Remcos RAT Keylogger logs.dat Creation in AppData\Roaming\DT

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.