Remcos RAT Written to ProgramData\Remcos with Hidden/System Attributes Set

Ethan Andrews@eandrews

•updated Jun 30, 2026•3•0•5

Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.