Remcos RAT (троян удаленного доступа) изначально был разработан как профессиональный инструмент для удаленного управления компьютерами. Remcos RAT признан семейством вредоносных программ, поскольку с момента публикации его первой версии 21 июля 2016 года хакеры злоупотребляют им для тайного контроля устройств жертв. Remcos RAT - это коммерческое программное обеспечение, которое продается онлайн.
Remcos RAT IOCs
Indicators of Compromise
IPv4 Port Combinations
- 194.5.98.184:3191
- 45.133.174.97:2404
- 79.134.225.115:6061
- 91.192.100.38:2050
- 91.193.75.239:10171
Domains
- 2pp67g.db.files.1drv.com
- 3iesxa.sn.files.1drv.com
- durdyq.db.files.1drv.com
- patronkingoopsalmghandnaiojamexicoquadaras.s3.sa-east-1.amazonaws.com
Domain Port Combinations
- 2ndspreading1.ddns.net:2404
- amalar.camdvr.org:2404
- bitm.dvrlists.com:6061
- Darwin06.casacam.net:2404
- eter101.dvrlists.com:2050
- eter103.dvrlists.com:2050
- july202022.ddns.net:2404
- july20220spread.ddns.net:2404
- july20220spread2.ddns.net:2404
- july20220spread2.ddns:2404
- mandingo.dvrlists.com:10171
- newehmpage.webredirect.org:5564
- nunez115.accesscam.org:2404
- nunez118.camdvr.org:2404
- nuvez110.camdvr.org:2404
- stopeet.camdvr.org:2404
- topboysully.dvrlists.com:10171
URLs
- http://192.3.76.220/client.jpg
- http://192.3.76.220/client.txt
- http://192.3.76.220/edi.vbs
- http://209.127.20.13/ade.jpg
- http://209.127.20.13/adec.txt
- http://209.127.20.13/boo.jpg
- http://209.127.20.13/boop.txt
- http://209.127.20.13/calc.vbs
- http://209.127.20.13/clb.jpg
- http://209.127.20.13/fiddy.jpg
- http://209.127.20.13/fif.txt
- http://209.127.20.13/firm.txt
- http://209.127.20.13/how.txt
- http://209.127.20.13/hwid.vbs
- http://209.127.20.13/jubile.js
- http://209.127.20.13/jut.jpg
- http://209.127.20.13/jutac.txt
- http://209.127.20.13/kim.txt
- http://209.127.20.13/kiss.jpg
- http://209.127.20.13/remit.jpg
- http://209.127.20.13/sinus.vbs
- http://209.127.20.13/tim.jpg
- http://209.127.20.13/time.txt
- http://geoplugin.net/json.gp
- http://kopadd.yunethosting.rs/up/gluteus.js
- http://lutanedukasi.co.id/wp-includes/Ejetkygbptvloikaflhkyeymcfvredrtjy.exe
- http://mckinneytighe.com/newmon/attack.txt
- http://mckinneytighe.com/newmon/calc/Attack.jpg
- http://mckinneytighe.com/newmon/calc/Client.vbs
- https://doc-0s-1c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/7me286ogiahm4va5jgga5t38mqdrhpgs/1659557700000/03089706310646530244/*/1uFwlni-97p4lDJkAjsiRPHiTpZ5ouhNo?e=download&uuid=9ca7469b-6301-48f0-b85f-72c972e97c58
- https://drive.google.com/uc?export=download&id=1uFwlni-97p4lDJkAjsiRPHiTpZ5ouhNo
- https://kopadd.yunethosting.rs/sync/gith.vbs
Emails
- achpaymentservice@online-citigroup.com
- activepay.notices@edi-pncactivepay.com
- amazon@deliveryamasupportngh.com
- amazon@orderdemandzon.cc
- cipc@replydhinfo.com
- dhl@postesmailing.com
- electronic_remit_desk@edi-wellsfargo.com
- finout@toyota-bishkek.kg
- info@gatron.cam
- infodelhi@akn.co.in
- noreply-remit_advice@secure-jpmchase.com
- paymentremittance@wellsfargofinances.com
- paymentremittanceinformation@epayables-wellsfargo.com
- remit_advice@messages-jpmchase.com
- remit_advice_notice@payments-chase.com
- remittance@nvoicepay-ach.com
- sales@ecbussinessllc.com
MD5
- 013abd2c23de690c05fb31992ecbc1f4
- 015fb26e44a3e4f9ad7c5d3409f28620
- 04f4a1f6c6ee5dbd45519f35dab50747
- 1051c4332d8125caaacb94c50bd0b8a6
- 10e5d1276a289ce059bb010f702c660c
- 135a1b45054fd8c36e854fb696d7391a
- 1edaa89cc9da5155236bcb4425372508
- 1f396ec5e8c1be3b135aa2c934e25ef4
- 26f29788079bdf0fed010623226f0c5e
- 2adb7638640adb4275b5d16fce2e405a
- 2af3aa56df81cdbe18efde3933a89ef5
- 2e01f50975210253a98efb3b651122a8
- 306dd85937f96d529011d00918cff5d5
- 31183bae60b98517ccec91048d621130
- 311b34e435e41292f7bb30bec80f0898
- 31704ec5746beae12de195b5356cc798
- 34b912cade8f5a1586e7110da2246803
- 351acd73e4baddb911410db6a9240a0c
- 362a915a33944b7b24f5f0edb837f5ee
- 39be556875f754cf4a3bc30c1260d02d
- 3d62f2398bb259fb35a8400833500650
- 44fbc207b7526be2ca294f0d9b8d494b
- 45a141133ea90216158e0651e641fd1f
- 48ca4854648ecdee074e3ee023c6bf04
- 4945a913a4fe8be10481e16136a98269
- 4b04a1aed8a1398e7d0139f367917d8e
- 4dba5eb47ea555dd2e88b0a7e13732f2
- 5564815065fcdecb2488c434ff5f3ed0
- 5a060aa2e0e82ee0b03b65ce9ed52c2f
- 6053670bd8e92e6b1eb1eba9fc2b2a81
- 62c42e22e7fda001b894902862a02295
- 679aa5e940e951def13c11829dd1fc06
- 6c8e95df972a44ac362df71557a4f2cb
- 6da60b17ebe25fae9e759be3bb11b49d
- 7092568e9cf03f175c5602bf89e19fb8
- 73d7c21952995d7f276c123ac4604fb8
- 77ebbd201aa627f32e5ad4644c8ffc7b
- 7b9490d2c1b4e4a41f388a9f3730ce6f
- 7e3bc947bf627a173b545873f3da8492
- 8233ec123d1b8059727e6dd5298a7ba3
- 87e9e499aacf415fdaf05a3b0bdcf6d6
- 92808b70a3219e9111f92ae19e2b32d9
- 986e5b86d80e7c324c21f534542ab099
- 98fb783932d6e50743126ce2cf8e8b30
- 9e0882145f56a07d20ea0c3038e1ea9f
- 9f32e40c1db0b066ff369e9229e86064
- a2cdd0c9f887dc5ad106ff62733bc70b
- a36fdca94c76051de2864d7a73a3120b
- a70728cb8e881efb78bb528eec03cb06
- af15a7290c8000d2c865a2c61a6ff0bf
- b34df937d4905eb496330866aa09bcc3
- b5ca979727b782ca354e96f26d0a60e7
- c135c2dad6b8d014bfd512fd94d31200
- c2ef131f8c613f738928c00f2d329386
- c3c7cf789d78efe2be49cb5ce041bbe1
- c52ef76cff0d8db1ecdc29d8a62cd5e6
- c64b60cf961b3b5a7537197cd2a4bba0
- c74ffb05677da82dfababe74d3a72653
- c987d1f0ac6eb170d00f8e204af58e26
- caa9b2660bb510d8e16fc68d56cc0976
- cbbbf27e54152323cfc193108664e1c0
- cd8ca76327c342972e95387b26538e45
- ce5a6d23610d19ccb256f296a43aaa7c
- cea5435e160dcea5b5850971416a1440
- cec8c0dc9dca393cb24012c54e152dcf
- cfda7cd8cbb2c4c0adea32e5e03f53c4
- d10f40f028e28a2afdfe8fa0c5a0a6e9
- d19ac64774f9158009b84c3c2a6dc81b
- d7e5758c0df051e9fbd9d13f0cb62fc6
- d939bff9dad8eb49995a3ff86778977e
- dc15d765cd0bc39e80308f433efd8084
- dd4c51fcf701df0e115d7bb88bb65859
- de418aa790a7798cf710979c873d7f0f
- df77ab87eefa751034d9099027ca56ec
- e1d8e6bc815f495e60427921a460e8a1
- e2ad2d338ad55451342eaaa248facfaa
- e3dc09e5e6ad89a1ece672cd09283f2e
- e52441a2515904b34ed8faa7d810965f
- e7b8d60cacad0c1f10167deb6eb7b55e
- e8111dca2d8ddd30b8412d6b3d14e781
- ea85f8681600aa1c3b437d11e4d0e34b
- eb0c96179ec5df5c958acf539e09e0bb
- ee4d5dbc729fc4362639ea1e5df56f43
- f1b95973c92658cd7b8c4fec8131391e
- f4011209afd51cf74754bb8c41b82095
- f971bc24ec679d4a5f7367a80728ada7
- f976f3392d428272b06d4a4ef871eac7
- fa98a8a955e190329afeba0a651a8c58
- fb88518ff7279fade40894d383c5bc62
- fdce4e6a7d253b155e1b75dbecd54d88
- fe8479c6965db87bfcefdb34123d4449
- fff088e23aa4db91797df9dcb02ef946