2021-08-19 Remcos RAT IOCs

THREAT IDENTIFICATION:  REMCOS RAT

SUBJECTS OBSERVED
Payment Receipt

SENDERS OBSERVED
jjandark@daum.net

MALDOC FILE HASHES
Receipt payment 18-08-21.xls
1d7a15e0603871aebf86f69d110c82b3

INTERMEDIATE PAYLOAD URLS
http://dreamwatchevent.com/wpadmins/Protected Client.js
http://dreamwatchevent.com/wpadmins/Attack.jpg

INTERMEDIATE PAYLOAD FILE HASHES
The "Protected Client.js" file is renamed:
notapad.js
f57b6af29796118192f653a4e0f44792

Attack.jpg
613ac253f76a02d11a71507cbcbd370c

REMCOS C2
freightmgmt.duckdns.org:691
https://194.5.98.207:691

SUPPORTING EVIDENCE
https://urlhaus.abuse.ch/url/1531262