{
  "family": "cool_remote_control",
  "sample_count": 23,
  "category": "trojan",
  "description": "COOL! Remote Control is an early-generation Remote Access Trojan (RAT) designed to grant unauthorized attackers full administrative access to compromised Windows systems. Operating on a client-server architecture, the malware consists of a server component that secretly runs on the victims machine, listening on a predefined port for incoming connections from the attackers client application. Once a connection is established, the attacker can execute a wide array of malicious actions, including remote file management (uploading, downloading, executing, and deleting files), capturing screenshots, keystroke logging, manipulating system registries, and controlling hardware peripherals such as the mouse and CD-ROM drive. Distributed primarily through social engineering tactics like phishing emails or bundled within pirated software, COOL! Remote Control exemplifies the foundational techniques of remote command and control (C2) that paved the way for modern, highly stealthy RATs. Despite its age, its feature set serves as a blueprint for understanding lateral movement and data exfiltration in early cyber attacks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Cool RAT",
    "CoolRemote"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is COOL! Remote Control?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is an early Remote Access Trojan (RAT) that gives attackers full administrative control over a victims computer."
      }
    },
    {
      "@type": "Question",
      "name": "How does it communicate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a traditional client-server model, typically binding to a specific TCP port and waiting for the attacker to connect."
      }
    },
    {
      "@type": "Question",
      "name": "What data can it steal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can capture keystrokes, take screenshots, and exfiltrate any files present on the local hard drive."
      }
    },
    {
      "@type": "Question",
      "name": "How is it distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Often through phishing emails containing malicious attachments or bundled with cracked software."
      }
    },
    {
      "@type": "Question",
      "name": "Can it evade modern antivirus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Generally no, its legacy network signatures and static file characteristics are easily flagged by modern AV."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1071",
    "T1056.001",
    "T1113"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1071",
      "name": "Application Layer Protocol (Stratum Protocol to Mining Pools)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Cool Remote Control binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Cool Remote Control installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.CoolRemote",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.coolremote"
    },
    {
      "name": "Snort IDS Rule 1-2292 - Cool Remote Control Runtime Detection",
      "url": "https://www.snort.org"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2002,
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "legacy_delphi_rat_framework"
    ],
    "variants": [
      "coolremote_v1.12",
      "trojan.coolremote"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2001-0500",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
      "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3"
    ],
    "delivery": [
      "Trojanized administrative utility downloads shared across underground hacking forums",
      "Phishing attachments disguised as remote desktop utilities"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CoolRemoteServer",
      "Listening backdoor socket opened on TCP ports 11977, 11978, and 11980"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}