API tools faq
paste
ExecuteMalware

2021-02-17 Remcos IOCs - 1st

ExecuteMalware
Feb 17th, 2021
4,921
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.78 KB | None | 0 0
raw download clone embed print report
  1. THREAT IDENTIFICATION: REMCOS
  2.  
  3. SUBJECTS OBSERVED
  4. EFT Remittance Advice
  5.  
  6. SENDERS OBSERVED
  7. [email protected]
  8.  
  9. MALDOC FILE HASHES
  10. EFT Remittance.xls
  11. e9dbdcfb6439bd0d888e907a71509937
  12.  
  13. JAVASCRIPT LOADER URL
  14. http://greenpayindia.com/king/file/ach/login/Protected%20Client.js
  15.  
  16. JAVASCRIPT LOADER FILE HASH
  17. Protected Client.js
  18. 53c6ba86eedbf52338675e5d806f7cfd
  19.  
  20. Copied to: C:\users\analyst\AppData\Roaming and renamed to notepad.js
  21.  
  22. PAYLOAD URL
  23. http://greenpayindia.com/king/file/ach/login/Attack.jpg
  24.  
  25. PAYLOAD FILE HASH
  26. Attack.jpg
  27. b0df36da77c4171eafae7ab7fbc9f64a
  28.  
  29. REMCOS C2
  30. https://isrealpicker.duckdns.org:672
  31.  
  32. SUPPORTING EVIDENCE
  33. https://urlhaus.abuse.ch/url/1016852/
  34. https://urlhaus.abuse.ch/url/1016853/
  35. https://app.any.run/tasks/0ab15224-b7c3-453a-8d13-a387e7356057/
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!