abuse.ch)

echox12.ddns.net Hostname

modified 2026-10-18 04:37:32
Remcos (ThreatFox Abuse.ch)

icingwater.duckdns.org Hostname

modified 2026-10-18 04:37:30
Remcos (ThreatFox Abuse.ch)

moremoney.myftp.org Hostname

modified 2026-10-18 04:37:28
Remcos (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

graceland777.ddns.net Hostname

modified 2026-10-18 04:37:24
Gen:Variant.Bulz (Hybrid-Analysis) · Remcos (ThreatFox Abuse.ch)

unforseen.duckdns.org Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

eventras.duckdns.org Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

daroughgan8hajous2.duckdns.org Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

everestenterprses21.sytes.net Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

nextnewupdationsforu.duckdns.org Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

mixkitchenamsterdam.nl Hostname

modified 2026-10-18 04:37:24
Remcos (ThreatFox Abuse.ch)

god.hopto.org Hostname

modified 2026-10-18 04:37:12
Remcos (ThreatFox Abuse.ch)

hazelglory1.hopto.org Hostname

modified 2026-10-18 04:37:11
Remcos (ThreatFox Abuse.ch)

ga888vn.ru.com Hostname

modified 2026-10-18 04:37:11
Remcos (ThreatFox Abuse.ch)

ssshost.viewdns.net Hostname

modified 2026-10-18 04:37:10
Remcos (ThreatFox Abuse.ch) · Malicious Hostname (Cyber Threat Coalition) · Covid19 scam (Cyber Threat Coalition)

dadc.noip.at Hostname

modified 2026-10-18 04:37:07
Remcos (ThreatFox Abuse.ch)

benhenry2234.zapto.org Hostname

modified 2026-10-18 04:36:58
Remcos (ThreatFox Abuse.ch)

go8go.net Hostname

modified 2026-10-18 04:36:55
Remcos (ThreatFox Abuse.ch)

pcnewsesperanza.duckdns.org Hostname

modified 2026-10-18 04:36:54
Remcos (ThreatFox Abuse.ch)

bj88.li Hostname

modified 2026-10-18 04:36:54
Remcos (ThreatFox Abuse.ch)

8kbeta5.com Hostname

modified 2026-10-18 04:36:54
Remcos (ThreatFox Abuse.ch)