Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- THREAT ATTRIBUTION: REMCOS RAT
- SUBJECTS OBSERVED
- Separate Remittance Advice: paper document number - 9604163
- SENDERS OBSERVED
- BB&T EFT <alert@message-bbt[.]com>
- EMAIL BODY
- Payment Remittance Advice
- July 28, 2020
- An electronic payment has been remitted to you. Please find attached your remittance and invoice details.
- From Payer
- BB & T Electronic Payments
- Trading Partner
- To Payee ID
- 6M8966578E033193B
- Bank Name
- BB & T.. ...
- Bank No.
- 111017694
- Branch No.
- 111017694
- Bank BIC Code
- XXXXXXXXX33
- Bank Account
- XXXXXXXXXXX
- IBAN
- Payment Reference Number
- 74492322
- Paper Document Number
- 9604163
- Payment Date
- July 28, 2020
- Payment Currency
- USD
- Payment Amount
- Payment Method
- 20,731.53
- EFT
- Branch Banking and Trust Company; Member FDIC.
- BB&T, 200 West Second Street, PO Box 1250, Winston Salem, NC 27101-1250.
- Copyright © 2020, Branch Banking and Trust Company. All rights reserved.
- This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use, or distribution of the information included in this message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments.
- MALDOC FILE HASHES
- ManagementBoard[.]vbs
- 4027246affd19bec5c03fd5af10218e4
- Payment Advice[.]xlsm
- e0c41f793cfb01ddece1701634a64cf3
- Image02[.]jpg
- deafaf17ddde7cb2cde1bd8d6145802c
- Image03[.]jpg
- bbeaffbdc3c48b84622a1b5de44240a2
- PAYLOAD URL
- hxxp://plaitt[.]com/Regional/ManagementBoard[.]vbs
- hxxp://plaitt[.]com/Images/Image02[.]jpg
- hxxp://plaitt[.]com/Images/Image03[.]jpg
- REMCOS C2
- 79[.]134[.]225[.]32:8950
- SUPPORTING EVIDENCE
- https://app.any.run/tasks/1bc823c2-5852-41d3-b745-9eb26008de1b/
Add Comment
Please, Sign In to add comment
