# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Aliases: korat, lsslogger, remcos # Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Remcos-G/detailed-analysis.aspx remcos.legacyrealestateadvisors.net remcos2.legacyrealestateadvisors.net # Reference: https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html dboynyz.pdns.cz streetz.club mdformo.ddns.net mdformo1.ddns.net vitlop.ddns.net ns1.madeinserverwick.club uploadtops.is prince.jumpingcrab.com timmason2.com lenovoscanner.duckdns.org lenovoscannertwo.duckdns.org lenovoscannerone.duckdns.org google.airdns.org civita2.no-ip.biz pimmas.com.tr mervinsaat.com.tr samurmakina.com.tr paulocamarao.com midatacreditoexperian.com.co lebontour.com businesslisting.igg.biz unifscon.com # Reference: https://twitter.com/MaelSecurity/status/1036551872008605696 test200.dynu.net # Reference: https://twitter.com/ps66uk/status/1040576968750706689 # Reference: https://www.virustotal.com/#/ip-address/185.163.100.45 gclarke77.gotdns.ch gclarke7.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1040620171692466176 yvonne.ddns.net # Reference: https://twitter.com/avman1995/status/1040472512356855808 top.taijh.xyz # Reference: https://twitter.com/Racco42/status/1040154199592509440 auxlorenagomez.ddns.net # Reference: https://twitter.com/luc4m/status/1021670673247285248 worldwide.weldwire.top # Reference: https://twitter.com/luc4m/status/1019948492947709953 gatewayglobal.strangled.net # Reference: https://twitter.com/James_inthe_box/status/1018792273574678528 http://185.62.190.232 # Reference: https://twitter.com/ps66uk/status/1046900765493739520 menaxe.duckdns.org # Reference: https://www.cyren.com/blog/articles/fake-invoice-carries-rescoms-malware-targeting-businesses-globally infocolornido.publicvm.com # Reference: https://twitter.com/ScumBots/status/1051360120834265088 satan969.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1044204804354957312 ddns.njegidi888.xyz # Reference: https://twitter.com/Racco42/status/1027883312252108800 2419.damnserver.com 2419.duckdns.org 2419.geekgalaxy.com 2419.health-carereform.com 2419.pgafan.net # Reference: https://twitter.com/Jan0fficial/status/986580332135829506 remrem.onmypc.net # Reference: https://twitter.com/Jan0fficial/status/975661898363559937 emilylatta411.servehttp.com # Reference: https://twitter.com/James_inthe_box/status/939146342357536768/photo/1 gemalto788.ddns.net # Reference: https://twitter.com/Racco42/status/1054384363524235264 eskimoz.duckdns.org # Reference: https://twitter.com/ScumBots/status/1102437794025295872 112.204.228.252:2323 # Reference: https://www.cert-pa.it/notizie/analisi-del-malware-remcos-veicolato-tramite-packer-delphi/ pekniecza.hopto.org # Reference: https://twitter.com/dvk01uk/status/1108949343074054144 # Reference: https://app.any.run/tasks/5e5404b2-4018-4da4-a6a3-19465fa7cc9c 185.244.29.73:6767 # Reference: https://twitter.com/malwrhunterteam/status/1111352801693782016 castelfable.duckdns.org # Reference: https://twitter.com/malwrhunterteam/status/1104327117309968384 infosblogwar.duckdns.org # Reference: https://twitter.com/James_inthe_box/status/1098553609375993856 194.68.59.41:1956 # Reference: https://twitter.com/pollo290987/status/1083401581670875136 194.5.98.173:7081 # Reference: https://twitter.com/ps66uk/status/1062514051165704192 argonsa.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1060547624418168839 cjmoney.duckdns.org # Reference: https://twitter.com/ps66uk/status/1049011930411794432 185.148.241.58:2442 # Reference: https://twitter.com/FewAtoms/status/1104355364391305216 196.127.74.118:2402 # Reference: https://twitter.com/Racco42/status/1088469487387664384 utchmann.bounceme.net # Reference: https://twitter.com/pancak3lullz/status/1075888625261387777 info1.duckdns.org 185.244.30.126:5552 # Reference: https://twitter.com/James_inthe_box/status/1063118942095331328 449ers.ddns.net # Reference: https://twitter.com/Jan0fficial/status/986580332135829506 remrem.onmypc.net # Reference: https://twitter.com/Jan0fficial/status/975661898363559937 emilylatta411.servehttp.com # Reference: https://twitter.com/ViriBack/status/971430374919122944 top.carolp1.xyz 185.62.189.72:1992 # Reference: https://twitter.com/pollo290987/status/963073970542129152 jerryemperror2.punkdns.top # Reference: https://twitter.com/avman1995/status/960419643704913920 obereagu.ddns.net # Reference: https://twitter.com/Antelox/status/884773449520095232 178.73.210.233:100 # Reference: https://twitter.com/makflwana/status/1104376804293263360 # Reference: https://app.any.run/tasks/8149d283-b550-4b31-9adf-4b4c85962e7d juanbouyant.ddns.net # Reference: https://twitter.com/x42x5a/status/1114133426708340736 prueba00223.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1115258819473317888 triggerd.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1121754056517537792 winsec.ddns.net 46.246.86.67:2606 # Reference: https://twitter.com/dvk01uk/status/1123210727483957248 # Reference: https://app.any.run/tasks/0e57a079-57d4-4c2d-8e01-82d316ac2d55 ablegod.hopto.org 79.134.225.6:6691 # Reference: https://github.com/edchavarro/RAT_IoCs lacoste587.lacoste587.agency dsquared21.dsquared21.rocks hugoboss01.hugoboss01.store luisvuitton.luisvuitton.tech supreme12.supreme12.recipes automovil1.peugeot10.cc comida2.kfc52.club auto14.wolsvagen7.mobi telefonia1.telcel75.asia consola2.nintendo3.life microsofteup.pdns.cz lexusempresa.100chickens.me mojarracompany.pdns.cz camilo6541.pdns.cz balvinnew.100chickens.me mercadolibre.pdns.cz ebayeup.pdns.cz antonio6532.pdns.cz daniel6536.pdns.cz 181.57.221.10:4450 181.57.221.10:4452 181.57.221.10:4851 # Reference: https://twitter.com/pancak3lullz/status/1009524847314194434 185.209.85.75:7921 # Reference: https://twitter.com/suyog41/status/1129322130078916608 # Reference: https://www.virustotal.com/gui/file/817e345ac4e63947b592e28774c71c4a01d7c0f2005324b028871e0dedd7c4ef/detection bego.hopto.org # Reference: https://twitter.com/HerbieZimmerman/status/1131977968950099968 185.244.31.137:6666 # Reference: https://twitter.com/James_inthe_box/status/1132292966062518272 manihackz.ddns.net # Reference: https://twitter.com/James_inthe_box/status/1132294012100960257 amanihackz.ddns.net # Reference: https://twitter.com/ffforward/status/1133631211337912320 mgc2.hopto.org # Reference: https://twitter.com/dvk01uk/status/1133667461335801857 # Reference: https://app.any.run/tasks/5c919ea0-0f27-481a-af41-42057d090096/ 185.244.31.137:6767 # Reference: https://twitter.com/dvk01uk/status/1134014391249252357 # Reference: https://app.any.run/tasks/8d26c7f7-70bc-40c7-bfe2-b664d555054b/ 185.244.31.34:6868 # Reference: https://www.malware-traffic-analysis.net/2017/12/22/index.html darlz.freeddns.org 185.62.190.214:1695 # Reference: https://twitter.com/anyrun_app/status/1138078003815206912 # Reference: https://app.any.run/tasks/2aa81217-cd73-41af-901b-d578b5bbf041/ 13.250.1.111:1986 13.250.1.111:1992 194.67.209.128:1992 194.67.209.128:7707 216.38.8.168:1986 216.38.8.168:7707 # Reference: https://twitter.com/James_inthe_box/status/1139839056748011520 xcv87xcv7xc7sd5f67s5dxc67vxdsfwe342.publicvm.com # Reference: https://twitter.com/James_inthe_box/status/1139881993607380993 stainlessplc.ddns.net 184.75.209.163:6799 # Reference: https://twitter.com/dvk01uk/status/1141314328362176512 # Reference: https://app.any.run/tasks/8f80f415-a02e-451b-9797-96a3d03c793d/ 185.247.228.199:6868 # Reference: https://twitter.com/x42x5a/status/1142113259044179968 jaybaba2.bounceme.net # Reference: https://twitter.com/James_inthe_box/status/1142187271283548160 91.189.180.203:3480 # Reference: https://twitter.com/x42x5a/status/1142436174755192833 cemileorucs.ddns.net # Reference: https://twitter.com/DbgShell/status/1143669818652069894 vubhijk.duckdns.org # Reference: https://twitter.com/gorimpthon/status/1144186368483975168 # Reference: https://app.any.run/tasks/e5283183-af56-4628-bff3-b12572b43896/ 185.247.228.99:1998 terrymamela.ddns.net # Reference: https://twitter.com/reecdeep/status/1145646210398773249 # Reference: https://app.any.run/tasks/e89b3c70-50a6-421a-b639-299a918e147c/ jerryo.duckdns.org 185.247.228.236:8815 # Reference: https://pastebin.com/S4ggik78 du4alr0ute.sendsmtp.com # Reference: https://twitter.com/killamjr/status/1154121304213094401 talkmess.dns-cloud.net # Reference: https://twitter.com/Racco42/status/1157207083382652928 newrr.duckdns.org # Reference: https://twitter.com/Racco42/status/1157242080932089856 191.101.150.90:2950 # Reference: https://blog.talosintelligence.com/2019/08/threat-roundup-0726-0802.html (# Win.Malware.Remcos-7089920-1) abeasinf.duckdns.org remsalvados2019.duckdns.org # Reference: https://twitter.com/killamjr/status/1161983614197936128 185.244.31.32:2404 # Reference: https://twitter.com/James_inthe_box/status/1148692646942015488 # Reference: https://twitter.com/killamjr/status/1167454907676467201 # Reference: https://app.any.run/tasks/1c8c17b6-2628-4a06-8c2a-deb889e3e010/ 185.244.31.96:3090 top.subaroone.waw.pl # Reference: https://twitter.com/reecdeep/status/1163796233363906560 # Reference: https://app.any.run/tasks/e990631e-57b0-49db-b0b0-750dc33927dc/ 185.244.31.26:6265 safer.ddns.net # Reference: https://twitter.com/wwp96/status/1163788636036501504 evergraced.ddns.net # Reference: https://twitter.com/Paladin3161/status/1164517058672906241 daya4659.ddns.net # Reference: https://twitter.com/killamjr/status/1165459331912888320 # Reference: https://app.any.run/tasks/211498a3-95a8-44ee-a87b-25cdac3d8edc/ # Reference: https://www.virustotal.com/gui/file/6b32d6a32540884c3fb1a195b32b02aec9dd06797c464dee1c02bbb6ee97ffd1/detection # Reference: https://twitter.com/killamjr/status/1168575703656189952 # Reference: https://app.any.run/tasks/346f19a6-7cd8-4da7-b7ba-76651bc540f1/ 193.56.28.241:4444 193.56.28.241:8888 23.105.131.202:8888 crackme.hopto.org noface55.kozow.com # Reference: https://twitter.com/oguzpamuk/status/1166293812714659841 # Reference: https://app.any.run/tasks/d069fcb1-1c81-4f87-97bc-d4afb40a06e7/ # Reference: https://twitter.com/Racco42/status/1168449724724084737 193.56.28.173:2404 95.216.17.186:2404 23.105.131.169:2404 rownip.3utilities.com rownip.dyndnss.net rownip.theworkpc.com # Reference: https://twitter.com/ps66uk/status/1167016794260946944 # Reference: https://app.any.run/tasks/121e7cd1-6954-44be-a1b4-825c2615c11c/ # Reference: https://www.virustotal.com/gui/file/15b83a6155f1aba3acb68e4ecb475bb742790b82de364d1df4dd918a31f7872e/detection 79.134.225.48:3765 79.134.225.86:3765 79.134.225.87:3765 79.134.225.89:3765 remcoss.onmypc.org # Reference: https://twitter.com/de_aviation/status/1097547526763433985 du4alr0ute.sendsmtp.com helloweenhagga.ddns.net hhlari.ddns.net moneybag123.ddns.net revengerx111.sytes.net # Reference: https://twitter.com/malware_traffic/status/1169050682386763776 37.19.193.217:2404 37.19.193.217:2405 # Reference: https://twitter.com/KorbenD_Intel/status/1169996681259245569 charlesremcos.duckdns.org # Reference: https://twitter.com/wwp96/status/1170314034564018180 uaeoffice999.warzonedns.com # Reference: https://twitter.com/wwp96/status/1170332469960331266 66.154.113.142:2404 jkharding2014.myddns.rocks tomharry.ddns.net # Reference: https://twitter.com/wwp96/status/1170334923892371459 # Reference: https://app.any.run/tasks/e2340ee4-ba30-44ec-b748-1d625e65db63/ 79.134.225.77:2019 gratefulheart.ddns.net # Reference: https://twitter.com/wwp96/status/1171448440535973888 # Reference: https://app.any.run/tasks/fcbb836f-7ade-44f1-bbeb-9c7d9047fbe1/ 185.4.29.140:24009 inf111.ddns.net inf111.hopto.org # Reference: https://twitter.com/luc4m/status/1171783171677065217 charstiago6.dynu.net # Reference: https://twitter.com/DynamicAnalysis/status/1172221575376134144 79.134.225.105:3368 sub2.haircaresupertouch.waw.pl # Reference: https://twitter.com/dvk01uk/status/1176383495339483136 217.20.114.220:1010 myhousedubem.ddns.net # Reference: https://twitter.com/VK_Intel/status/1176933671389081601 79.134.225.101:1188 sciano.duckdns.org # Reference: https://twitter.com/Racco42/status/1179472593927200774 # Reference: https://twitter.com/Racco42/status/1179880257438003200 # Reference: https://www.virustotal.com/gui/ip-address/185.105.236.187/relations 185.105.236.187:5001 cepastr.ddns.net manafuuh.ddns.net teryts1802.sytes.net updatechrome.duckdns.org # Reference: https://twitter.com/VK_Intel/status/1179782506465366020 ulnews.duckdns.org # Reference: https://twitter.com/Dashowl/status/1179833764651962369 # Reference: https://app.any.run/tasks/e38aa085-4cc2-43e6-befe-0b4d5caeb0b6/ 204.152.219.70:5731 abundantgrace1.ddns.net # Reference: https://app.any.run/tasks/9bfe4193-bfea-4523-be81-68953435e7b7/ 181.215.247.18:2404 # Reference: https://twitter.com/MalwareConfig/status/1180886611602612224 # Reference: https://malwareconfig.com/config/daca573a51e9b080e2f3f6303611ee83 160.116.15.149:35364 henryofonyiri.ddns.net # Reference: https://twitter.com/killamjr/status/1180968029858910209 # Reference: https://app.any.run/tasks/f9985b06-08a9-41dd-b2d4-d051e02f8c08/ 137.116.73.45:2404 reneelauto.ddns.net # Reference: https://twitter.com/teoseller/status/1179318648718188545 # Reference: https://www.virustotal.com/gui/file/550baa07a33c62d24636d672c5a0973dbb1babc8ddc75e434d316ece595296f6/detection 185.81.157.41:2404 santzo.warzonedns.com # Reference: https://app.any.run/tasks/cb0e97af-6122-4181-87e5-842dedde0d77/ 178.239.21.116:1795 # Reference: https://app.any.run/tasks/7634c4dc-dee9-41e0-a2c0-32b4ef3d1885/ 213.184.126.134:1337 # Reference: https://twitter.com/P3pperP0tts/status/1181578274394251264 # Reference: https://www.hybrid-analysis.com/sample/47232b513efbd2c6fcd3dd1778aa00ca018710c8afd597d238ab1c94433747c4/5d9c9ed50288383e19febfe6 185.158.249.88:2404 # Reference: https://twitter.com/killamjr/status/1183421884794204160 # Reference: https://app.any.run/tasks/deed1a67-8d99-4e3c-9e87-5e63c39cb4c6/ top.intelprovidejordan.waw.pl # Reference: https://github.com/edchavarro/RAT_IoCs/blob/master/README.md (# Remcos section) 181.57.204.130:4452 46.246.82.66:2000 bolso.gucci12.cc celularmovil.huawei10.digital consola2.nintendo3.life consolajuego.nintendowii12.email telefonia.claromovil1.work tennis1.adidas3.tech # Reference: https://any.run/report/613f437f01744740c4e96d84c970c51128929fcdaa1a9d7e31a1ee063bf49f8e/3ae8d7b9-9a47-4ac4-b564-96510dc901d7 185.217.1.173:2404 algheithcompany.duckdns.org # Reference: https://twitter.com/smica83/status/1186542376355094529 91.189.180.214:7890 # Reference: https://twitter.com/killamjr/status/1188630140076658690 # Reference: https://app.any.run/tasks/a9de27e3-1bdc-43e9-8349-25bbe9c6cd90/ 192.169.69.25:8077 redditmercy.duckdns.org # Reference: https://twitter.com/James_inthe_box/status/1189251481943363586 # Reference: https://pastebin.com/H5UqcHv1 37.19.193.217:2398 toptoptop2.online toptoptop2.site toptoptop3.online toptoptop3.site # Reference: https://twitter.com/James_inthe_box/status/1189202165161529344 79.134.225.95:4050 79.134.225.95:6080 mnx.duckdns.org # Reference: https://twitter.com/w3ndige/status/1189301538142990339 # Reference: https://app.any.run/tasks/a8a4f079-0296-41fa-bcb0-546a54db9e56/ 109.202.103.170:8733 213.152.161.40:8733 213.152.162.89:8733 213.152.162.109:8733 # Reference: https://twitter.com/VK_Intel/status/1189602729498464257 # Reference: https://www.virustotal.com/gui/file/9235b1f5f9cc8efbf0ad96e4b48872a4043286fcdd182423746ed2e3700e1559/detection 79.134.225.20:2404 hobbotgy.duckdns.org # Reference: https://twitter.com/Paladin3161/status/1190072879242596352 # Reference: https://www.virustotal.com/gui/file/6e366fd065815118100c0a7fe8fa95208e87944b9dd4ce9df556c6d9f31151ec/detection menaxe.nsupdate.info # Reference: https://www.virustotal.com/gui/file/d23189d4520692301d6a013f60d59972fb61fd4bc3f011693411b20e9bdbd1e6/detection 185.244.31.85:4050 menaxe212.duckdns.org # Reference: https://www.virustotal.com/gui/file/6ddca5e1a4a9a4afd6663da5c05252d4150c8e271fbe28a81b3ae3af4cbca49c/detection 185.165.153.185:4050 # Reference: https://pastebin.com/29uSdMAk sub.thebest1jewels.waw.pl # Reference: https://pastebin.com/29uSdMAk # Reference: https://www.virustotal.com/gui/ip-address/79.134.225.29/relations 79.134.225.29:3018 bzsoftwaress.hopto.org faxjohn01.dyn.ddnss.de londonchap.duckdns.org samuelcity.ddns.net top.citycentrejo.waw.pl sub.winkcaffe.waw.pl # Reference: https://twitter.com/killamjr/status/1191192709727506438 79.134.225.73:2404 # Reference: https://app.any.run/tasks/508a6b73-18b4-490e-a1f3-69341ba72512/ 79.134.225.80:2404 clintonlog.hopto.org joseph3m.ddns.net # Reference: https://app.any.run/tasks/880d03b6-ed40-4688-a1ee-7f27e9873013/ 91.189.180.214:7890 # Reference: https://twitter.com/malwrhunterteam/status/1060836685771087873 35.237.81.215:1604 fuckerswashere.duckdns.org # Reference: https://twitter.com/wwp96/status/1191790897714913281 # Reference: https://app.any.run/tasks/4e587628-821c-42e9-ae52-ad84fd05ba85/ 91.193.75.51:4343 # Reference: https://blog.talosintelligence.com/2019/11/threat-roundup-1101-1108.html (# Win.Dropper.Remcos-7376444-0) # Reference: https://www.virustotal.com/gui/ip-address/179.33.152.127/relations msipro2019.duckdns.org # Reference: https://twitter.com/wwp96/status/1191486608249368581 # Reference: https://app.any.run/tasks/4ca60fe6-eb65-48eb-8f80-eb28e19ecfa4/ 79.134.225.11:5198 mpremx.duckdns.org # Reference: https://twitter.com/wwp96/status/1191443761563353089 # Reference: https://app.any.run/tasks/bd34ac22-9167-4ae5-a91f-e5600e21e72f/ 115.133.245.72:3908 115.133.245.72:4101 115.133.245.72:4421 ego9.ddns.net # Reference: https://twitter.com/JayTHL/status/1189778893298970624 # Rereference: https://www.virustotal.com/gui/file/1511d64209925c818d7db8eb1d0229e54debbea0d2a60bba094a05edd8d76a1d/detection # Reference: https://www.virustotal.com/gui/file/0634fc3acc43e1b3a357a28e4f0e20edac01ea07aa5de6e0373b8eb521bfd150/detection 194.5.97.96:22940 194.5.97.96:7493 lekwahouse.ddns.net pirorityclient.ddns.net # Reference: https://twitter.com/JayTHL/status/1189761540251103232 82.112.40.135:1604 # Reference: https://twitter.com/VK_Intel/status/1194260473631428608 # Reference: https://twitter.com/VK_Intel/status/1194338499085778944 # Reference: https://www.virustotal.com/gui/file/73cd4a5fd5d4670ecfa8d3e1d64055b76373e7730e0f7947ae850dbf2ee41549/detection 194.5.97.119:1000 nanoprivv.duckdns.org zotizieweb1.duckdns.org # Reference: https://twitter.com/wwp96/status/1196471158054494208 # Reference: https://app.any.run/tasks/66e92f07-3225-4d85-838f-cb3ccdbd90c8/ 79.134.225.99:4387 respainc.duckdns.org # Reference: https://twitter.com/wwp96/status/1196491717572222977 # Reference: https://app.any.run/tasks/594a9510-e48a-4dd5-89ea-73fe6929c225/ 185.140.53.168:5980 # Reference: https://www.virustotal.com/gui/file/db21285f8f62e182c6cb217073632a0c878c44e6b9d7dd2cf68df573391aa924/detection 154.16.93.170:8320 185.217.1.186:8320 217.79.184.12:8320 79.134.225.29:8320 faxjohn01.dyn.ddnss.de # Reference: https://app.any.run/tasks/c735b356-3ad6-47b2-8db9-4b820fba23ce/ pharmalobster.duckdns.org # Reference: https://app.any.run/tasks/1c7dc445-3d6f-4219-a2e1-afc99d3916a0/ rt.sexsweet.vip # Reference: https://www.virustotal.com/gui/ip-address/79.134.225.105/relations # Reference: https://www.virustotal.com/gui/file/331003b87d0c8194b40ca96740295c74a3695331e917a9d0511c62e6ffdd7e80/detection 79.134.225.105:3368 sub2.haircaresupertouch.waw.pl top1.supertouchhaircare.waw.pl # Reference: https://www.virustotal.com/gui/file/4a43fde440d91d130acd096114cfbe5e965100793f354297657d6595e2a4b941/detection electroking444.hopto.org # Reference: https://www.virustotal.com/gui/file/2478c6c90b6c4ecfc0a010b111bde48456898aba2946625784ecc083960f683a/detection electroking444.ddns.net # Reference: https://www.virustotal.com/gui/file/10c47670d9b565e7911364006e01fc545ef9b313bf5d230405f067b6a7795b50/detection 79.134.225.89:2501 # Reference: https://www.virustotal.com/gui/file/31022c5eb483f3b105050ab054e45541b206583996aec342b20fad359b1978ce/detection 199.195.250.222:6464 leebase.nsupdate.info # Reference: https://www.virustotal.com/gui/file/3692d98da1a9c209fe3f7789caa282a374eb39acde6d3b6690297773cd201c2a/detection 79.134.225.89:6464 filebase.duckdns.org # Reference: https://www.virustotal.com/gui/file/3121062c6478104325d7bdf59a08f9c416c2c8343ee4eb80829775c984a06310/detection 79.134.225.89:3369 fucktoto.duckdns.org # Reference: https://www.virustotal.com/gui/file/9e0d19b6ddfce89c11868bd8afdcfb53fa8d8c7c17623d25d04065aac411b521/detection 79.134.225.89:32002 work1234.duckdns.org # Reference: https://blog.talosintelligence.com/2019/11/threat-roundup-1115-1122.html (# Win.Dropper.Remcos-7395733-0) # Reference: https://www.virustotal.com/gui/ip-address/186.170.64.85/relations 186.170.64.85:2404 msipro2019.duckdns.org nashpink2019.duckdns.org proyectobasevirtualcol.com recuperaciondecartera.website # Reference: https://www.virustotal.com/gui/file/c382f97e5303ea6f171e7a1a1d1f305fa228dd368857d57035c70b7c1dbe4c2e/detection 186.170.64.85:6404 # Reference: https://www.virustotal.com/gui/file/c382f97e5303ea6f171e7a1a1d1f305fa228dd368857d57035c70b7c1dbe4c2e/detection 161.18.215.40:6404 179.33.63.205:6404 # Reference: https://www.virustotal.com/gui/file/ec3c174d36d5f8faa784d42a6972406d5ad258b770a308027a0bea1bb04a2fa3/detection 186.170.70.152:3370 # Reference: https://www.virustotal.com/gui/file/a0f495716cd691031cef9c3e92aa0c19f6f97a1179a60518797f1fdb5e1d82f7/detection 79.134.225.90:6553 # Reference: https://www.virustotal.com/gui/file/bb81e35d7d90e9d2a97408c256c4a498d85cfd36568e85b631766d34a9182b57/detection 79.134.225.90:2404 graceofgod.duckdns.org # Reference: https://www.virustotal.com/gui/file/9d22fa075c100254780f36d4ece00b40fad5cad6c5be21e15ed929c99680b904/detection 79.134.225.90:24197 registerme.warzonedns.com # Reference: https://www.virustotal.com/gui/file/646178cbc5b2452e1f3ee34500f039ab15f1f4d81533e1abc7db290fe43a10e7/detection 79.134.225.90:54985 1338099.ddns.net jaden222.kozow.com # Reference: https://www.virustotal.com/gui/file/eb712d5bb30e21cac53acdac476e526371534827486ad228c592facad084d220/detection 79.134.225.90:7331 7331.duckdns.org # Reference: https://www.virustotal.com/gui/file/04393c8b23e1742c3ca20a081739b7bb959274adc61f83158d0ef96ef575779e/detection 79.134.225.90:1720 jack2019.warzonedns.com # Reference: https://www.virustotal.com/gui/file/5689e69c5f46ab06f7b5b8d4aaaf235210ce6cf014fb3324c6d6c785ccb688c7/detection 79.134.225.90:5656 # Reference: https://www.virustotal.com/gui/file/330e409e8edbecfd1e3146c7dd09670e6d3364fb3f16ff0b2c129aea37b03e2f/detection 79.134.225.90:5001 teryts1802.sytes.net # Reference: https://www.virustotal.com/gui/file/83c8a487ae867ea10107a1a6a93a5c1b6b54744a384338e166317049a53f97ec/detection 79.134.225.90:5355 # Reference: https://www.virustotal.com/gui/file/8bbfa7a830568b039465d6abf3c517422c94d3abfe6455410a1437430a48e2de/detection 64.42.179.59:33089 sdkljsdf89237487428974wrewrwrereerwerw.linkpc.net # Reference: https://www.virustotal.com/gui/file/747cc60bf20b60daa1441457d74becb38f01564068d56e8eed000a1f9557d344/detection 199.249.230.22:33089 # Reference: https://www.virustotal.com/gui/file/da9f70611fc313108dfd69262954d2b926761528e20acda0593878ba0bd7a0ab/detection 198.203.28.43:33089 # Reference: https://www.virustotal.com/gui/file/60fc1a6f625150ec93ea5eb5cc91252542f15bd91dda6ea27d389b828a383061/detection 192.69.169.25:4864 abeasinf.duckdns.org # Reference: https://www.virustotal.com/gui/file/97571694c24fc14cfb658d7620d74c69ef42a78e2bad32ca047022b984edf922/detection 186.170.76.206:4864 # Reference: https://www.virustotal.com/gui/file/45f8ba1f2b1456f4192a0ac31b2788c18b957fdec9d94da8f3c3a581cf0e0591/detection 192.69.169.25:1626 wiskiriski15.duckdns.org # Reference: https://www.virustotal.com/gui/file/1daf168cc60d73346093932e5db44e055166da7e26c06e7fa7453ced43cffd42/detection 192.69.169.25:3864 pichicoyote.duckdns.org # Reference: https://www.virustotal.com/gui/file/060231c7729f65f39c1cc05fbe097d9c872dabd9391cc20eaf60c8d3c3cb0b5a/detection 79.134.225.80:3360 # Reference: https://www.virustotal.com/gui/file/e8a34e6e1db7c73ffea0618863c3d4ce31f3b32c4a16ec04b11460efb13a195e/detection 79.134.225.99:3360 # Reference: https://www.virustotal.com/gui/file/d96c1dc0ea3859660cd97e0f88b0cb0fab0a974ac0f07c7eadd45f48407a0224/detection 79.134.225.123:3360 79.134.225.125:3360 # Reference: https://www.virustotal.com/gui/file/1f6baac0b57ae8c9a3dfe83c6c4bf14ed0b00c785c333cfd905f3b403c036077/detection 79.134.225.122:3360 79.134.225.124:3360 # Reference: https://www.virustotal.com/gui/file/29bd4d55cb24fd04eabdc27eabcabe11f348ed1fc60b4c066af3be4c5eed869c/detection 185.165.153.113:3360 185.165.153.198:3360 # Reference: https://www.virustotal.com/gui/file/cc0f030f39bfc8c65c10bbcee2ce8679f313687dcce2ea8218e2a8fc8cd5c14d/detection 79.134.225.58:5609 remcus.chickenkiller.com # Reference: https://any.run/malware-trends/remcos (Note: as seen on 2019-12-04) ubananocore.ddns.net sandra.myddns.me prayersanswered.hopto.org gratefulheart.ddns.net 888rats.duckdns.org grafeulheart.ddns.net ijomsdavis1.ddns.net blessingfollowme.myddns.me slimyuyo.duckdns.org vemvemserver.duckdns.org 3forall2019.servesarcasm.com mozillamaintenanceservice.duckdns.org spenzmarine-56499.portmap.io fobeno-42652.portmap.io lololol-54262.portmap.io Theprohd-59801.portmap.io # Reference: https://pastebin.com/r5ZV1TCJ menaxe.nsupdate.info # Reference: https://twitter.com/wwp96/status/1203002510765707264 # Reference: https://app.any.run/tasks/30aa42c6-1bf5-4eed-84fc-099cc2f69404/ 174.127.99.167:8970 # Reference: https://pastebin.com/7Ak2nP2T reverse.spamassasins.icu top.multigamingjo.waw.pl # Reference: https://www.virustotal.com/gui/file/80120be87db5c64640fbd69a55cfd335601de08d5bcff393e66ff6f51c460850/detection 79.134.225.121:22940 # Reference: https://twitter.com/smica83/status/1205000837430468608 top.phonefix1.waw.pl # Reference: https://twitter.com/Paladin3161/status/1197842954037018625 192.169.69.25:1116 ashawo.duckdns.org wecollect11.duckdns.org # Reference: https://www.virustotal.com/gui/file/3e444ad341b93f3150b1eae401b84c1b8afd73a80345b4b328bd26c9e5dc5d66/detection 185.148.241.48:1115 # Reference: https://www.virustotal.com/gui/file/a22ede52f14be480dd478fa0ec955b807e4b91a14fbe1b5d46c07bbb5cacccbb/detection 185.244.30.116:1116 # Reference: https://www.virustotal.com/gui/file/53a20bb94b5f34076b98b161b786e24a3fe4c1d3ba36892a901f0709461d096e/detection 185.244.30.116:2444 proudsoldier.duckdns.org # Reference: https://www.virustotal.com/gui/file/bf16f2332e28ac589939efd41ce77fafeed6c9f8b20661f55a0e1264c78bebd0/detection 91.193.75.49:1116 # Reference: https://www.virustotal.com/gui/file/efda9ecdddba583c653b76dbc825daaba070e16d4e6be3f6439278c6c023450a/detection 185.165.153.231:2404 # Reference: https://twitter.com/ActorExpose/status/1196103594845593600 # Reference: https://app.any.run/tasks/4be5595d-4651-40ae-b24d-917a47b26fbb/ 79.134.225.46:1960 mgc1.duckdns.org # Reference: https://twitter.com/coderippers/status/1194935759775641600 185.165.153.186:5132 91.193.75.51:3434 # Reference: https://twitter.com/Paladin3161/status/1194813271494148096 192.169.69.25:100 jamesremcos.duckdns.org savagesquad.ooguy.com # Reference: https://www.virustotal.com/gui/file/a8c80446c78199908f9187795627a6111e765b7abf20662cd0f1762ba80abaa1/detection 185.165.153.27:100 # Reference: https://app.any.run/tasks/4e587628-821c-42e9-ae52-ad84fd05ba85/ # Reference: https://www.virustotal.com/gui/file/9b4585e342acf00e8d7c0f0b215af2f74ce1a0b428583c30868dbc616d87e1dd/detection srvc50.turhost.com # Reference: https://www.virustotal.com/gui/file/1efc346c6761b933adc7a10ab7e6da5e6c65369b5b90f3ddd528ce2bcc3116ab/detection 91.193.75.51:4343 # Reference: https://research.checkpoint.com/2019/decypherit-all-eggs-in-one-basket/ rmagent.biz # Reference: https://www.virustotal.com/gui/file/8003d7af85e3d328eb0c789e32bba3de456523c109847eca2ace5ae0252c1ee2/detection 185.165.153.22:2211 # Reference: https://www.virustotal.com/gui/file/04455422ee74836e38315b4ac9740470c963e45d5cf61fb3927f02ed9be4d995/detection 185.165.153.22:11011 # Reference: https://www.virustotal.com/gui/file/606aee9e6f0ec6e51dd94cda76b4978392bf5c7f505e049fbd936e7b97928387/detection 185.165.153.22:3330 # Reference: https://www.virustotal.com/gui/file/9fe933614e864926edb99dd6a6c1df31e3db0f74fb8c0d622ef73fd1c6e14104/detection 91.192.100.37:23850 # Reference: https://www.virustotal.com/gui/file/444a412bebf61392e5368bd1464f5773024d1c8758626cd7c5f061ba7688403a/detection 88.172.243.236:23850 # Reference: https://www.virustotal.com/gui/file/d2ddf0997db4b87a354abacba8f0b22f5923eeff7f01bcf3e2bae535160c579a/detection 79.134.225.122:23850 79.134.225.122:3366 # Reference: https://www.virustotal.com/gui/file/bd6220c705c6f321f59d1f45eea1e13c5171f7a2061dec9f907ffa291f3b9ec1/detection 79.134.225.122:2404 # Reference: https://www.virustotal.com/gui/file/c176c510cdc4c587528c7b3fd414ff373f966e669243ade0f76bc674e8053a9f/detection 23.105.131.156:2404 # Reference: https://www.virustotal.com/gui/file/abb4c76901b644cb756fe3727d3933d6a614d0709b62c78c9c54f2dd3ba6aea0/detection 192.253.246.140:23850