Remcos RAT - Distribution Methods
File types, delivery vectors, and hosting infrastructure used to distribute Remcos RAT.
Last updated: 2026-10-11
Understanding how Remcos RAT reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.
What Distribution Data Tells You
Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.
Hosting Infrastructure
The hosting data below shows which domains and servers are actively distributing Remcos RAT payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Remcos RAT samples.
Malicious Distribution URLs (131)
https://raw.githubusercontent.com/Karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_053520.png https://raw.githubusercontent.com/Karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_065109.png https://raw.githubusercontent.com/Karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_015611.png https://rough-truth-e072.publicftpresend.workers.dev/dxnobk https://mbcasesores.com/tap/BBVA_pdf.zip https://linktrap.co/ZAHEQN-h http://216.225.206.31/55/wegivingbestthignswiththemforme.hta http://216.225.206.31/44/createdbestnaturealsystemforbestentieryformebest.vbe http://216.225.206.31/55/Notepad___files__document__004949596060.txt http://216.225.206.31/44/dc_00940404094404004_file.pdf http://57.129.23.24/sike/crypted.ps1 http://57.129.23.24/29039/crypted.ps1 http://57.129.23.24/63748/crypted.ps1 http://107.172.235.200/ww.adyen.comknowledge-hubpayment-gatewaymsclkid=0dcc9c9da58815369da2f6a715a7654d&utm_source=bing&utm_medium=cpc&utm_camiii.php http://213.165.78.201/1092093/crypted.ps1 http://217.154.188.255/60/document_picture_0994950005995.jpg/verygoodthingsarecomingentiretimeforbest.hta http://217.154.188.255/60/goodthingsarebestformehappeninggood.vbe http://66.63.170.33/81/img_085818.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/WUswB https://lemon-kutt.lemon.cchan.tv/VXteWP https://cuth.me/YEqaFn https://masuk.to/EUGfh3 http://66.63.170.33/301/img_044239.png http://66.63.170.33/301/weneedbetterplacewithbestfeature.hta http://66.63.170.33/81/kingsibacktoruletheworld.hta http://66.63.170.33/httpswww.digitaltrends.comcomputingai-browsers-are-here-and-you-need-to-learn-how-to-use-the-web-properly.php http://66.63.170.33/httpsexpertinsights.comdata-security-and-privacytop-secure-file-sharing-storage-services-need.php https://dawn-bush-ddd1.yasminanthonyy.workers.dev/yHcDA https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/ULUcj https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/KugEf https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/NkgAa https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/etiVI https://dawn-bush-ddd1.yasminanthonyy.workers.dev/EapFp https://dawn-bush-ddd1.yasminanthonyy.workers.dev/gglDg https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/pijol https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/DoPkb https://pub-ce54f1982e42425c94a1dd345decfbb9.r2.dev/slive.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/wIXPl https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/BVXMa https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/ekKrr https://pub-14b7818eeed2473fb453a2385620ceb9.r2.dev/vplaqn.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/vzjBJ https://dawn-bush-ddd1.yasminanthonyy.workers.dev/jXILw https://acmgrupo.com/new/optimized_MSI.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/VyVZu https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/NcaeY https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/vemRp https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/yxgQj https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/yxybF https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/aNWAd https://small-morning-8be0.fsocietyandtools.workers.dev/QQIB-J3OB-PICL-3175/img_x231jh.png https://small-morning-8be0.fsocietyandtools.workers.dev/6NS9-9ZTY-N247-UX3J/img_wp6sn7.png https://as.al/file/UGJG0S https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/egYcW https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/nYeQl https://raw.githubusercontent.com/bhh545578-lab/asasasas/refs/heads/main/kalel123.png http://small-morning-8be0.fsocietyandtools.workers.dev/QQIB-J3OB-PICL-3175/img_id20y0.png https://filesco.lovestoblog.com/jungle.png https://as.al/file/AzKztT https://d7.tfdl.net/public/2026-06-03/f2760afb-0bc2-4ad4-9a54-c3a9079de4ff/7896789678JKLJMNIJNM.png http://kpmmg.org/common/caches/optimized.png http://d7.tfdl.net/public/2026-06-03/f2760afb-0bc2-4ad4-9a54-c3a9079de4ff/7896789678JKLJMNIJNM.png http://66.63.170.33/90/img_045800.png http://66.63.170.33/90/givenrestthignsaregoodformebest.hta http://66.63.170.33/httpswww.gartner.comennewsroompress-releases2025-05-13-gartner-identifies-top-trends-shaping-the-future-of-cloud.php https://raw.githubusercontent.com/solid-23/ghy/refs/heads/main/kkArdSd.txt https://raw.githubusercontent.com/slaytonms/ab/refs/heads/main/AdkkSfA.txt https://raw.githubusercontent.com/solid-23/kl/refs/heads/main/mkFpIik.txt https://raw.githubusercontent.com/solid-23/job/refs/heads/main/fhhkmoo.txt https://raw.githubusercontent.com/slaytonms/gt/refs/heads/main/djkpodd.txt https://raw.githubusercontent.com/slaytonms/nb/refs/heads/main/SrdmaIk.txt https://raw.githubusercontent.com/slaytonms/df/refs/heads/main/oicAjon.txt https://raw.githubusercontent.com/slaytonms/hy/refs/heads/main/cAbdcfo.txt https://raw.githubusercontent.com/slaytonms/hi/refs/heads/main/peokjfS.txt https://bitbucket.org/ghkjkghlkgl/ghf/downloads/2.jpg https://raw.githubusercontent.com/solid-23/bv/refs/heads/main/SijgpcA.txt https://toptionlab.co.za/tr.vbs https://paste.sensio.no/BirdsKnocked https://raw.githubusercontent.com/solid-23/ki/refs/heads/main/boagniF.txt http://mivventi.com/adminreport/service.txt https://yaso.su/raw/uy3rCXFK http://80.253.251.8:5225/REFORESTGAL.VILAR-SL_NIEcopiaAusweis.pdf.lnk http://80.253.251.8:5225/Ausweis.js http://192.3.176.237/100/img_043611.png https://lpi0ngge6c.ufs.sh/f/6iUgXKGAnNfhv6ErsuPf2QHpJ59uZgXt1RD0dnyqcMGKeYi4 https://lpi0ngge6c.ufs.sh/f/6iUgXKGAnNfhfkzVpT8zhFpeCvZscS8IaxlWKQyYEH0qrJ7G https://epaste.app/p/MYgb7ihl/raw https://raw.githubusercontent.com/respalditorespaldito/repalditopro/refs/heads/main/CRYP.txt https://yaso.su/raw/utlwCJNi https://pastefy.app/WSBxlMpn/raw https://186.169.75.221/a.exe https://bashupload.com/Daerjg.exe https://dn721508.ca.archive.org/0/items/optimized_msi_20251017_0233/optimized_MSI.png http://186.169.76.187/31agosto.vbs http://186.169.76.187/sostener.vbs http://186.169.76.187/andre.vbs http://186.169.76.187/dllchichi.txt http://186.169.76.187/pchichi.txt http://respaldo2.duckdns.org/scvhost.vbs http://runds.duckdns.org/proceso.vbs
Source: URLhaus (abuse.ch). Updated: 2026-10-11
Hosting Infrastructure
| Host | URLs |
|---|---|
| icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev | 19 |
| raw.githubusercontent.com | 16 |
| 66.63.170.33 | 9 |
| 186.169.76.187 | 5 |
| 216.225.206.31 | 4 |
| dawn-bush-ddd1.yasminanthonyy.workers.dev | 4 |
| exclusionremcoss.duckdns.org | 4 |
| 57.129.23.24 | 3 |
| small-morning-8be0.fsocietyandtools.workers.dev | 3 |
| arcangelgabriel2828.duckdns.org | 3 |
| remcolinomayo24.duckdns.org | 3 |
| remcolino.duckdns.org | 3 |
| rc2404.duckdns.org | 3 |
| remcos7770.duckdns.org | 3 |
| cookies32560.duckdns.org | 3 |
| 217.154.188.255 | 2 |
| as.al | 2 |
| d7.tfdl.net | 2 |
| yaso.su | 2 |
| 80.253.251.8 | 2 |