user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:PowerShell/RemcosRAT!AMTB
Trojan:PowerShell/RemcosRAT!AMTB - Windows Defender threat signature analysis

Trojan:PowerShell/RemcosRAT!AMTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:PowerShell/RemcosRAT!AMTB
Classification:
Type:Trojan
Platform:PowerShell
Family:RemcosRAT
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!AMTB
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for PowerShell platform, family RemcosRAT

Summary:

This detection indicates a concrete instance of Trojan:PowerShell/RemcosRAT, a sophisticated Remote Access Trojan (RAT) deployed via PowerShell. RemcosRAT is designed to establish persistence, execute arbitrary commands, steal sensitive data like browser cookies, and communicate with a command-and-control server over HTTP, granting attackers extensive control over the compromised system.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - HttpWebResponse (PEHSTR_EXT)
 - HttpWebRequest (PEHSTR_EXT)
 - SmallestEnclosingCircle.Properties.Resources (PEHSTR_EXT)
 - CompressionMode (PEHSTR_EXT)
 - rundll32.exe %sadvpack.dll,DelNodeRunDLL32 (PEHSTR_EXT)
 - rundll32.exe %s,InstallHinfSection %s 128 %s (PEHSTR_EXT)
 - cmd /c cmd < (PEHSTR_EXT)
 - .htm & ping -n 5 localhost (PEHSTR_EXT)
 - Command.com /c %s (PEHSTR_EXT)
 - Software\Microsoft\Windows\CurrentVersion\RunOnce (PEHSTR_EXT)
 - cmd /c cmd < Preferences.vsd & ping -n 5 localhost (PEHSTR_EXT)
 - LkXE.exe (PEHSTR_EXT)
 - RandomMaker.Properties.Resources (PEHSTR_EXT)
 - 5Assembled.Program (PEHSTR_EXT)
 - Njswpsg (PEHSTR_EXT)
 - %homedrive%\eegv (PEHSTR_EXT)
 - Zptcs.exe (PEHSTR_EXT)
 - reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System (PEHSTR_EXT)
 - User Data\Default\Cookies (PEHSTR_EXT)
 - CreateObject("WScript.Shell").Run "cmd (PEHSTR_EXT)
 - \sysinfo.txt (PEHSTR_EXT)
 - SOFTWARE\Microsoft\Windows NT\CurrentVersion (PEHSTR_EXT)
 - \AppData\Local\Google\Chrome\User Data\Default\Login Data (PEHSTR_EXT)
 - \AppData\Local\Google\Chrome\User Data\Default\Cookies (PEHSTR_EXT)
 - AppData\Roaming\Mozilla\Firefox\Profiles\ (PEHSTR_EXT)
 - \logins.json (PEHSTR_EXT)
 - \key3.db (PEHSTR_EXT)
 - Execute (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: 75deee7af25dc4f772661f17be4938c1980a703a785dc32274bf1647f8133cec.ps1
75deee7af25dc4f772661f17be4938c1980a703a785dc32274bf1647f8133cec
30/01/2026
→VirusTotal↓Download Sample
Filename: 8cd7d9ccea98ad6a3dfb4767e574349c9fd5678150c629661574ddd45e40cd37.ps1
8cd7d9ccea98ad6a3dfb4767e574349c9fd5678150c629661574ddd45e40cd37
30/01/2026
→VirusTotal↓Download Sample
Filename: a46170be7cca7d8bcecf3da4caf035ec24f758eba45936ed802c1a03beab1c0a.ps1
a46170be7cca7d8bcecf3da4caf035ec24f758eba45936ed802c1a03beab1c0a
30/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the compromised host from the network. Perform a full system scan, then manually investigate and remove all persistent artifacts (registry keys, scheduled tasks, suspicious files like LkXE.exe, Zptcs.exe, and files in %homedrive%\eegv) related to RemcosRAT. Reset all user and administrative credentials, especially those potentially compromised, and consider a full system reimage for critical assets to ensure complete eradication.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 30/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊