cyber_threat_intelligence/actors/Remcos

Remcos - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Remcos. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.remcos

Campaigns

The following campaigns are known and can be associated with Remcos:

• Ukraine

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Remcos:

• ES
• US
• GB
• ...

There are 10 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Remcos.

ID	IP address	Hostname	Campaign	Confidence
1	2.58.47.203	-	-	High
2	3.13.31.214	ec2-3-13-31-214.us-east-2.compute.amazonaws.com	-	Medium
3	3.64.163.50	ec2-3-64-163-50.eu-central-1.compute.amazonaws.com	-	Medium
4	3.94.41.167	ec2-3-94-41-167.compute-1.amazonaws.com	-	Medium
5	5.61.37.41	-	-	High
6	5.181.234.139	-	-	High
7	5.181.234.145	-	-	High
8	5.249.226.166	uw19.uniweb.no	-	High
9	8.253.139.120	-	-	High
10	13.107.21.200	-	-	High
11	13.107.42.12	1drv.ms	-	High
12	13.107.42.13	-	-	High
13	13.107.43.12	-	-	High
14	13.107.43.13	-	-	High
15	13.225.230.20	server-13-225-230-20.jfk51.r.cloudfront.net	-	High
16	13.250.255.10	ec2-13-250-255-10.ap-southeast-1.compute.amazonaws.com	-	Medium
17	15.197.142.173	a4ec4c6ea1c92e2e6.awsglobalaccelerator.com	-	High
18	18.214.132.216	ec2-18-214-132-216.compute-1.amazonaws.com	-	Medium
19	20.36.253.92	-	-	High
20	20.42.73.27	-	-	High
21	20.106.94.110	-	-	High
22	20.190.151.7	-	-	High
23	20.190.151.8	-	-	High
24	20.190.151.68	-	-	High
25	20.190.151.70	-	-	High
26	20.190.151.131	-	-	High
27	20.190.151.132	-	-	High
28	20.190.151.133	-	-	High
29	20.190.152.21	-	-	High
30	20.190.154.139	-	-	High
31	23.3.13.88	a23-3-13-88.deploy.static.akamaitechnologies.com	-	High
32	23.3.13.154	a23-3-13-154.deploy.static.akamaitechnologies.com	-	High
33	23.21.27.29	ec2-23-21-27-29.compute-1.amazonaws.com	-	Medium
34	23.21.205.229	ec2-23-21-205-229.compute-1.amazonaws.com	-	Medium
35	23.21.213.140	ec2-23-21-213-140.compute-1.amazonaws.com	-	Medium
36	23.38.131.139	a23-38-131-139.deploy.static.akamaitechnologies.com	-	High
37	23.46.239.18	a23-46-239-18.deploy.static.akamaitechnologies.com	-	High
38	23.56.9.181	a23-56-9-181.deploy.static.akamaitechnologies.com	-	High
39	23.78.173.83	a23-78-173-83.deploy.static.akamaitechnologies.com	-	High
40	23.82.12.29	-	-	High
41	23.105.131.193	-	-	High
42	23.105.131.209	-	-	High
43	23.105.131.222	-	-	High
44	23.196.74.222	a23-196-74-222.deploy.static.akamaitechnologies.com	-	High
45	23.199.63.11	a23-199-63-11.deploy.static.akamaitechnologies.com	-	High
46	23.199.63.83	a23-199-63-83.deploy.static.akamaitechnologies.com	-	High
47	23.223.37.181	a23-223-37-181.deploy.static.akamaitechnologies.com	-	High
48	23.226.128.197	23.226.128.197.static.quadranet.com	-	High
49	23.227.38.74	-	-	High
50	34.96.116.138	138.116.96.34.bc.googleusercontent.com	-	Medium
51	34.102.136.180	180.136.102.34.bc.googleusercontent.com	-	Medium
52	34.117.168.233	233.168.117.34.bc.googleusercontent.com	-	Medium
53	34.192.250.175	ec2-34-192-250-175.compute-1.amazonaws.com	-	Medium
54	34.197.12.81	ec2-34-197-12-81.compute-1.amazonaws.com	-	Medium
55	34.202.33.33	ec2-34-202-33-33.compute-1.amazonaws.com	-	Medium
56	35.205.61.67	67.61.205.35.bc.googleusercontent.com	-	Medium
57	35.214.144.124	124.144.214.35.bc.googleusercontent.com	-	Medium
58	37.0.14.195	-	-	High
59	37.0.14.217	-	-	High
60	37.1.206.16	free.ispiria.net	-	High
61	37.19.193.217	unn-37-19-193-217.cdn77.com	-	High
62	37.120.138.222	-	-	High
63	37.123.118.150	-	-	High
64	37.139.64.106	-	-	High
65	37.230.130.153	-	-	High
66	37.235.1.174	resolver1.freedns.zone.powered.by.virtexxa.com	-	High
67	40.126.26.134	-	-	High
68	40.126.28.12	-	-	High
69	40.126.28.22	-	-	High
70	44.230.27.49	ec2-44-230-27-49.us-west-2.compute.amazonaws.com	-	Medium
71	44.238.161.76	ec2-44-238-161-76.us-west-2.compute.amazonaws.com	-	Medium
72	45.15.143.148	-	-	High
73	45.74.32.12	-	-	High
74	45.95.168.62	maxko-hosting.com	-	High
75	45.133.174.177	-	-	High
76	45.148.17.62	mail.spokel.se	-	High
77	46.2.255.122	-	-	High
78	46.105.127.143	ns385442.ip-46-105-127.eu	-	High
79	46.243.147.194	-	-	High
80	46.243.239.153	-	-	High
81	46.243.249.150	-	-	High
82	46.246.80.68	c-46-246-80-68.ip4.frootvpn.com	-	High
83	47.254.172.117	-	-	High
84	50.16.234.229	ec2-50-16-234-229.compute-1.amazonaws.com	-	Medium
85	50.63.202.36	ip-50-63-202-36.ip.secureserver.net	-	High
86	51.15.229.127	127-229-15-51.instances.scw.cloud	-	High
87	51.75.209.242	ip242.ip-51-75-209.eu	-	High
88	51.91.236.193	cluster028.hosting.ovh.net	-	High
89	...	...	...	...

There are 352 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Remcos. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Weakness	Description	Confidence
1	T1006	CWE-21, CWE-22, CWE-23, CWE-425	Pathname Traversal	High
2	T1055	CWE-74	Injection	High
3	T1059	CWE-94	Cross Site Scripting	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	High
5	T1068	CWE-264, CWE-266, CWE-269, CWE-284	Execution with Unnecessary Privileges	High
6	...	...	...	...

There are 19 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Remcos. This data is unique as it uses our predictive model for actor profiling.

ID	Type	Indicator	Confidence
1	File	/admin/inquiries/view_details.php	High
2	File	/anony/mjpg.cgi	High
3	File	/blog/blog.php	High
4	File	/cgi-bin/mesh.cgi?page=upgrade	High
5	File	/common/info.cgi	High
6	File	/data/vendor/tcl	High
7	File	/etc/hosts	Medium
8	File	/etc/passwd	Medium
9	File	/etc/password	High
10	File	/files.md5	Medium
11	File	/forum/away.php	High
12	File	/hy-cgi/devices.cgi	High
13	File	/mgmt/tm/util/bash	High
14	File	/plesk-site-preview/	High
15	File	/plugin/jcapture/applet.php	High
16	File	/proc/stat	Medium
17	File	/ram/pckg/security/nova/bin/ipsec	High
18	File	/uncpath/	Medium
19	File	/usr/bin/pkexec	High
20	File	/v2/quantum/save-data-upload-big-file	High
21	File	/webservices/api/v2.php	High
22	File	/wp-admin/admin-ajax.php	High
23	File	/_internal	Medium
24	...	...	...

There are 199 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

• https://1275.ru/ioc/87/remcos-rat-remote-access-trojan-ioc/
• https://asec.ahnlab.com/en/31429/
• https://asec.ahnlab.com/en/32085/
• https://blog.morphisec.com/remcos-trojan-analyzing-attack-chain
• https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities
• https://blog.talosintelligence.com/2018/06/threat-roundup-0622-0629.html
• https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html
• https://blog.talosintelligence.com/2019/03/threat-roundup-0315-0322.html
• https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html
• https://blog.talosintelligence.com/2019/06/threat-roundup-0531-0607.html
• https://blog.talosintelligence.com/2019/06/threat-roundup-0614-0621.html
• https://blog.talosintelligence.com/2019/08/threat-roundup-0726-0802.html
• https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html
• https://blog.talosintelligence.com/2019/11/threat-roundup-1101-1108.html
• https://blog.talosintelligence.com/2019/11/threat-roundup-1115-1122.html
• https://blog.talosintelligence.com/2020/04/threat-roundup-0403-0410.html
• https://blog.talosintelligence.com/2020/04/threat-roundup-0410-0417.html
• https://blog.talosintelligence.com/2020/04/threat-roundup-0417-0424.html
• https://blog.talosintelligence.com/2020/05/threat-roundup-0501-0508.html
• https://blog.talosintelligence.com/2020/05/threat-roundup-0508-0515.html
• https://blog.talosintelligence.com/2020/06/threat-roundup-0529-0605.html
• https://blog.talosintelligence.com/2020/06/threat-roundup-0605-0612.html
• https://blog.talosintelligence.com/2020/06/threat-roundup-0619-0626.html
• https://blog.talosintelligence.com/2020/07/threat-roundup-0710-0717.html
• https://blog.talosintelligence.com/2020/09/threat-roundup-0911-0918.html
• https://blog.talosintelligence.com/2020/10/threat-roundup-1009-1016.html
• https://blog.talosintelligence.com/2020/12/threat-roundup-1204-1211.html
• https://blog.talosintelligence.com/2021/02/threat-roundup-0219-0226.html
• https://blog.talosintelligence.com/2021/03/threat-roundup-0226-0305.html
• https://blog.talosintelligence.com/2021/08/threat-roundup-0730-0806.html
• https://blog.talosintelligence.com/2021/08/threat-roundup-0806-0813.html
• https://blog.talosintelligence.com/2021/08/threat-roundup-0813-0820.html
• https://blog.talosintelligence.com/2021/09/threat-roundup-0827-0903.html
• https://blog.talosintelligence.com/2021/09/threat-roundup-0910-0917.html
• https://blog.talosintelligence.com/2021/09/threat-roundup-0917-0924.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-0924-1001.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-1008-1015.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-1015-1022.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-1022-1029.html
• https://blog.talosintelligence.com/2021/11/threat-roundup-1112-1119.html
• https://blog.talosintelligence.com/2022/01/threat-roundup-1231-0107.html
• https://blog.talosintelligence.com/2022/02/threat-roundup-0211-0218.html
• https://blog.talosintelligence.com/2022/03/threat-roundup-0311-0318.html
• https://blog.talosintelligence.com/2022/03/threat-roundup-0318-0325.html
• https://blog.talosintelligence.com/2022/03/ukraine-invasion-scams-malware.html
• https://blog.talosintelligence.com/2022/04/threat-roundup-0401-0408.html
• https://blog.talosintelligence.com/2022/07/threat-roundup-0701-0708.html
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-17%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-19%20Remcos%20RAT%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-08-19%20Remcos%20RAT%20IOCs%202
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-09-15%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-10-12%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-11-04%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-06%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-08%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2021-12-16%20Remcos%20RAT%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-10%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-01-18%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-01%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-01%20Remcos%202%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-02-09%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-08%20Remcos_1%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-08%20Remcos_2%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-12%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-04-27%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-11%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-11%20Remcos%202%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-13%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-18%20Remcos_1%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-18%20Remcos_2%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-19%20Remcos%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-25%20Remcos%201%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-05-25%20Remcos%203%20IOCs
• https://github.com/executemalware/Malware-IOCs/blob/main/2022-06-23%20Remcos%20IOCs
• https://isc.sans.edu/forums/diary/Malspam+using+passwordprotected+Word+docs+to+push+Remcos+RAT/25292/
• https://twitter.com/Paladin3161/status/1197842954037018625

Literature

The following articles explain our unique predictive cyber threat intelligence:

• VulDB Cyber Threat Intelligence Documentation
• Cyber Threat Intelligence - Early Anticipation of Attacks

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!