API tools faq
paste
ExecuteMalware

2020-11-24 Remcos IOCs

ExecuteMalware
Nov 24th, 2020
5,828
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.84 KB | None | 0 0
raw download clone embed print report
  1. THREAT ATTRIBUTION: REMCOS RAT
  2.  
  3. SUBJECTS OBSERVED
  4. Citbank Payment Advice Notice For Vendor-- <Company Name>
  5. Wells Fargo Payment Advice Notification -<Company Name> WF11232020
  6.  
  7. SENDERS OBSERVED
  8. [email protected]
  9. [email protected]
  10.  
  11. MALDOC FILE HASHES
  12. Payment-Advice.xls
  13. d0eec012f6b2d39a4d3b0091588d4d23
  14.  
  15. Remit_Advice.xls
  16. 75ecb80a0cfeb25ac23b4fe0c611ca7a
  17.  
  18. ach.vbs
  19. 7eb75ac29bcdb9b04ffd7be21be218c0
  20.  
  21. PAYLOAD FILE HASHES
  22. fila.jpg
  23. 5aef2c7a517e06b2ff42c55b2546a44e
  24.  
  25. MALDOC DOWNLOAD URLS
  26. http://creditcollectionglobal.co/holder/word.vbs
  27. http://creditcollectionglobal.co/holder/ach.vbs
  28.  
  29. PAYLOAD URL
  30. http://creditcollectionglobal.co/mint/fila.jpg
  31.  
  32. REMCOS C2
  33. daemontime.myq-see.com
  34. 79.134.225.120:12489
  35.  
  36. SUPPORTING EVIDENCE
  37. https://app.any.run/tasks/c6b92e79-f5dd-40b9-a294-01b14f06d9b3/
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!