As described in other blog posts, Remcos appears to be developed in C++. As the release notes show, it is actively maintained. 17, 2017 Remcos has the functionalities that are typical of a RAT. It is capable of hiding in the system and using malware techniques that make it difficult for the typical user to detect the existence of Remcos. A good example is the anti-analysis section: It is checking for an outdated artifact, the 'SbieDll.dll'. In our opinion, there are not many analysts using Sandboxie these days anymore. Below you can see the Remcos VMware detection code: The following is a code sample from aldeid.com: The blog referenced above has already described several functions of Remcos features in detail. We would like to focus on Remcos' cryptographic implementation. It uses RC4 pretty much everywhere when there is a need to decode or encode any data. Examples are registry entries, C2 server network communication or file paths shown below: The exepath registry data is base64-encoded, RC4-encrypted data. This can be converted into the typical RC4 pseudo code