# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Aliases: korat, lsslogger, remcos # Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Remcos-G/detailed-analysis.aspx remcos.legacyrealestateadvisors.net remcos2.legacyrealestateadvisors.net # Reference: https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html dboynyz.pdns.cz streetz.club mdformo.ddns.net mdformo1.ddns.net vitlop.ddns.net ns1.madeinserverwick.club uploadtops.is prince.jumpingcrab.com timmason2.com lenovoscanner.duckdns.org lenovoscannertwo.duckdns.org lenovoscannerone.duckdns.org google.airdns.org civita2.no-ip.biz pimmas.com.tr mervinsaat.com.tr samurmakina.com.tr paulocamarao.com midatacreditoexperian.com.co lebontour.com businesslisting.igg.biz unifscon.com # Reference: https://twitter.com/MaelSecurity/status/1036551872008605696 test200.dynu.net # Reference: https://twitter.com/ps66uk/status/1040576968750706689 # Reference: https://www.virustotal.com/#/ip-address/185.163.100.45 gclarke77.gotdns.ch gclarke7.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1040620171692466176 yvonne.ddns.net # Reference: https://twitter.com/avman1995/status/1040472512356855808 top.taijh.xyz # Reference: https://twitter.com/Racco42/status/1040154199592509440 auxlorenagomez.ddns.net # Reference: https://twitter.com/luc4m/status/1021670673247285248 worldwide.weldwire.top # Reference: https://twitter.com/luc4m/status/1019948492947709953 gatewayglobal.strangled.net # Reference: https://twitter.com/James_inthe_box/status/1018792273574678528 http://185.62.190.232 # Reference: https://twitter.com/ps66uk/status/1046900765493739520 menaxe.duckdns.org # Reference: https://www.cyren.com/blog/articles/fake-invoice-carries-rescoms-malware-targeting-businesses-globally infocolornido.publicvm.com # Reference: https://twitter.com/ScumBots/status/1051360120834265088 satan969.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1044204804354957312 ddns.njegidi888.xyz # Reference: https://twitter.com/Racco42/status/1027883312252108800 2419.damnserver.com 2419.duckdns.org 2419.geekgalaxy.com 2419.health-carereform.com 2419.pgafan.net # Reference: https://twitter.com/Jan0fficial/status/986580332135829506 remrem.onmypc.net # Reference: https://twitter.com/Jan0fficial/status/975661898363559937 emilylatta411.servehttp.com # Reference: https://twitter.com/James_inthe_box/status/939146342357536768/photo/1 gemalto788.ddns.net # Reference: https://twitter.com/Racco42/status/1054384363524235264 eskimoz.duckdns.org # Reference: https://twitter.com/ScumBots/status/1102437794025295872 112.204.228.252:2323 # Reference: https://www.cert-pa.it/notizie/analisi-del-malware-remcos-veicolato-tramite-packer-delphi/ pekniecza.hopto.org # Reference: https://twitter.com/dvk01uk/status/1108949343074054144 # Reference: https://app.any.run/tasks/5e5404b2-4018-4da4-a6a3-19465fa7cc9c 185.244.29.73:6767 # Reference: https://twitter.com/malwrhunterteam/status/1111352801693782016 castelfable.duckdns.org # Reference: https://twitter.com/malwrhunterteam/status/1104327117309968384 infosblogwar.duckdns.org # Reference: https://twitter.com/James_inthe_box/status/1098553609375993856 194.68.59.41:1956 # Reference: https://twitter.com/pollo290987/status/1083401581670875136 194.5.98.173:7081 # Reference: https://twitter.com/ps66uk/status/1062514051165704192 argonsa.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1060547624418168839 cjmoney.duckdns.org # Reference: https://twitter.com/ps66uk/status/1049011930411794432 185.148.241.58:2442 # Reference: https://twitter.com/FewAtoms/status/1104355364391305216 196.127.74.118:2402 # Reference: https://twitter.com/Racco42/status/1088469487387664384 utchmann.bounceme.net # Reference: https://twitter.com/pancak3lullz/status/1075888625261387777 info1.duckdns.org 185.244.30.126:5552 # Reference: https://twitter.com/James_inthe_box/status/1063118942095331328 449ers.ddns.net # Reference: https://twitter.com/Jan0fficial/status/986580332135829506 remrem.onmypc.net # Reference: https://twitter.com/Jan0fficial/status/975661898363559937 emilylatta411.servehttp.com # Reference: https://twitter.com/ViriBack/status/971430374919122944 top.carolp1.xyz 185.62.189.72:1992 # Reference: https://twitter.com/pollo290987/status/963073970542129152 jerryemperror2.punkdns.top # Reference: https://twitter.com/avman1995/status/960419643704913920 obereagu.ddns.net # Reference: https://twitter.com/Antelox/status/884773449520095232 178.73.210.233:100 # Reference: https://twitter.com/makflwana/status/1104376804293263360 # Reference: https://app.any.run/tasks/8149d283-b550-4b31-9adf-4b4c85962e7d juanbouyant.ddns.net # Reference: https://twitter.com/x42x5a/status/1114133426708340736 prueba00223.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1115258819473317888 triggerd.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1121754056517537792 winsec.ddns.net 46.246.86.67:2606 # Reference: https://twitter.com/dvk01uk/status/1123210727483957248 # Reference: https://app.any.run/tasks/0e57a079-57d4-4c2d-8e01-82d316ac2d55 ablegod.hopto.org 79.134.225.6:6691 # Reference: https://github.com/edchavarro/RAT_IoCs lacoste587.lacoste587.agency dsquared21.dsquared21.rocks hugoboss01.hugoboss01.store luisvuitton.luisvuitton.tech supreme12.supreme12.recipes automovil1.peugeot10.cc comida2.kfc52.club auto14.wolsvagen7.mobi telefonia1.telcel75.asia consola2.nintendo3.life microsofteup.pdns.cz lexusempresa.100chickens.me mojarracompany.pdns.cz camilo6541.pdns.cz balvinnew.100chickens.me mercadolibre.pdns.cz ebayeup.pdns.cz antonio6532.pdns.cz daniel6536.pdns.cz 181.57.221.10:4450 181.57.221.10:4452 181.57.221.10:4851 # Reference: https://twitter.com/pancak3lullz/status/1009524847314194434 185.209.85.75:7921 # Reference: https://twitter.com/suyog41/status/1129322130078916608 # Reference: https://www.virustotal.com/gui/file/817e345ac4e63947b592e28774c71c4a01d7c0f2005324b028871e0dedd7c4ef/detection bego.hopto.org # Reference: https://twitter.com/HerbieZimmerman/status/1131977968950099968 185.244.31.137:6666 # Reference: https://twitter.com/James_inthe_box/status/1132292966062518272 manihackz.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1132294012100960257 amanihackz.ddns.net # Reference: https://twitter.com/ffforward/status/1133631211337912320 mgc2.hopto.org # Reference: https://twitter.com/dvk01uk/status/1133667461335801857 # Reference: https://app.any.run/tasks/5c919ea0-0f27-481a-af41-42057d090096/ 185.244.31.137:6767 # Reference: https://twitter.com/dvk01uk/status/1134014391249252357 # Reference: https://app.any.run/tasks/8d26c7f7-70bc-40c7-bfe2-b664d555054b/ 185.244.31.34:6868 # Reference: https://www.malware-traffic-analysis.net/2017/12/22/index.html darlz.freeddns.org 185.62.190.214:1695 # Reference: https://twitter.com/anyrun_app/status/1138078003815206912 # Reference: https://app.any.run/tasks/2aa81217-cd73-41af-901b-d578b5bbf041/ 13.250.1.111:1986 13.250.1.111:1992 194.67.209.128:1992 194.67.209.128:7707 216.38.8.168:1986 216.38.8.168:7707 # Reference: https://twitter.com/James_inthe_box/status/1139839056748011520 xcv87xcv7xc7sd5f67s5dxc67vxdsfwe342.publicvm.com # Reference: https://twitter.com/James_inthe_box/status/1139881993607380993 stainlessplc.ddns.net 184.75.209.163:6799 # Reference: https://twitter.com/dvk01uk/status/1141314328362176512 # Reference: https://app.any.run/tasks/8f80f415-a02e-451b-9797-96a3d03c793d/ 185.247.228.199:6868 # Reference: https://twitter.com/x42x5a/status/1142113259044179968 jaybaba2.bounceme.net # Reference: https://twitter.com/James_inthe_box/status/1142187271283548160 91.189.180.203:3480 # Reference: https://twitter.com/x42x5a/status/1142436174755192833 cemileorucs.ddns.net # Reference: https://twitter.com/DbgShell/status/1143669818652069894 vubhijk.duckdns.org # Reference: https://twitter.com/gorimpthon/status/1144186368483975168 # Reference: https://app.any.run/tasks/e5283183-af56-4628-bff3-b12572b43896/ 185.247.228.99:1998 terrymamela.ddns.net # Reference: https://twitter.com/reecdeep/status/1145646210398773249 # Reference: https://app.any.run/tasks/e89b3c70-50a6-421a-b639-299a918e147c/ jerryo.duckdns.org 185.247.228.236:8815 # Reference: https://pastebin.com/S4ggik78 du4alr0ute.sendsmtp.com # Reference: https://twitter.com/killamjr/status/1154121304213094401 talkmess.dns-cloud.net # Reference: https://twitter.com/Racco42/status/1157207083382652928 newrr.duckdns.org # Reference: https://twitter.com/Racco42/status/1157242080932089856 191.101.150.90:2950 # Reference: https://blog.talosintelligence.com/2019/08/threat-roundup-0726-0802.html (# Win.Malware.Remcos-7089920-1) abeasinf.duckdns.org remsalvados2019.duckdns.org # Reference: https://twitter.com/killamjr/status/1161983614197936128 185.244.31.32:2404 # Reference: https://twitter.com/James_inthe_box/status/1148692646942015488 # Reference: https://twitter.com/killamjr/status/1167454907676467201 # Reference: https://app.any.run/tasks/1c8c17b6-2628-4a06-8c2a-deb889e3e010/ 185.244.31.96:3090 top.subaroone.waw.pl # Reference: https://twitter.com/reecdeep/status/1163796233363906560 # Reference: https://app.any.run/tasks/e990631e-57b0-49db-b0b0-750dc33927dc/ 185.244.31.26:6265 safer.ddns.net # Reference: https://twitter.com/wwp96/status/1163788636036501504 evergraced.ddns.net # Reference: https://twitter.com/Paladin3161/status/1164517058672906241 daya4659.ddns.net # Reference: https://twitter.com/killamjr/status/1165459331912888320 # Reference: https://app.any.run/tasks/211498a3-95a8-44ee-a87b-25cdac3d8edc/ # Reference: https://www.virustotal.com/gui/file/6b32d6a32540884c3fb1a195b32b02aec9dd06797c464dee1c02bbb6ee97ffd1/detection # Reference: https://twitter.com/killamjr/status/1168575703656189952 # Reference: https://app.any.run/tasks/346f19a6-7cd8-4da7-b7ba-76651bc540f1/ 193.56.28.241:4444 193.56.28.241:8888 23.105.131.202:8888 crackme.hopto.org noface55.kozow.com # Reference: https://twitter.com/oguzpamuk/status/1166293812714659841 # Reference: https://app.any.run/tasks/d069fcb1-1c81-4f87-97bc-d4afb40a06e7/ # Reference: https://twitter.com/Racco42/status/1168449724724084737 193.56.28.173:2404 95.216.17.186:2404 23.105.131.169:2404 rownip.3utilities.com rownip.dyndnss.net rownip.theworkpc.com # Reference: https://twitter.com/ps66uk/status/1167016794260946944 # Reference: https://app.any.run/tasks/121e7cd1-6954-44be-a1b4-825c2615c11c/ # Reference: https://www.virustotal.com/gui/file/15b83a6155f1aba3acb68e4ecb475bb742790b82de364d1df4dd918a31f7872e/detection 79.134.225.48:3765 79.134.225.86:3765 79.134.225.87:3765 79.134.225.89:3765 remcoss.onmypc.org # Reference: https://twitter.com/de_aviation/status/1097547526763433985 du4alr0ute.sendsmtp.com helloweenhagga.ddns.net hhlari.ddns.net moneybag123.ddns.net revengerx111.sytes.net # Reference: https://twitter.com/malware_traffic/status/1169050682386763776 37.19.193.217:2404 37.19.193.217:2405 # Reference: https://twitter.com/KorbenD_Intel/status/1169996681259245569 charlesremcos.duckdns.org # Reference: https://twitter.com/wwp96/status/1170314034564018180 uaeoffice999.warzonedns.com # Reference: https://twitter.com/wwp96/status/1170332469960331266 66.154.113.142:2404 jkharding2014.myddns.rocks tomharry.ddns.net # Reference: https://twitter.com/wwp96/status/1170334923892371459 # Reference: https://app.any.run/tasks/e2340ee4-ba30-44ec-b748-1d625e65db63/ 79.134.225.77:2019 gratefulheart.ddns.net # Reference: https://twitter.com/wwp96/status/1171448440535973888 # Reference: https://app.any.run/tasks/fcbb836f-7ade-44f1-bbeb-9c7d9047fbe1/ 185.4.29.140:24009 inf111.ddns.net inf111.hopto.org # Reference: https://twitter.com/luc4m/status/1171783171677065217 charstiago6.dynu.net # Reference: https://twitter.com/DynamicAnalysis/status/1172221575376134144 79.134.225.105:3368 sub2.haircaresupertouch.waw.pl # Reference: https://twitter.com/dvk01uk/status/1176383495339483136 217.20.114.220:1010 myhousedubem.ddns.net # Reference: https://twitter.com/VK_Intel/status/1176933671389081601 79.134.225.101:1188 sciano.duckdns.org # Reference: https://twitter.com/Racco42/status/1179472593927200774 # Reference: https://twitter.com/Racco42/status/1179880257438003200 # Reference: https://www.virustotal.com/gui/ip-address/185.105.236.187/relations 185.105.236.187:5001 cepastr.ddns.net manafuuh.ddns.net teryts1802.sytes.net updatechrome.duckdns.org # Reference: https://twitter.com/VK_Intel/status/1179782506465366020 ulnews.duckdns.org # Reference: https://twitter.com/Dashowl/status/1179833764651962369 # Reference: https://app.any.run/tasks/e38aa085-4cc2-43e6-befe-0b4d5caeb0b6/ 204.152.219.70:5731 abundantgrace1.ddns.net # Reference: https://app.any.run/tasks/9bfe4193-bfea-4523-be81-68953435e7b7/ 181.215.247.18:2404 # Reference: https://twitter.com/MalwareConfig/status/1180886611602612224 # Reference: https://malwareconfig.com/config/daca573a51e9b080e2f3f6303611ee83 160.116.15.149:35364 henryofonyiri.ddns.net # Reference: https://twitter.com/killamjr/status/1180968029858910209 # Reference: https://app.any.run/tasks/f9985b06-08a9-41dd-b2d4-d051e02f8c08/ 137.116.73.45:2404 reneelauto.ddns.net # Reference: https://twitter.com/teoseller/status/1179318648718188545 # Reference: https://www.virustotal.com/gui/file/550baa07a33c62d24636d672c5a0973dbb1babc8ddc75e434d316ece595296f6/detection 185.81.157.41:2404 santzo.warzonedns.com # Reference: https://app.any.run/tasks/cb0e97af-6122-4181-87e5-842dedde0d77/ 178.239.21.116:1795 # Reference: https://app.any.run/tasks/7634c4dc-dee9-41e0-a2c0-32b4ef3d1885/ 213.184.126.134:1337 # Reference: https://twitter.com/P3pperP0tts/status/1181578274394251264 # Reference: https://www.hybrid-analysis.com/sample/47232b513efbd2c6fcd3dd1778aa00ca018710c8afd597d238ab1c94433747c4/5d9c9ed50288383e19febfe6 185.158.249.88:2404 # Reference: https://twitter.com/killamjr/status/1183421884794204160 # Reference: https://app.any.run/tasks/deed1a67-8d99-4e3c-9e87-5e63c39cb4c6/ top.intelprovidejordan.waw.pl # Reference: https://github.com/edchavarro/RAT_IoCs/blob/master/README.md (# Remcos section) 181.57.204.130:4452 46.246.82.66:2000 bolso.gucci12.cc celularmovil.huawei10.digital consola2.nintendo3.life consolajuego.nintendowii12.email telefonia.claromovil1.work tennis1.adidas3.tech # Reference: https://any.run/report/613f437f01744740c4e96d84c970c51128929fcdaa1a9d7e31a1ee063bf49f8e/3ae8d7b9-9a47-4ac4-b564-96510dc901d7 185.217.1.173:2404 algheithcompany.duckdns.org # Reference: https://twitter.com/smica83/status/1186542376355094529 91.189.180.214:7890 # Reference: https://twitter.com/killamjr/status/1188630140076658690 # Reference: https://app.any.run/tasks/a9de27e3-1bdc-43e9-8349-25bbe9c6cd90/ 192.169.69.25:8077 redditmercy.duckdns.org # Reference: https://twitter.com/James_inthe_box/status/1189251481943363586 # Reference: https://pastebin.com/H5UqcHv1 37.19.193.217:2398 toptoptop2.online toptoptop2.site toptoptop3.online toptoptop3.site # Reference: https://twitter.com/James_inthe_box/status/1189202165161529344 79.134.225.95:4050 79.134.225.95:6080 mnx.duckdns.org # Reference: https://twitter.com/w3ndige/status/1189301538142990339 # Reference: https://app.any.run/tasks/a8a4f079-0296-41fa-bcb0-546a54db9e56/ 109.202.103.170:8733 213.152.161.40:8733 213.152.162.89:8733 213.152.162.109:8733 # Reference: https://twitter.com/VK_Intel/status/1189602729498464257 # Reference: https://www.virustotal.com/gui/file/9235b1f5f9cc8efbf0ad96e4b48872a4043286fcdd182423746ed2e3700e1559/detection 79.134.225.20:2404 hobbotgy.duckdns.org # Reference: https://twitter.com/Paladin3161/status/1190072879242596352 # Reference: https://www.virustotal.com/gui/file/6e366fd065815118100c0a7fe8fa95208e87944b9dd4ce9df556c6d9f31151ec/detection menaxe.nsupdate.info # Reference: https://www.virustotal.com/gui/file/d23189d4520692301d6a013f60d59972fb61fd4bc3f011693411b20e9bdbd1e6/detection 185.244.31.85:4050 menaxe212.duckdns.org # Reference: https://www.virustotal.com/gui/file/6ddca5e1a4a9a4afd6663da5c05252d4150c8e271fbe28a81b3ae3af4cbca49c/detection 185.165.153.185:4050 # Reference: https://pastebin.com/29uSdMAk sub.thebest1jewels.waw.pl # Reference: https://pastebin.com/29uSdMAk # Reference: https://www.virustotal.com/gui/ip-address/79.134.225.29/relations 79.134.225.29:3018 bzsoftwaress.hopto.org faxjohn01.dyn.ddnss.de londonchap.duckdns.org samuelcity.ddns.net top.citycentrejo.waw.pl sub.winkcaffe.waw.pl # Reference: https://twitter.com/killamjr/status/1191192709727506438 79.134.225.73:2404 # Reference: https://app.any.run/tasks/508a6b73-18b4-490e-a1f3-69341ba72512/ 79.134.225.80:2404 clintonlog.hopto.org joseph3m.ddns.net # Reference: https://app.any.run/tasks/880d03b6-ed40-4688-a1ee-7f27e9873013/ 91.189.180.214:7890 # Reference: https://twitter.com/malwrhunterteam/status/1060836685771087873 35.237.81.215:1604 fuckerswashere.duckdns.org # Reference: https://twitter.com/wwp96/status/1191790897714913281 # Reference: https://app.any.run/tasks/4e587628-821c-42e9-ae52-ad84fd05ba85/ 91.193.75.51:4343 # Reference: https://blog.talosintelligence.com/2019/11/threat-roundup-1101-1108.html (# Win.Dropper.Remcos-7376444-0) # Reference: https://www.virustotal.com/gui/ip-address/179.33.152.127/relations msipro2019.duckdns.org # Reference: https://twitter.com/wwp96/status/1191486608249368581 # Reference: https://app.any.run/tasks/4ca60fe6-eb65-48eb-8f80-eb28e19ecfa4/ 79.134.225.11:5198 mpremx.duckdns.org # Reference: https://twitter.com/wwp96/status/1191443761563353089 # Reference: https://app.any.run/tasks/bd34ac22-9167-4ae5-a91f-e5600e21e72f/ 115.133.245.72:3908 115.133.245.72:4101 115.133.245.72:4421 ego9.ddns.net # Reference: https://twitter.com/JayTHL/status/1189778893298970624 # Rereference: https://www.virustotal.com/gui/file/1511d64209925c818d7db8eb1d0229e54debbea0d2a60bba094a05edd8d76a1d/detection # Reference: https://www.virustotal.com/gui/file/0634fc3acc43e1b3a357a28e4f0e20edac01ea07aa5de6e0373b8eb521bfd150/detection 194.5.97.96:22940 194.5.97.96:7493 lekwahouse.ddns.net pirorityclient.ddns.net # Reference: https://twitter.com/JayTHL/status/1189761540251103232 82.112.40.135:1604 # Reference: https://twitter.com/VK_Intel/status/1194260473631428608 # Reference: https://twitter.com/VK_Intel/status/1194338499085778944 # Reference: https://www.virustotal.com/gui/file/73cd4a5fd5d4670ecfa8d3e1d64055b76373e7730e0f7947ae850dbf2ee41549/detection 194.5.97.119:1000 nanoprivv.duckdns.org zotizieweb1.duckdns.org # Reference: https://twitter.com/wwp96/status/1196471158054494208 # Reference: https://app.any.run/tasks/66e92f07-3225-4d85-838f-cb3ccdbd90c8/ 79.134.225.99:4387 respainc.duckdns.org # Reference: https://twitter.com/wwp96/status/1196491717572222977 # Reference: https://app.any.run/tasks/594a9510-e48a-4dd5-89ea-73fe6929c225/ 185.140.53.168:5980 # Reference: https://www.virustotal.com/gui/file/db21285f8f62e182c6cb217073632a0c878c44e6b9d7dd2cf68df573391aa924/detection 154.16.93.170:8320 185.217.1.186:8320 217.79.184.12:8320 79.134.225.29:8320 faxjohn01.dyn.ddnss.de # Reference: https://app.any.run/tasks/c735b356-3ad6-47b2-8db9-4b820fba23ce/ pharmalobster.duckdns.org # Reference: https://app.any.run/tasks/1c7dc445-3d6f-4219-a2e1-afc99d3916a0/ rt.sexsweet.vip # Reference: https://www.virustotal.com/gui/ip-address/79.134.225.105/relations # Reference: https://www.virustotal.com/gui/file/331003b87d0c8194b40ca96740295c74a3695331e917a9d0511c62e6ffdd7e80/detection 79.134.225.105:3368 sub2.haircaresupertouch.waw.pl top1.supertouchhaircare.waw.pl # Reference: https://www.virustotal.com/gui/file/4a43fde440d91d130acd096114cfbe5e965100793f354297657d6595e2a4b941/detection electroking444.hopto.org # Reference: https://www.virustotal.com/gui/file/2478c6c90b6c4ecfc0a010b111bde48456898aba2946625784ecc083960f683a/detection electroking444.ddns.net # Reference: https://www.virustotal.com/gui/file/10c47670d9b565e7911364006e01fc545ef9b313bf5d230405f067b6a7795b50/detection 79.134.225.89:2501 # Reference: https://www.virustotal.com/gui/file/31022c5eb483f3b105050ab054e45541b206583996aec342b20fad359b1978ce/detection 199.195.250.222:6464 leebase.nsupdate.info # Reference: https://www.virustotal.com/gui/file/3692d98da1a9c209fe3f7789caa282a374eb39acde6d3b6690297773cd201c2a/detection 79.134.225.89:6464 filebase.duckdns.org # Reference: https://www.virustotal.com/gui/file/3121062c6478104325d7bdf59a08f9c416c2c8343ee4eb80829775c984a06310/detection 79.134.225.89:3369 fucktoto.duckdns.org # Reference: https://www.virustotal.com/gui/file/9e0d19b6ddfce89c11868bd8afdcfb53fa8d8c7c17623d25d04065aac411b521/detection 79.134.225.89:32002 work1234.duckdns.org # Reference: https://blog.talosintelligence.com/2019/11/threat-roundup-1115-1122.html (# Win.Dropper.Remcos-7395733-0) # Reference: https://www.virustotal.com/gui/ip-address/186.170.64.85/relations 186.170.64.85:2404 msipro2019.duckdns.org nashpink2019.duckdns.org proyectobasevirtualcol.com recuperaciondecartera.website # Reference: https://www.virustotal.com/gui/file/c382f97e5303ea6f171e7a1a1d1f305fa228dd368857d57035c70b7c1dbe4c2e/detection 186.170.64.85:6404 # Reference: https://www.virustotal.com/gui/file/c382f97e5303ea6f171e7a1a1d1f305fa228dd368857d57035c70b7c1dbe4c2e/detection 161.18.215.40:6404 179.33.63.205:6404 # Reference: https://www.virustotal.com/gui/file/ec3c174d36d5f8faa784d42a6972406d5ad258b770a308027a0bea1bb04a2fa3/detection 186.170.70.152:3370 # Reference: https://www.virustotal.com/gui/file/a0f495716cd691031cef9c3e92aa0c19f6f97a1179a60518797f1fdb5e1d82f7/detection 79.134.225.90:6553 # Reference: https://www.virustotal.com/gui/file/bb81e35d7d90e9d2a97408c256c4a498d85cfd36568e85b631766d34a9182b57/detection 79.134.225.90:2404 graceofgod.duckdns.org # Reference: https://www.virustotal.com/gui/file/9d22fa075c100254780f36d4ece00b40fad5cad6c5be21e15ed929c99680b904/detection 79.134.225.90:24197 registerme.warzonedns.com # Reference: https://www.virustotal.com/gui/file/646178cbc5b2452e1f3ee34500f039ab15f1f4d81533e1abc7db290fe43a10e7/detection 79.134.225.90:54985 1338099.ddns.net jaden222.kozow.com # Reference: https://www.virustotal.com/gui/file/eb712d5bb30e21cac53acdac476e526371534827486ad228c592facad084d220/detection 79.134.225.90:7331 7331.duckdns.org # Reference: https://www.virustotal.com/gui/file/04393c8b23e1742c3ca20a081739b7bb959274adc61f83158d0ef96ef575779e/detection 79.134.225.90:1720 jack2019.warzonedns.com # Reference: https://www.virustotal.com/gui/file/5689e69c5f46ab06f7b5b8d4aaaf235210ce6cf014fb3324c6d6c785ccb688c7/detection 79.134.225.90:5656 # Reference: https://www.virustotal.com/gui/file/330e409e8edbecfd1e3146c7dd09670e6d3364fb3f16ff0b2c129aea37b03e2f/detection 79.134.225.90:5001 teryts1802.sytes.net # Reference: https://www.virustotal.com/gui/file/83c8a487ae867ea10107a1a6a93a5c1b6b54744a384338e166317049a53f97ec/detection 79.134.225.90:5355 # Reference: https://www.virustotal.com/gui/file/8bbfa7a830568b039465d6abf3c517422c94d3abfe6455410a1437430a48e2de/detection 64.42.179.59:33089 sdkljsdf89237487428974wrewrwrereerwerw.linkpc.net # Reference: https://www.virustotal.com/gui/file/747cc60bf20b60daa1441457d74becb38f01564068d56e8eed000a1f9557d344/detection 199.249.230.22:33089 # Reference: https://www.virustotal.com/gui/file/da9f70611fc313108dfd69262954d2b926761528e20acda0593878ba0bd7a0ab/detection 198.203.28.43:33089 # Reference: https://www.virustotal.com/gui/file/60fc1a6f625150ec93ea5eb5cc91252542f15bd91dda6ea27d389b828a383061/detection 192.69.169.25:4864 abeasinf.duckdns.org # Reference: https://www.virustotal.com/gui/file/97571694c24fc14cfb658d7620d74c69ef42a78e2bad32ca047022b984edf922/detection 186.170.76.206:4864 # Reference: https://www.virustotal.com/gui/file/45f8ba1f2b1456f4192a0ac31b2788c18b957fdec9d94da8f3c3a581cf0e0591/detection 192.69.169.25:1626 wiskiriski15.duckdns.org # Reference: https://www.virustotal.com/gui/file/1daf168cc60d73346093932e5db44e055166da7e26c06e7fa7453ced43cffd42/detection 192.69.169.25:3864 pichicoyote.duckdns.org # Reference: https://www.virustotal.com/gui/file/060231c7729f65f39c1cc05fbe097d9c872dabd9391cc20eaf60c8d3c3cb0b5a/detection 79.134.225.80:3360 # Reference: https://www.virustotal.com/gui/file/e8a34e6e1db7c73ffea0618863c3d4ce31f3b32c4a16ec04b11460efb13a195e/detection 79.134.225.99:3360 # Reference: https://www.virustotal.com/gui/file/d96c1dc0ea3859660cd97e0f88b0cb0fab0a974ac0f07c7eadd45f48407a0224/detection 79.134.225.123:3360 79.134.225.125:3360 # Reference: https://www.virustotal.com/gui/file/1f6baac0b57ae8c9a3dfe83c6c4bf14ed0b00c785c333cfd905f3b403c036077/detection 79.134.225.122:3360 79.134.225.124:3360 # Reference: https://www.virustotal.com/gui/file/29bd4d55cb24fd04eabdc27eabcabe11f348ed1fc60b4c066af3be4c5eed869c/detection 185.165.153.113:3360 185.165.153.198:3360 # Reference: https://www.virustotal.com/gui/file/cc0f030f39bfc8c65c10bbcee2ce8679f313687dcce2ea8218e2a8fc8cd5c14d/detection 79.134.225.58:5609 remcus.chickenkiller.com # Reference: https://any.run/malware-trends/remcos (Note: as seen on 2019-12-04) ubananocore.ddns.net sandra.myddns.me prayersanswered.hopto.org gratefulheart.ddns.net 888rats.duckdns.org grafeulheart.ddns.net ijomsdavis1.ddns.net blessingfollowme.myddns.me slimyuyo.duckdns.org vemvemserver.duckdns.org 3forall2019.servesarcasm.com mozillamaintenanceservice.duckdns.org spenzmarine-56499.portmap.io fobeno-42652.portmap.io lololol-54262.portmap.io Theprohd-59801.portmap.io # Reference: https://pastebin.com/r5ZV1TCJ menaxe.nsupdate.info # Reference: https://twitter.com/wwp96/status/1203002510765707264 # Reference: https://app.any.run/tasks/30aa42c6-1bf5-4eed-84fc-099cc2f69404/ 174.127.99.167:8970 # Reference: https://pastebin.com/7Ak2nP2T reverse.spamassasins.icu top.multigamingjo.waw.pl # Reference: https://www.virustotal.com/gui/file/80120be87db5c64640fbd69a55cfd335601de08d5bcff393e66ff6f51c460850/detection 79.134.225.121:22940 # Reference: https://twitter.com/smica83/status/1205000837430468608 top.phonefix1.waw.pl # Reference: https://twitter.com/Paladin3161/status/1197842954037018625 192.169.69.25:1116 ashawo.duckdns.org wecollect11.duckdns.org # Reference: https://www.virustotal.com/gui/file/3e444ad341b93f3150b1eae401b84c1b8afd73a80345b4b328bd26c9e5dc5d66/detection 185.148.241.48:1115 # Reference: https://www.virustotal.com/gui/file/a22ede52f14be480dd478fa0ec955b807e4b91a14fbe1b5d46c07bbb5cacccbb/detection 185.244.30.116:1116 # Reference: https://www.virustotal.com/gui/file/53a20bb94b5f34076b98b161b786e24a3fe4c1d3ba36892a901f0709461d096e/detection 185.244.30.116:2444 proudsoldier.duckdns.org # Reference: https://www.virustotal.com/gui/file/bf16f2332e28ac589939efd41ce77fafeed6c9f8b20661f55a0e1264c78bebd0/detection 91.193.75.49:1116 # Reference: https://www.virustotal.com/gui/file/efda9ecdddba583c653b76dbc825daaba070e16d4e6be3f6439278c6c023450a/detection 185.165.153.231:2404 # Reference: https://twitter.com/ActorExpose/status/1196103594845593600 # Reference: https://app.any.run/tasks/4be5595d-4651-40ae-b24d-917a47b26fbb/ 79.134.225.46:1960 mgc1.duckdns.org # Reference: https://twitter.com/coderippers/status/1194935759775641600 185.165.153.186:5132 91.193.75.51:3434 # Reference: https://twitter.com/Paladin3161/status/1194813271494148096 192.169.69.25:100 jamesremcos.duckdns.org savagesquad.ooguy.com # Reference: https://www.virustotal.com/gui/file/a8c80446c78199908f9187795627a6111e765b7abf20662cd0f1762ba80abaa1/detection 185.165.153.27:100 # Reference: https://app.any.run/tasks/4e587628-821c-42e9-ae52-ad84fd05ba85/ # Reference: https://www.virustotal.com/gui/file/9b4585e342acf00e8d7c0f0b215af2f74ce1a0b428583c30868dbc616d87e1dd/detection srvc50.turhost.com # Reference: https://www.virustotal.com/gui/file/1efc346c6761b933adc7a10ab7e6da5e6c65369b5b90f3ddd528ce2bcc3116ab/detection 91.193.75.51:4343 # Reference: https://research.checkpoint.com/2019/decypherit-all-eggs-in-one-basket/ rmagent.biz # Reference: https://www.virustotal.com/gui/file/8003d7af85e3d328eb0c789e32bba3de456523c109847eca2ace5ae0252c1ee2/detection 185.165.153.22:2211 # Reference: https://www.virustotal.com/gui/file/04455422ee74836e38315b4ac9740470c963e45d5cf61fb3927f02ed9be4d995/detection 185.165.153.22:11011 # Reference: https://www.virustotal.com/gui/file/606aee9e6f0ec6e51dd94cda76b4978392bf5c7f505e049fbd936e7b97928387/detection 185.165.153.22:3330 # Reference: https://www.virustotal.com/gui/file/9fe933614e864926edb99dd6a6c1df31e3db0f74fb8c0d622ef73fd1c6e14104/detection 91.192.100.37:23850 # Reference: https://www.virustotal.com/gui/file/444a412bebf61392e5368bd1464f5773024d1c8758626cd7c5f061ba7688403a/detection 88.172.243.236:23850 # Reference: https://www.virustotal.com/gui/file/d2ddf0997db4b87a354abacba8f0b22f5923eeff7f01bcf3e2bae535160c579a/detection 79.134.225.122:23850 79.134.225.122:3366 # Reference: https://www.virustotal.com/gui/file/bd6220c705c6f321f59d1f45eea1e13c5171f7a2061dec9f907ffa291f3b9ec1/detection 79.134.225.122:2404 # Reference: https://www.virustotal.com/gui/file/c176c510cdc4c587528c7b3fd414ff373f966e669243ade0f76bc674e8053a9f/detection 23.105.131.156:2404 # Reference: https://www.virustotal.com/gui/file/abb4c76901b644cb756fe3727d3933d6a614d0709b62c78c9c54f2dd3ba6aea0/detection 192.253.246.140:23850 # Reference: https://otx.alienvault.com/pulse/5c4543d7fa493a3bac56ae13 jaxboss.publicvm.com # Reference: https://www.virustotal.com/gui/file/fffb52d51e9688cc08c2a2ad0d818528174eda3e9738c7df8d009301bd127419/detection 173.242.125.75:7241 mysit.space # Reference: https://www.virustotal.com/gui/file/8e99fca6285e318095ad693fa35b922f88743bf7743a1a8316eb0138fb771e2c/detection 185.82.202.149:7241 uploadtops.is # Reference: https://www.virustotal.com/gui/file/a0dd3cf4f046432c109448c53687a0cf06cdc1d287fda725c7c15397dab984f0/detection 66.85.185.105:7241 # Reference: https://www.virustotal.com/gui/file/6caecb1c499dfb5b9a00c1eed46b7c6b223893f5a95a10dbb7dc41515a132c7e/detection 66.85.185.105:1427 # Reference: https://twitter.com/DynamicAnalysis/status/1205555781095108608 79.134.225.99:2018 # Reference: https://www.virustotal.com/gui/file/8c49d633a12c6ea14ac72e58de6c9f7ba239403f21cc25c6f1ae867b5df29b36/detection 41.203.78.140:2888 41.203.78.93:2888 # Reference: https://twitter.com/wwp96/status/1210224614149939200 185.140.53.26:2404 michaelking102.hopto.org michaelking102.loseyourip.com rennelautos.zapto.org sunwap878.ddns.net sunwap878.dynu.net # Reference: https://app.any.run/tasks/8541d798-8243-46a8-8631-f54e6ed5d19e/ redsocial.instagram21.best # Reference: https://twitter.com/James_inthe_box/status/1211999781721006081 # Reference: https://www.virustotal.com/gui/file/a05be2b7d477cf006794c746d241b4dad0a392f59d19238f17bc7128418108f2/detection # Reference: https://www.virustotal.com/gui/file/76b700b072fd5820e296c1fd9a62f2a63c8c6715e778ad32213cdfcae5bae878/detection 108.62.12.134:4922 nolim.duckdns.org # Reference: https://www.virustotal.com/gui/file/472aa23054d16bcf70e18d254613161d80cb345229aafca5e0b103e0afb65271/detection aprsgkpc-51401.portmap.host # Reference: https://www.virustotal.com/gui/file/51ba982bff7c5afbb35f5ce500570bf94aacda560e649e32fa9445155a31994c/detection 193.161.193.99:54120 # Reference: https://www.virustotal.com/gui/file/7a7060976e2908d0202c7c318be3226718cc324db2976e5423eb71b3851bad31/detection tunedd30.duckdns.org # Reference: https://www.virustotal.com/gui/file/e4f477f955ae23cb599858715626e86d3c5a8869d7cfd340af87147e2e7c9818/detection 178.124.140.136:6640 # Reference: https://www.virustotal.com/gui/file/28842367cd70d14f0776b246cb821275ff817051813b3ad4090eb412496d319c/detection 178.124.140.136:1284 dfrannk.hopto.org # Reference: https://www.virustotal.com/gui/file/63e1f393cbd4bfe5c8e431af3de70b382482ed3e11b967db8caccf4c38ada733/detection expertyline.mooo.com # Reference: https://www.virustotal.com/gui/file/4c407408ea383edc394a84baed80b6991581a5df5d9cbcb818f83dfc1c6b4317/detection ddfranks.ddns.net # Reference: https://www.virustotal.com/gui/file/eb91f6ed14de853b1d987e199eaede7005c4cf6671321315d22e4626677bfb7c/detection 178.124.140.136:1515 # Reference: https://www.virustotal.com/gui/file/72b74037adf3cf0cf6e9ead907f565d4976b0ed15a8b62e2c8a8cde28a09867b/detection 178.124.140.136:2033 blessederic.ddns.net # Reference: https://www.virustotal.com/gui/file/978b349faa2c6e8894897bb1cc54d1f92ca9613af0078528fab4f10466c2667b/detection 178.124.140.136:2669 dfranki.ddns.net # Reference: https://www.virustotal.com/gui/file/b57e631645446ad3744528b05f961ea2c4cb23f426f0a6a6dea8203786c9e528/detection 178.124.140.136:3333 menorte.ddns.net # Reference: https://www.virustotal.com/gui/file/2bd9dd47981f11b696c2ad7c6b11723da0f091c658210799e2fdd1efd326172a/detection 104.244.75.220:9300 # Reference: https://www.virustotal.com/gui/file/26d109f07bff6ad6142cc1e2c455849a3f641ac43660372686aad7381527fe00/detection 103.136.43.131:7368 104.244.75.220:7368 105.112.99.44:7368 194.5.98.25:7368 sam555.ddns.net # Reference: https://www.virustotal.com/gui/file/48fafbbccc345ad4f5b9d525107cd139bde73ec2b4eb54432336bf6450943a5f/detection 91.193.75.49:2016 91.193.75.49:3001 proud.duckdns.org # Reference: https://www.virustotal.com/gui/file/bf76c5ca49445e8aacb161337d1d333cf481c4ea7eaecfd2c2a3170e70a69ce7/detection 91.193.75.49:3111 # Reference: https://www.virustotal.com/gui/file/7618cd1e9e2ca86f97552e1c3584f418ffd17141832c913021b5c3694914106d/detection 79.134.225.97:54985 tools4money1.duckdns.org # Reference: https://www.virustotal.com/gui/file/254a0ac154ebc83d9838fb52af5dc8118cfc31d81571cfdac3d3bf4f75be5d6a/detection remcos.got-game.org # Reference: https://www.virustotal.com/gui/file/f9aae3f8af4a70b5634a9ec9f069ac3458ff6835547107e42955fa12c5a2cf8a/detection 91.193.75.66:3039 # Reference: https://www.virustotal.com/gui/file/223e21cb4169999a2086cbcb4d56013d151b81745a541f300ffbbfd838c1a8f5/detection 79.134.225.72:4564 ebuxxxxx.duckdns.org # Reference: https://www.virustotal.com/gui/file/8889736c0a30eb477236a624f55e66d38f52025db003cf7fe621fd084109db5e/detection 79.134.225.72:7676 # Reference: https://www.virustotal.com/gui/file/166e944c81082a59ffbf8cf5a2ae228913dc8656990d71238ad2db19cd2221b5/detection top.pubgstores1.waw.pl # Reference: https://www.virustotal.com/gui/file/5ee090b3c5b98a33e60f2a3eeb6f8429ffabc5ac0ea932e373c6a383cfce5289/detection smart0147.ddns.net # Reference: https://www.virustotal.com/gui/file/2170aa91350c123fa9a2319492afbd73c2b5fbe29a84c001efd545980c330856/detection 79.134.225.73:6569 passwrdboss.duckdns.org # Reference: https://www.virustotal.com/gui/file/e4538221d4740b28f2aa439fddfba69448a2751a0a4f78b54145ddd7ef7d6992/detection 79.134.225.73:18943 cashoutmoney.ddns.net # Reference: https://www.virustotal.com/gui/domain/top.fishingjoco.waw.pl/relations top.fishingjoco.waw.pl # Reference: https://www.virustotal.com/gui/file/72e6c5ce4b7844eee3a6b293f54aeedd38d572bd5ff7c3609507030da46041fe/detection 185.158.139.238:9334 # Reference: https://www.virustotal.com/gui/file/cbf1a3f24d6fb4c163cdc540dc6df98779b16e491017c9534c58a9f23df47941/detection 185.140.53.93:9334 # Reference: https://www.virustotal.com/gui/file/38de8ff2bdcad25f923d0d22138c23541991c3f96095a0ee22de5e1849f3f20e/detection 185.140.53.59:9334 # Reference: https://www.virustotal.com/gui/file/ad74423af971f9d55f4fb2ca010f6dc81ef98a6dd36fd18b833c2623d17eb913/detection 185.140.53.192:9334 # Reference: https://www.virustotal.com/gui/file/d99ac8879353bd8cbc3ca502cdc6cf5581652f1a26f7de6337644758d6370e16/detection 185.140.53.107:8787 185.140.53.107:9334 # Reference: https://www.virustotal.com/gui/file/0bca93258e81977fd667e4ceab83f2e3460dd5fa5d5f4e88549bd4bfad20ee12/detection 185.140.53.52:9334 # Reference: https://www.virustotal.com/gui/file/c7b6e9095074b013ff9e5f9f1b3a7a15493b8b4f099deda31f2cffc308cdfa61/detection 185.140.53.26:5200 185.140.53.26:8153 185.140.53.26:8787 185.140.53.26:9334 # Reference: https://www.virustotal.com/gui/file/63f7dcd1893c84eae20fe494fd9d0bda10dd809ead94eb4d2c271d25208fc992/detection 185.140.53.222:5200 185.140.53.222:8153 185.140.53.222:8787 185.140.53.222:9334 185.140.53.52:5200 185.140.53.52:8153 185.140.53.52:8787 # Reference: https://www.virustotal.com/gui/file/8fdf5d5c5cf41f4f80a563d12f07d6f59bdeed91028eaa888a982a45df76bd09/detection 185.140.53.115:9334 # Reference: https://www.virustotal.com/gui/file/44558aeedee27b83942c4e33a0c0f060035f2ef4beaf66af23f719f121934194/detection 185.140.53.94:9334 # Reference: https://www.virustotal.com/gui/file/f5a7efd0ffb5145945fed2f92b2df8a79847085547333ec841e3e0b1fc5e1133/detection 185.140.53.50:5200 185.140.53.50:8153 185.140.53.50:8787 185.140.53.50:9334 185.140.53.149:9334 # Reference: https://www.virustotal.com/gui/file/4d51a099cfcab43ebfdaef8d4bc8bd0560c933c665cb6ca353f63d2d97bb2f18/detection 185.140.53.91:9334 # Reference: https://www.virustotal.com/gui/file/225c850cfd1f040c9b7f3513eb77aa5830a4b37b9cb1a516cd128e7841429537/detection 185.140.53.162:8787 185.140.53.162:9334 # Reference: https://www.virustotal.com/gui/file/49e01999814d095689ceda6247ccaea14bcd21d0267e8705b393de930e883667/detection 185.140.53.114:8787 185.140.53.114:9334 # Reference: https://www.virustotal.com/gui/file/cbe362033ba85e20d7b86bc9108c1d1db1786febfbf0b99258e755ac8b6297b2/detection 185.140.53.194:8787 185.140.53.194:9334 # Reference: https://www.virustotal.com/gui/file/27d2f7b50dc11a146fd7d950a1d3eec3031882b970463b7b685b516849071fe1/detection 185.140.53.232:9334 185.247.228.103:9334 # Reference: https://www.virustotal.com/gui/file/d4487b370ba2645516192a1461cb25ed3d11d02e4d0fdce3025269ca7d63aefa/detection 185.247.228.251:8153 185.247.228.251:8787 185.247.228.251:9334 # Reference: https://www.virustotal.com/gui/file/c68b820b65097d851e33a977e562fd51d12d852613b43caba3b325dd74b0e618/detection 185.140.53.96:8787 185.140.53.96:9334 185.247.228.103:8787 23.105.131.142:8787 23.105.131.142:9334 # Reference: https://www.virustotal.com/gui/file/b4f87be6ab41d1216a36822bf791212e29eb07c469059571d916221f0508ef97/detection 185.140.53.208:5200 185.140.53.208:8153 185.140.53.208:8787 185.140.53.208:9334 79.134.225.10:9334 # Reference: https://www.virustotal.com/gui/file/a246556f34f23f1e8c67a4aadda22bd03324521aadf4526b0db5f696b6761d35/detection 23.105.131.216:9334 # Reference: https://www.virustotal.com/gui/file/eae3e753b4461e78f7f0206f2d3434f9ced9c302ec509e952e69332b2be73ee4/detection sub.jofishingco.waw.pl # Reference: https://www.virustotal.com/gui/file/cfc1e1ff16319b95761d4b4b950bd46e7c7b8cab339cbf556b21fa56cc7f069a/detection 23.105.131.216:5200 23.105.131.216:8153 23.105.131.216:8787 173.254.195.173:5200 173.254.195.173:8153 173.254.195.173:8787 173.254.195.173:9334 # Reference: https://www.virustotal.com/gui/file/590fac000e2f4cbe9a27520e6cf3223e045bc3386633c25088e55439679150f7/detection 173.254.223.68:5200 173.254.223.68:8153 173.254.223.68:8787 173.254.223.68:9334 91.193.75.128:8787 91.193.75.128:9334 98.143.144.221:9334 98.143.144.243:5200 98.143.144.243:8153 98.143.144.243:8787 98.143.144.243:9334 # Reference: https://www.virustotal.com/gui/file/9f945ca391310fb2880045f5bd60393d62b2a0c65f06aa57396d9bcb313128a7/detection 173.254.195.172:8152 173.254.195.172:8153 173.254.195.172:9334 173.254.223.121:8152 173.254.223.121:8153 173.254.223.68:8152 173.254.223.74:9334 204.152.219.119:8152 204.152.219.119:8153 204.152.219.119:9334 # Reference: https://www.virustotal.com/gui/file/96158e53f76c37ba6590d80f10bbc5009bdc758d388d456274fb065a5ce8f325/detection 173.254.195.173:8152 173.254.195.173:8153 173.254.195.173:9334 173.254.223.110:8152 173.254.223.110:8153 173.254.223.110:9334 185.140.53.236:8152 185.140.53.236:8153 185.140.53.236:9334 73.0.71.4:8152 73.0.71.4:9334 98.143.144.217:8152 98.143.144.217:8153 98.143.144.217:9334 98.143.144.243:8152 98.203.61.135:8152 98.203.61.135:9334 # Reference: https://www.virustotal.com/gui/file/5cac3d994fcc5eefdaef9ffd6b9fae41dd49f1a699e88746e17fb51a49f73bd2/detection 204.152.219.90:8152 204.152.219.90:8153 204.152.219.90:9334 91.193.75.126:8152 91.193.75.126:8153 91.193.75.126:9334 91.193.75.220:8152 91.193.75.220:8153 91.193.75.220:9334 91.193.75.128:8152 91.193.75.128:8153 # Reference: https://www.virustotal.com/gui/file/a26302049b7fbfa6d107b726717cc1a29c7b1dc04d3ad07b6a2f56fd3ca9cd1d/detection 185.247.228.103:5200 185.247.228.103:8153 173.254.223.110:5200 173.254.223.110:8787 73.0.71.4:8787 98.203.61.135:8787 91.193.75.126:8787 # Reference: https://www.virustotal.com/gui/file/0c92e3f679873eae4f540f6f62d29bd80abd6bdc7267221c5a0ba1f82c9e90f7/detection 185.140.53.213:8152 185.140.53.213:8153 185.140.53.213:9334 91.193.75.232:8152 91.193.75.232:8153 91.193.75.232:9334 91.193.75.238:8152 91.193.75.238:8153 91.193.75.238:9334 91.193.75.97:8152 91.193.75.97:8153 91.193.75.97:9334 98.143.144.211:8153 98.143.144.211:9334 # Reference: https://www.virustotal.com/gui/file/4b5c755f37994c6474cabd023f83ec8d58ff7f875d25fb788ec9770383833af5/detection 173.254.223.124:8152 173.254.223.124:8153 173.254.223.124:9334 204.152.219.93:8152 204.152.219.93:8153 204.152.219.93:9334 # Reference: https://www.virustotal.com/gui/file/1053aed27e83dc8f682739c0d1716060b1fa525d3a8cef7fb066e8103a3fe50b/detection 91.193.75.107:9334 # Reference: https://www.virustotal.com/gui/file/82889980e77fab696835eb230b3d3b04ade235e7a2442f267bfeae32dcb189f0/detection 173.254.223.121:9334 173.254.223.92:8152 173.254.223.92:8153 173.254.223.92:9334 98.143.144.207:8152 98.143.144.207:8153 98.143.144.207:9334 # Reference: https://www.virustotal.com/gui/file/925e39df3d71d49ed7c31790de157fd50e6bfc7eed6d151fa0c89760b059937e/detection 204.152.219.94:8152 204.152.219.94:8153 204.152.219.94:9334 # Reference: https://www.virustotal.com/gui/file/daaa67b875f56060c05fae1fa635f9a30786054b3efb9c3ef82204b30f6dd7fe/detection 185.140.53.137:9334 # Reference: https://twitter.com/wwp96/status/1214559701280722945 # Reference: https://app.any.run/tasks/fa298bab-4c01-4269-93af-1808d94595fd/ jessene.ddns.net rennelautos.kozow.com # Reference: https://app.any.run/tasks/ef3a8b4d-0d5b-4f7a-a187-336b1327884c/ successfulghost.duckdns.org 185.244.30.35:2009 # Reference: https://twitter.com/wwp96/status/1214925176632225799 # Reference: https://app.any.run/tasks/1ad4f2da-7513-4d09-bd27-f6cf3327b489/ 209.127.18.228:2424 roboscchi.duckdns.org # Reference: https://twitter.com/killamjr/status/1216571369892139008 # Reference: https://app.any.run/tasks/a58e0909-6db7-4a3e-961d-02dcb6800803/ 161.117.86.44:2500 88.198.205.179:2500 devicenet.org devicenet1.org devicenet2.org devicenet3.org devicenet4.org devicenet5.org # Reference: https://www.virustotal.com/gui/file/3bcfb4fec5c49609ce2e1688f24ae874728e9fd53a1769673d2ad3ac0c5554aa/detection 174.127.99.211:9493 vision2020.ddns.net # Reference: https://www.virustotal.com/gui/file/0c2912541176b553f2d4595ea338f88bc8d6110ac43cb892cf86dd06ca49307c/detection 41.242.137.4:9493 41.242.138.53:9493 # Reference: https://www.virustotal.com/gui/file/6e5a7c74c609d6363a56cca712900ec5ab4ffa4e22c0307adf9b30f56b7eb218/detection 185.244.31.31:9493 # Reference: https://www.virustotal.com/gui/file/972cd696927d9d1804566fe6a610a67ca4f9a1bd631769ba7a2d3b06f8413497/detection 79.134.225.104:1871 umc621.myftp.biz # Reference: https://twitter.com/DynamicAnalysis/status/1217873533310816257 # Reference: https://app.any.run/tasks/a948d44d-9d3b-4675-8c4f-6ec951a9346a/ 79.134.225.36:2121 79.134.225.98:2030 srvr1.serverpubg1.pw srvr2.serverpubg3.pw