2020-02-20 Remcos IOCs

SUBJECTS OBSERVED
Regarding Job

SENDERS OBSERVED
James Johnson <frank@topl3ss.com>

EMAIL BODY
Hello,
I'm James Johnson and I'm interested in a job.
I've added a copy of my resume.
Pass code is 1234

Looking forward to hearing back from you!
--
James Johnson

467146582

PAYLOAD URL
http://199.19.226.33/droptop1.bin

ADDITIONAL DOWNLOAD URLS
https://drive.google.com/uc?export=download&id=1N8gVOM5p8Ubm1HwolChxHidT7YoN29EE
https://doc-00-2k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ln06597lsc5jdn6kl1qvrs9r9qoolh4m/1582237800000/04567802101573540432/*/1N8gVOM5p8Ubm1HwolChxHidT7YoN29EE?e=download

DOCUMENT FILE HASH
f631424f4956da36d6c88857e612a910

EXE FILE HASH
b5479869c1ae14084526161cc002036c

REMCOS C2
http://47.245.32.229:2500