2021-08-17 Remcos IOCs

THREAT ATTRIBUTION:  REMCOS RAT

SUBJECTS OBSERVED
Order Invoice NO##8745996

SENDERS OBSERVED
manuel.conde@ferrox.com.mx

MALDOC FILE HASHES
Proformar invioce.zip
82a7277aae45928346023c77abc2c87b

REMCOS PAYLOAD FILE HASHES
Proformar invioce.exe
a311cef429085f54e95b32fd836c56b6

renamed to:
remcos.exe
a311cef429085f54e95b32fd836c56b6

REMCOS C2
govdouglas.ydns.eu
https://91.92.120.140:4973