Remcos RAT Keylogger File Written to %APPDATA%\keylogger.dat

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of a 'keylogger.dat' file within the Windows APPDATA Roaming directory. This specific file path is a known artifact generated by Remcos RAT when utilizing its offline keylogger capability, which relies on the SetWindowsHookExA API with the WH_KEYBOARD_LL hook to intercept keystrokes.