Remcos RAT Keylogger File Written to AppData Remcos Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.