Remcos RAT IOCs

Remcos RAT (троян удаленного доступа) изначально был разработан как профессиональный инструмент для удаленного управления компьютерами. Remcos RAT признан семейством вредоносных программ, поскольку с момента публикации его первой версии 21 июля 2016 года хакеры злоупотребляют им для тайного контроля устройств жертв. Remcos RAT - это коммерческое программное обеспечение, которое продается онлайн.

Содержание

Indicators of Compromise

IPv4 Port Combinations

194.5.98.184:3191
45.133.174.97:2404
79.134.225.115:6061
91.192.100.38:2050
91.193.75.239:10171

Domains

2pp67g.db.files.1drv.com
3iesxa.sn.files.1drv.com
durdyq.db.files.1drv.com
patronkingoopsalmghandnaiojamexicoquadaras.s3.sa-east-1.amazonaws.com

Domain Port Combinations

2ndspreading1.ddns.net:2404
amalar.camdvr.org:2404
bitm.dvrlists.com:6061
Darwin06.casacam.net:2404
eter101.dvrlists.com:2050
eter103.dvrlists.com:2050
july202022.ddns.net:2404
july20220spread.ddns.net:2404
july20220spread2.ddns.net:2404
july20220spread2.ddns:2404
mandingo.dvrlists.com:10171
newehmpage.webredirect.org:5564
nunez115.accesscam.org:2404
nunez118.camdvr.org:2404
nuvez110.camdvr.org:2404
stopeet.camdvr.org:2404
topboysully.dvrlists.com:10171

URLs

http://192.3.76.220/client.jpg
http://192.3.76.220/client.txt
http://192.3.76.220/edi.vbs
http://209.127.20.13/ade.jpg
http://209.127.20.13/adec.txt
http://209.127.20.13/boo.jpg
http://209.127.20.13/boop.txt
http://209.127.20.13/calc.vbs
http://209.127.20.13/clb.jpg
http://209.127.20.13/fiddy.jpg
http://209.127.20.13/fif.txt
http://209.127.20.13/firm.txt
http://209.127.20.13/how.txt
http://209.127.20.13/hwid.vbs
http://209.127.20.13/jubile.js
http://209.127.20.13/jut.jpg
http://209.127.20.13/jutac.txt
http://209.127.20.13/kim.txt
http://209.127.20.13/kiss.jpg
http://209.127.20.13/remit.jpg
http://209.127.20.13/sinus.vbs
http://209.127.20.13/tim.jpg
http://209.127.20.13/time.txt
http://geoplugin.net/json.gp
http://kopadd.yunethosting.rs/up/gluteus.js
http://lutanedukasi.co.id/wp-includes/Ejetkygbptvloikaflhkyeymcfvredrtjy.exe
http://mckinneytighe.com/newmon/attack.txt
http://mckinneytighe.com/newmon/calc/Attack.jpg
http://mckinneytighe.com/newmon/calc/Client.vbs
https://doc-0s-1c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7me286ogiahm4va5jgga5t38mqdrhpgs/1659557700000/03089706310646530244/*/1uFwlni-97p4lDJkAjsiRPHiTpZ5ouhNo?e=download&uuid=9ca7469b-6301-48f0-b85f-72c972e97c58
https://drive.google.com/uc?export=download&id=1uFwlni-97p4lDJkAjsiRPHiTpZ5ouhNo
https://kopadd.yunethosting.rs/sync/gith.vbs

Emails

achpaymentservice@online-citigroup.com
activepay.notices@edi-pncactivepay.com
amazon@deliveryamasupportngh.com
amazon@orderdemandzon.cc
cipc@replydhinfo.com
dhl@postesmailing.com
electronic_remit_desk@edi-wellsfargo.com
finout@toyota-bishkek.kg
info@gatron.cam
infodelhi@akn.co.in
noreply-remit_advice@secure-jpmchase.com
paymentremittance@wellsfargofinances.com
paymentremittanceinformation@epayables-wellsfargo.com
remit_advice@messages-jpmchase.com
remit_advice_notice@payments-chase.com
remittance@nvoicepay-ach.com
sales@ecbussinessllc.com

MD5

013abd2c23de690c05fb31992ecbc1f4
015fb26e44a3e4f9ad7c5d3409f28620
04f4a1f6c6ee5dbd45519f35dab50747
1051c4332d8125caaacb94c50bd0b8a6
10e5d1276a289ce059bb010f702c660c
135a1b45054fd8c36e854fb696d7391a
1edaa89cc9da5155236bcb4425372508
1f396ec5e8c1be3b135aa2c934e25ef4
26f29788079bdf0fed010623226f0c5e
2adb7638640adb4275b5d16fce2e405a
2af3aa56df81cdbe18efde3933a89ef5
2e01f50975210253a98efb3b651122a8
306dd85937f96d529011d00918cff5d5
31183bae60b98517ccec91048d621130
311b34e435e41292f7bb30bec80f0898
31704ec5746beae12de195b5356cc798
34b912cade8f5a1586e7110da2246803
351acd73e4baddb911410db6a9240a0c
362a915a33944b7b24f5f0edb837f5ee
39be556875f754cf4a3bc30c1260d02d
3d62f2398bb259fb35a8400833500650
44fbc207b7526be2ca294f0d9b8d494b
45a141133ea90216158e0651e641fd1f
48ca4854648ecdee074e3ee023c6bf04
4945a913a4fe8be10481e16136a98269
4b04a1aed8a1398e7d0139f367917d8e
4dba5eb47ea555dd2e88b0a7e13732f2
5564815065fcdecb2488c434ff5f3ed0
5a060aa2e0e82ee0b03b65ce9ed52c2f
6053670bd8e92e6b1eb1eba9fc2b2a81
62c42e22e7fda001b894902862a02295
679aa5e940e951def13c11829dd1fc06
6c8e95df972a44ac362df71557a4f2cb
6da60b17ebe25fae9e759be3bb11b49d
7092568e9cf03f175c5602bf89e19fb8
73d7c21952995d7f276c123ac4604fb8
77ebbd201aa627f32e5ad4644c8ffc7b
7b9490d2c1b4e4a41f388a9f3730ce6f
7e3bc947bf627a173b545873f3da8492
8233ec123d1b8059727e6dd5298a7ba3
87e9e499aacf415fdaf05a3b0bdcf6d6
92808b70a3219e9111f92ae19e2b32d9
986e5b86d80e7c324c21f534542ab099
98fb783932d6e50743126ce2cf8e8b30
9e0882145f56a07d20ea0c3038e1ea9f
9f32e40c1db0b066ff369e9229e86064
a2cdd0c9f887dc5ad106ff62733bc70b
a36fdca94c76051de2864d7a73a3120b
a70728cb8e881efb78bb528eec03cb06
af15a7290c8000d2c865a2c61a6ff0bf
b34df937d4905eb496330866aa09bcc3
b5ca979727b782ca354e96f26d0a60e7
c135c2dad6b8d014bfd512fd94d31200
c2ef131f8c613f738928c00f2d329386
c3c7cf789d78efe2be49cb5ce041bbe1
c52ef76cff0d8db1ecdc29d8a62cd5e6
c64b60cf961b3b5a7537197cd2a4bba0
c74ffb05677da82dfababe74d3a72653
c987d1f0ac6eb170d00f8e204af58e26
caa9b2660bb510d8e16fc68d56cc0976
cbbbf27e54152323cfc193108664e1c0
cd8ca76327c342972e95387b26538e45
ce5a6d23610d19ccb256f296a43aaa7c
cea5435e160dcea5b5850971416a1440
cec8c0dc9dca393cb24012c54e152dcf
cfda7cd8cbb2c4c0adea32e5e03f53c4
d10f40f028e28a2afdfe8fa0c5a0a6e9
d19ac64774f9158009b84c3c2a6dc81b
d7e5758c0df051e9fbd9d13f0cb62fc6
d939bff9dad8eb49995a3ff86778977e
dc15d765cd0bc39e80308f433efd8084
dd4c51fcf701df0e115d7bb88bb65859
de418aa790a7798cf710979c873d7f0f
df77ab87eefa751034d9099027ca56ec
e1d8e6bc815f495e60427921a460e8a1
e2ad2d338ad55451342eaaa248facfaa
e3dc09e5e6ad89a1ece672cd09283f2e
e52441a2515904b34ed8faa7d810965f
e7b8d60cacad0c1f10167deb6eb7b55e
e8111dca2d8ddd30b8412d6b3d14e781
ea85f8681600aa1c3b437d11e4d0e34b
eb0c96179ec5df5c958acf539e09e0bb
ee4d5dbc729fc4362639ea1e5df56f43
f1b95973c92658cd7b8c4fec8131391e
f4011209afd51cf74754bb8c41b82095
f971bc24ec679d4a5f7367a80728ada7
f976f3392d428272b06d4a4ef871eac7
fa98a8a955e190329afeba0a651a8c58
fb88518ff7279fade40894d383c5bc62
fdce4e6a7d253b155e1b75dbecd54d88
fe8479c6965db87bfcefdb34123d4449
fff088e23aa4db91797df9dcb02ef946

Remcos RAT IOCs - Part 4