Trojan.Remcos.IH
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,431 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1,067 |
| First Seen: | November 7, 2021 |
| Last Seen: | July 17, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Remcos.IH on your system indicates a potential security threat that requires immediate attention. This type of threat is categorized as a Trojan, which is a broad term for malicious software that disguises itself as legitimate to gain unauthorized access to a computer system. The presence of Trojan.Remcos.IH suggests that your system may be compromised, and it is essential to understand the nature of this threat and take appropriate steps to remove it.
Table of Contents
What Is Trojan.Remcos.IH?
Trojan.Remcos.IH is a type of malware that can infect a computer system without the user's knowledge or consent. The term "Trojan" refers to the fact that this malware often masquerades as a legitimate program or file, allowing it to bypass security measures and gain access to the system. Once inside, Trojan.Remcos.IH can cause a range of problems, from stealing sensitive information to disrupting system performance.
How Trojan.Remcos.IH Operates
Malware like Trojan.Remcos.IH typically operates by exploiting vulnerabilities in software or tricking users into installing it. Once installed, it can communicate with its creators or other malicious entities to receive instructions or transmit stolen data. This type of malware can also modify system settings, install additional malicious software, or create backdoors for future access. Understanding how Trojan.Remcos.IH operates is crucial for developing effective strategies to detect and remove it.
Symptoms of Infection
Identifying the symptoms of a Trojan.Remcos.IH infection can be challenging, as they may resemble issues caused by other types of malware or system problems. Common symptoms include unusual system behavior, such as unexpected crashes or slowdowns, appearance of unfamiliar programs or icons, and suspicious network activity. Additionally, users may notice that their personal data is being accessed or that their system settings have been altered without their consent. Recognizing these symptoms early can help in taking prompt action to mitigate the damage.
How to Remove Trojan.Remcos.IH
- Boot your computer in Safe Mode with Networking to prevent Trojan.Remcos.IH from loading and to allow for a clean environment to perform removal steps.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of the malware.
- Uninstall any suspicious programs that were installed around the time of the infection. Be cautious and only remove programs that you are certain are malicious or unnecessary.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings that Trojan.Remcos.IH may have altered.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all components of Trojan.Remcos.IH have been removed.
Conclusion
Removing Trojan.Remcos.IH from your system requires careful and systematic steps to ensure that all components of the malware are eliminated. It is essential to act quickly to prevent further damage and to protect your personal data. By following the removal steps outlined above and maintaining good security practices, such as regularly updating your software and being cautious with emails and downloads, you can significantly reduce the risk of future infections. Remember, vigilance and proactive security measures are key to safeguarding your digital environment.
Analysis Report
General information
| Family Name: | Trojan.Remcos.IH |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
bc679f7ffa4598ceeb6fb02c0f11f013
SHA1:
76bde52ab03cf9a31eb9ef7e70cc3354aaf94811
File Size:
55.30 KB, 55296 bytes
|
|
MD5:
0c19a872ebc60f92a28e08e3ba407f99
SHA1:
b1cb42e75b4c624f98ee730c3adaf8d48cd417a9
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
7c520f618df1ace9a77c5b51ac560d9e
SHA1:
037b215c7bea3d209a7f582ef3f088ca2b7087c3
File Size:
61.44 KB, 61440 bytes
|
|
MD5:
f394ef3de9e47f73d481d3c3f9a67bcd
SHA1:
a8ffd441949860931bb8014786ce3f33da1c7b13
SHA256:
3F315EDAC9C5D18DED924B9135E783C400AE0FF5509A277EE588180927371A64
File Size:
49.66 KB, 49664 bytes
|
|
MD5:
f87cecd996ca8c473960d53dddf72df9
SHA1:
1025cb4309de0dfa210b3863e62b6c0e157442e9
SHA256:
857F26F2981055E0012EB787ACDFF7DE7425693DF622F2348C8F3FE01D4EB3F5
File Size:
49.66 KB, 49664 bytes
|
Show More
|
MD5:
db66c500425d4d701b4e503ab0068cb1
SHA1:
fde6b513012a826fff9b32d72b1ca14f97efa0e6
SHA256:
7CDFD70E939BE37956213B889C247ABD4069FF7BE15220617DBA9008ABBC54BA
File Size:
83.97 KB, 83968 bytes
|
|
MD5:
b79fd4ad55e71be61f6c0994a1c22606
SHA1:
03e7902b0c374860f15d07eb1d67fbc8f3acc0b1
SHA256:
80C9641F65278762E746EFC7D711A1A4A05E6BA87DE50652DBB721E4EACA1610
File Size:
40.45 KB, 40448 bytes
|
|
MD5:
4e3c2540d2ad08424138744ea6d49bc9
SHA1:
e52758614c9017010c9d63706c4b8c699733b71f
SHA256:
E6ED180D4B7808B54E1A15E2524C5CF29D85741A6A86B0545D99BBC6023E86AE
File Size:
41.98 KB, 41984 bytes
|
|
MD5:
d9b5366d4098a3ed1aaac2017855ab83
SHA1:
10512c86b7ac35112e5a1e8832d0368544ea2298
SHA256:
3DA50328F6E8A7E6F7CBB87082317ACB304652701EFA8F82AC1C4001E7F89D17
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
d934b3386817c81c2d372ca8b3966783
SHA1:
2c0bbde666adbcf7b8830da6cd2c575149520f68
SHA256:
5DE14170DDC8140BEA9CC4BF8EF105A663001C9422A26918228E13FE68B563C2
File Size:
169.47 KB, 169472 bytes
|
|
MD5:
5046a6a448c383e6c65fb960672a6580
SHA1:
c2fedba8fb6da4436339bfe7ab241c0358229187
SHA256:
3202A3424E416DB1D2C2CA610D2F6153D5D2433E8263000E93718A75761EBEF0
File Size:
41.98 KB, 41984 bytes
|
|
MD5:
485713d78a283768ca0743c395a02929
SHA1:
ef96f819591fd659a7e883fd4c043b3a0a0fddbc
SHA256:
B0F0AFEFE60CF0ED47F08FBCCCFF9AADBC43C2876AE188351E89675C3F3F4F19
File Size:
41.47 KB, 41472 bytes
|
|
MD5:
df7039f12e34f9eadbdf84e225d0bc69
SHA1:
4699b4770aca08e55fcf9abb600be3b73fcb7436
SHA256:
FA9CDABF2D62ABD168819C7408E8AC8A57883C0DD93844F50A93F44511361D17
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
c91f8cf3d6cd9811a8c4286740f84ee7
SHA1:
fb5ca312d72b8417c6a14528d19d6d44c28b6ef5
SHA256:
198A495EC96AFA80A2A40E83CBA21EA51C593D314191B88E8CA2E7BA06A3A51D
File Size:
47.62 KB, 47616 bytes
|
|
MD5:
0c85006cdbe1b6f6ce6b64bd42c6692f
SHA1:
2fb89d6df76329a259cd199694b52a68dc19ffba
SHA256:
0A6DC1DE4366ECB4CDD29FE20DCBE81A26F26023366C83787391B0EC38556867
File Size:
65.54 KB, 65536 bytes
|
|
MD5:
cb81b144f6a8499873afa12281dc7583
SHA1:
068214363ffeb9e24c39b58ae88a459ca64f56ab
SHA256:
AF7789974B291B93FC8DA28128748103CCB39DF68EDD1600A3DC26C36687DD62
File Size:
43.01 KB, 43008 bytes
|
|
MD5:
c656837baadd27c349fe7d309209a663
SHA1:
be95bcfa69cb27d6b3b2f757fa0eb8729c1b25f9
SHA256:
747FA2ED20B2D6670BA8046EBAADFAD3863E059073275320BB8998C20E467D08
File Size:
55.30 KB, 55296 bytes
|
|
MD5:
f908478130ffd1738ff66bf144df6f7b
SHA1:
329f6b655540518321775d23c9d666d097e241b7
SHA256:
F66A73157A81B8792FBE9CEFB5402D063C8BBFA0B79C685A8EFE3EDB28EC7312
File Size:
47.62 KB, 47616 bytes
|
|
MD5:
939d2c6d9f71579d827d272e3705f7cb
SHA1:
d7a5748b4bdadeb68c434f732c8aab1704fc7cb2
SHA256:
4D4DE1005DC1CFE66E4AB75E0C3FBA80BD9603B62B0F08DE2C4CC0B0C6E9B7A9
File Size:
40.45 KB, 40448 bytes
|
|
MD5:
090d11072ad40ffacd75f1b18bb546bb
SHA1:
e72db59c950ba622ce0e1eaf72c754c3a82d007c
SHA256:
C8DC1F99E663C865A7B4C57E95E6F201B69B1FC4BA860456FAF213B4822276C8
File Size:
141.82 KB, 141824 bytes
|
|
MD5:
ba4f4ec2132f20d1a79be306d36d2a1d
SHA1:
8b6c73357ac7250d1d8b789f13da40074af7dbc2
SHA256:
985018B7DED7FE768978861F12D6D679F3AE596E972599BE6DEB4D24B010FD93
File Size:
97.79 KB, 97792 bytes
|
|
MD5:
f3308098552bec735bf9abf94bb42cf5
SHA1:
c7c023221eab2c90a23db7ddb609dee2074fe7c5
SHA256:
258174B5EBA02A3A977C5D3CF38E8147240F4931082713150C5552626DD220FA
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
604c8cb8318a4813bdce02480bc42d09
SHA1:
1f467404b11d1b69b6756816724230b86d37ad89
SHA256:
3B29D6060E91B43057E417D7EAB1399B022494EEA7AD55D7A89780DFD32DD907
File Size:
43.52 KB, 43520 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | MPD Eft Api C - Test Client |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- Installer Version
- JMC
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 122 |
|---|---|
| Potentially Malicious Blocks: | 2 |
| Whitelisted Blocks: | 111 |
| Unknown Blocks: | 9 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.FDS
- Agent.FGT
- Agent.FYH
- Agent.XCO
- Agent.XSE
Show More
- Agent.XSH
- BadJoke.XA
- CsgoHack.P
- Injector.DFD
- Injector.YF
- KillMBR.XB
- KillMBR.Y
- KillMBR.YA
- Optix.A
- Remcos.IF
- Remcos.IL
- Rozena.HGF
- Rozena.VD
- Trojan.Kryptik.Gen.AZP
