2021-08-27 Remcos IOCs

THREAT IDENTIFICATION:  REMCOS RAT

SUBJECTS OBSERVED
Confirmation of Remittance ACH2020821

SENDERS OBSERVED
gilhongkim@daum.net

MALDOC FILE HASHES
ACH Remittance Advice 26-08-21..xls
8401e85cf30c0d2f831a8f8c82a6ebdc

INTERMEDIATE PAYLOAD URLS
http://dreamwatchevent.com/.well-known/pki-validation/Protected Client.js
http://dreamwatchevent.com/.well-known/pki-validation/Attack.jpg

INTERMEDIATE PAYLOAD FILE HASHES
The "Protected Client.js" file is renamed:
notapad.js
6c3168ab9c2783576e790c71005498d2

Attack.jpg
699f41958e12d9cd2b134d0cbb8b0a13

REMCOS C2
freightmgmt.duckdns.org:691
https://194.5.98.207:691