Remcos RAT (Remote Control & Surveillance): Forensic Reverse-Engineering & Architectural Dossier

Constructed entirely in C++ and MASM, linking directly against native Win32/NT subsystem libraries (kernel32.dll, user32.dll, advapi32.dll, ws2_32.dll). Does not depend on the .NET CLR or external runtimes. The binary relies on custom runtime dynamic linking: API function pointers are resolved dynamically via custom DJB2/ROR13 hash comparisons against export directories to suppress Import Address Table (IAT) indicators. The executable embeds a proprietary watchdog architecture and process injection module.

Remcos Professional incorporates a Win32 GUI client builder and real-time remote operations console. Builder configuration tabs include: 1) Connection: Primary/Fallback C2 Hosts, Port numbers, Keep-Alive ping frequency, Dynamic DNS update strings, and Master Password. 2) Installation: File path targets (%AppData%, %Temp%, %ProgramFiles%), randomized payload filename, Hidden and System file attribute switches, and Process Watchdog toggles. 3) Persistence: Registry Run keys (HKCU/HKLM), Winlogon Userinit hooks, and Scheduled Tasks. 4) Stealth: Target injection process list (explorer.exe, svchost.exe), Anti-VM checks (VMware, VirtualBox, QEMU, Sandboxie), and UAC elevation exploits (fodhelper.exe, eventvwr.exe). Config data is stored within the PE resource section (.rsrc) under resource type RT_RCDATA named 'SETTINGS'. The resource blob begins with a 32-byte RC4 initialization key followed by the encrypted configuration string.

struct Remcos_RAT_(Remote_Control_&_Surveillance)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

Execution begins by parsing its own PE resource directory via FindResourceA, LoadResource, and LockResource to retrieve the SETTINGS payload. It extracts the 32-byte key and decrypts the config buffer via standard RC4. If stealth mode is configured, Remcos spawns or targets an existing instance of explorer.exe or svchost.exe: 1) Obtains a process handle using OpenProcess(PROCESS_ALL_ACCESS). 2) Allocates virtual memory in the remote target using VirtualAllocEx(MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE). 3) Writes the decrypted payload and bootstrap shellcode via WriteProcessMemory. 4) Executes the injected code via CreateRemoteThread or NtQueueApcThread. Persistence is reinforced via a separate Watchdog process: both binaries monitor mutually held named Mutexes (e.g., 'Remcos-XXXXXX'); termination of one process causes the other to immediately respawn it.

Concrete technical breakdown of functional modules implemented in the Remcos RAT (Remote Control & Surveillance) binary:

Communication operates over raw TCP sockets. The session is initialized via a symmetric RC4 cipher or optional TLS wrapper. Wire packet structure: [4 Bytes Little-Endian Length Prefix] [1 Byte Packet Type] [Command Delimiter '|remcos|'] [Variable Length Command & Arguments]. Handshake sequence: 1) Client initiates socket connection to configured C2:Port. 2) Client transmits encrypted Identification Beacon: 'remcos|version|OS|ComputerName|UserName|RAM|PrivilegeLevel(Admin/User)|CamAvailable|MicAvailable'. 3) C2 server returns tasking command strings (e.g., 'start_hvnc', 'get_passwords', 'start_socks:1080'). 4) Heartbeat packets: Client sends periodic 4-byte ping headers at operator-configured intervals to keep socket state alive through NAT firewalls.

Indicators of compromise and forensic patterns recorded across laboratory triage: