Remcos RAT - Distribution Methods

File types, delivery vectors, and hosting infrastructure used to distribute Remcos RAT.

Last updated: 2026-07-12

Understanding how Remcos RAT reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.

What Distribution Data Tells You

Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.

Hosting Infrastructure

The hosting data below shows which domains and servers are actively distributing Remcos RAT payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Remcos RAT samples.

Malicious Distribution URLs (114)

http://66.63.170.33/81/img_085818.png
https://lemon-kutt.lemon.cchan.tv/VXteWP
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/WUswB
https://cuth.me/YEqaFn
http://66.63.170.33/httpswww.digitaltrends.comcomputingai-browsers-are-here-and-you-need-to-learn-how-to-use-the-web-properly.php
http://66.63.170.33/httpsexpertinsights.comdata-security-and-privacytop-secure-file-sharing-storage-services-need.php
http://66.63.170.33/81/kingsibacktoruletheworld.hta
http://66.63.170.33/301/img_044239.png
http://66.63.170.33/301/weneedbetterplacewithbestfeature.hta
https://masuk.to/EUGfh3
https://dawn-bush-ddd1.yasminanthonyy.workers.dev/yHcDA
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/DoPkb
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/pijol
https://dawn-bush-ddd1.yasminanthonyy.workers.dev/EapFp
https://dawn-bush-ddd1.yasminanthonyy.workers.dev/gglDg
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/etiVI
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/NkgAa
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/KugEf
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/ULUcj
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/ekKrr
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/BVXMa
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/wIXPl
https://pub-ce54f1982e42425c94a1dd345decfbb9.r2.dev/slive.png
https://pub-14b7818eeed2473fb453a2385620ceb9.r2.dev/vplaqn.png
https://dawn-bush-ddd1.yasminanthonyy.workers.dev/jXILw
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/vzjBJ
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/vemRp
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/NcaeY
https://acmgrupo.com/new/optimized_MSI.png
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/VyVZu
https://small-morning-8be0.fsocietyandtools.workers.dev/QQIB-J3OB-PICL-3175/img_x231jh.png
https://small-morning-8be0.fsocietyandtools.workers.dev/6NS9-9ZTY-N247-UX3J/img_wp6sn7.png
https://as.al/file/UGJG0S
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/egYcW
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/yxybF
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/aNWAd
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/yxgQj
https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/nYeQl
https://raw.githubusercontent.com/bhh545578-lab/asasasas/refs/heads/main/kalel123.png
http://small-morning-8be0.fsocietyandtools.workers.dev/QQIB-J3OB-PICL-3175/img_id20y0.png
https://filesco.lovestoblog.com/jungle.png
https://as.al/file/AzKztT
https://d7.tfdl.net/public/2026-06-03/f2760afb-0bc2-4ad4-9a54-c3a9079de4ff/7896789678JKLJMNIJNM.png
http://kpmmg.org/common/caches/optimized.png
http://d7.tfdl.net/public/2026-06-03/f2760afb-0bc2-4ad4-9a54-c3a9079de4ff/7896789678JKLJMNIJNM.png
http://66.63.170.33/90/img_045800.png
http://66.63.170.33/90/givenrestthignsaregoodformebest.hta
http://66.63.170.33/httpswww.gartner.comennewsroompress-releases2025-05-13-gartner-identifies-top-trends-shaping-the-future-of-cloud.php
https://raw.githubusercontent.com/solid-23/ghy/refs/heads/main/kkArdSd.txt
https://raw.githubusercontent.com/slaytonms/ab/refs/heads/main/AdkkSfA.txt
https://raw.githubusercontent.com/solid-23/kl/refs/heads/main/mkFpIik.txt
https://raw.githubusercontent.com/solid-23/job/refs/heads/main/fhhkmoo.txt
https://raw.githubusercontent.com/slaytonms/gt/refs/heads/main/djkpodd.txt
https://raw.githubusercontent.com/slaytonms/nb/refs/heads/main/SrdmaIk.txt
https://raw.githubusercontent.com/slaytonms/df/refs/heads/main/oicAjon.txt
https://raw.githubusercontent.com/slaytonms/hy/refs/heads/main/cAbdcfo.txt
https://raw.githubusercontent.com/slaytonms/hi/refs/heads/main/peokjfS.txt
https://bitbucket.org/ghkjkghlkgl/ghf/downloads/2.jpg
https://raw.githubusercontent.com/solid-23/bv/refs/heads/main/SijgpcA.txt
https://toptionlab.co.za/tr.vbs
https://paste.sensio.no/BirdsKnocked
https://raw.githubusercontent.com/solid-23/ki/refs/heads/main/boagniF.txt
http://mivventi.com/adminreport/service.txt
https://yaso.su/raw/uy3rCXFK
http://80.253.251.8:5225/REFORESTGAL.VILAR-SL_NIEcopiaAusweis.pdf.lnk
http://80.253.251.8:5225/Ausweis.js
http://192.3.176.237/100/img_043611.png
https://lpi0ngge6c.ufs.sh/f/6iUgXKGAnNfhv6ErsuPf2QHpJ59uZgXt1RD0dnyqcMGKeYi4
https://lpi0ngge6c.ufs.sh/f/6iUgXKGAnNfhfkzVpT8zhFpeCvZscS8IaxlWKQyYEH0qrJ7G
https://epaste.app/p/MYgb7ihl/raw
https://raw.githubusercontent.com/respalditorespaldito/repalditopro/refs/heads/main/CRYP.txt
https://yaso.su/raw/utlwCJNi
https://pastefy.app/WSBxlMpn/raw
https://186.169.75.221/a.exe
https://bashupload.com/Daerjg.exe
https://dn721508.ca.archive.org/0/items/optimized_msi_20251017_0233/optimized_MSI.png
http://186.169.76.187/31agosto.vbs
http://186.169.76.187/sostener.vbs
http://186.169.76.187/andre.vbs
http://186.169.76.187/dllchichi.txt
http://186.169.76.187/pchichi.txt
http://respaldo2.duckdns.org/scvhost.vbs
http://runds.duckdns.org/proceso.vbs
http://respaldo2.duckdns.org/proceso.vbs
http://runds.duckdns.org/scvhost.vbs
http://exclusionremcoss.duckdns.org/sostener.vbs
http://exclusionremcoss.duckdns.org/sostener1.vbs
http://exclusionremcoss.duckdns.org/proceso.vbs
http://exclusionremcoss.duckdns.org/scvhost.vbs
http://arcangelgabriel2828.duckdns.org/sostener.vbs
http://arcangelgabriel2830.duckdns.org/sosten.vbs
http://arcangelgabriel2830.duckdns.org/sostener.vbs
http://remcolinomayo24.duckdns.org/sostener.vbs
http://avefenix21deabril.duckdns.org/proceso.vbs
http://remcolino.duckdns.org/proceso.vbs
http://remcolinomayo24.duckdns.org/sosten.vbs
http://rc2404.duckdns.org/sosten.vbs
http://avefenix21deabril.duckdns.org/sostener.vbs
http://cookies641570.duckdns.org/sosten.vbs
http://remcolino.duckdns.org/sostener.vbs

Source: URLhaus (abuse.ch). Updated: 2026-07-12

Hosting Infrastructure

Host URLs
icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev 19
raw.githubusercontent.com 13
66.63.170.33 9
186.169.76.187 5
dawn-bush-ddd1.yasminanthonyy.workers.dev 4
exclusionremcoss.duckdns.org 4
small-morning-8be0.fsocietyandtools.workers.dev 3
arcangelgabriel2828.duckdns.org 3
remcolinomayo24.duckdns.org 3
remcolino.duckdns.org 3
rc2404.duckdns.org 3
remcos7770.duckdns.org 3
cookies32560.duckdns.org 3
as.al 2
d7.tfdl.net 2
yaso.su 2
80.253.251.8 2
lpi0ngge6c.ufs.sh 2
respaldo2.duckdns.org 2
runds.duckdns.org 2