Skip to main content

Remcos

Malware Family

2 793 indicators of compromise attributed to Remcos across abuse.ch threat intelligence feeds.

Domains

1 147

IPs

1 567

URLs

4

Hashes

75

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 147)IPs (1 567)URLs (4)Hashes (75)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
weerterveldautos.nldomain
wkstazionmagat.obrigadocristiano.spacedomain
www.consultarprocesosramajudicial.com.codomain
www.jesusboyglobalbackup2.comdomain
www.iltat.comdomain
xoso66v.comdomain
ufye28738bd3yv23d783.con-ip.comdomain
toleskiki.ddnsgeek.comdomain
brideeded.duckdns.orgdomain
348787241.comdomain
jahour7lamo1.duckdns.orgdomain
service-kom.ydns.eudomain
8kbet.fitnessdomain
backdoor.slotmachinesoldiveri.comdomain
bj88ac.codomain
pcnewsesperanza.duckdns.orgdomain
fb88.farmdomain
malware.clipmagic.codomain
donta.duckdns.orgdomain
shlobo.duckdns.orgdomain
77.83.39.219ip
86.54.42.18ip
172.96.165.204ip
182.23.2.163ip
192.227.135.223ip
172.111.139.231ip
103.67.163.108ip
130.12.182.180ip
147.124.215.2ip
45.74.7.161ip
45.83.31.190ip
103.83.86.48ip
172.245.155.96ip
204.10.160.243ip
178.16.53.140ip
107.173.4.16ip
80.253.249.67ip
141.98.10.154ip
217.76.57.196ip
69.197.150.245ip
https://mbcasesores.com/tap/BBVA_pdf.zipurl
http://192.210.229.56/demo.exeurl
https://192.236.217.110/83/goodthings.htaurl
https://107.175.88.100/img/remcos_a.daturl
453e775ba32c43699a47bbfb2f0c9675f523d2a90c903a0e069086658d76485chash
4be24ba6132ddc47ae55ee91183e7982394827b6d334e559fd24d5d056ae12a5hash
4f722dfacbe424bcde50dfc36e8629748f2721474c34978e28eb7c4e45ce4318hash
741cc13f514227ce73d22363e5488730dc56028cde4970a8eb734c447a46faabhash
295614f9bf8a66878ed5429b3f2bb33981bae48c993964e79702a49d57e536d2hash
140eb57e93274c31571ed13bafc3d36267e970620d7b588b7735cec7b41cfbb9hash
d1d4d72e4759b1bb95cc16f8e2e3dbded8409f68bc0d761c51c27071778946behash
4f4dfad2cd9ff21d88353f568982655c240bee96a4034b05e6c1efacb515622ehash
54706d8d39e619a4e7e5a882d304dc34a86d9756da1f0be9df420ac60b8847abhash
363ee51fc02f20cb206039434758c3afa1c71bc7d316c6db4a39b0d310ab92f9hash
372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985hash
72ecd967be4dcc2dc6cf357a7b8baea5hash
1148fa91ce87cc06cbd373b0bd40eb1de0ede6e438262dda0ca8bea60b9239f8hash
49efd867be8b4c8337d2064b6c3749d5hash
a82ab47795a1a4a04da0b73a9597a58072fcb05ce9ac83ba8f922c11d74b8457hash
ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833hash

Another file to check? Run a file hash reputation check.