# Copyright (c) 2014-2019 Miroslav Stampar (@stamparm) # See the file 'LICENSE' for copying permission # Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Remcos-G/detailed-analysis.aspx remcos.legacyrealestateadvisors.net remcos2.legacyrealestateadvisors.net # Reference: https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html dboynyz.pdns.cz streetz.club mdformo.ddns.net mdformo1.ddns.net vitlop.ddns.net ns1.madeinserverwick.club uploadtops.is prince.jumpingcrab.com timmason2.com lenovoscanner.duckdns.org lenovoscannertwo.duckdns.org lenovoscannerone.duckdns.org google.airdns.org civita2.no-ip.biz www.pimmas.com.tr www.mervinsaat.com.tr samurmakina.com.tr www.paulocamarao.com midatacreditoexperian.com.co www.lebontour.com businesslisting.igg.biz unifscon.com # Reference: https://twitter.com/MaelSecurity/status/1036551872008605696 test200.dynu.net # Reference: https://twitter.com/ps66uk/status/1040576968750706689 # Reference: https://www.virustotal.com/#/ip-address/185.163.100.45 gclarke77.gotdns.ch gclarke7.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1040620171692466176 yvonne.ddns.net # Reference: https://twitter.com/avman1995/status/1040472512356855808 top.taijh.xyz # Reference: https://twitter.com/Racco42/status/1040154199592509440 auxlorenagomez.ddns.net # Reference: https://twitter.com/luc4m/status/1021670673247285248 worldwide.weldwire.top # Reference: https://twitter.com/luc4m/status/1019948492947709953 gatewayglobal.strangled.net # Reference: https://twitter.com/James_inthe_box/status/1018792273574678528 http://185.62.190.232 # Reference: https://twitter.com/ps66uk/status/1046900765493739520 menaxe.duckdns.org # Reference: https://www.cyren.com/blog/articles/fake-invoice-carries-rescoms-malware-targeting-businesses-globally infocolornido.publicvm.com # Reference: https://twitter.com/ScumBots/status/1051360120834265088 satan969.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1044204804354957312 ddns.njegidi888.xyz # Reference: https://twitter.com/Racco42/status/1027883312252108800 2419.damnserver.com 2419.duckdns.org 2419.geekgalaxy.com 2419.health-carereform.com 2419.pgafan.net # Reference: https://twitter.com/Jan0fficial/status/986580332135829506 remrem.onmypc.net # Reference: https://twitter.com/Jan0fficial/status/975661898363559937 emilylatta411.servehttp.com # Reference: https://twitter.com/James_inthe_box/status/939146342357536768/photo/1 gemalto788.ddns.net