Skip to main content

Remcos

Malware Family

2 888 indicators of compromise attributed to Remcos across abuse.ch threat intelligence feeds.

Domains

1 167

IPs

1 642

URLs

4

Hashes

75

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 167)IPs (1 642)URLs (4)Hashes (75)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
newhigh.duckdns.orgdomain
j88.studiodomain
julyblessed634.duckdns.orgdomain
bahira.medomain
oni17.duckdns.orgdomain
backdoor.trangchuae888.comdomain
1.tcp.us-cal-1.ngrok.iodomain
esteesnuevo2025.duckdns.orgdomain
trfsgysu28opask06.duckdns.orgdomain
procesjudicial2.duckdns.orgdomain
www.cbcleib.comdomain
saralee1.duckdns.orgdomain
www.webdevarrayremcobackup2.comdomain
newssssssssssssss.duckdns.orgdomain
backdoor.kolaybet.clubdomain
emphasis.co.indomain
judasbuoyeahuruhusitemnaakezigbonduyaaaa.duckdns.orgdomain
onboard.radiantfluxstudio.comdomain
datesnewplus.duckdns.orgdomain
crushanytics.duckdns.orgdomain
46.28.70.102ip
206.123.137.164ip
109.205.211.40ip
217.64.148.147ip
158.94.209.29ip
172.94.111.195ip
94.154.32.247ip
2.27.5.37ip
194.156.79.129ip
45.74.7.168ip
5.101.86.99ip
172.245.4.221ip
86.106.84.151ip
163.245.199.241ip
192.3.198.23ip
172.94.53.99ip
62.60.226.157ip
192.236.217.108ip
138.226.237.250ip
172.111.232.228ip
https://mbcasesores.com/tap/BBVA_pdf.zipurl
http://192.210.229.56/demo.exeurl
https://192.236.217.110/83/goodthings.htaurl
https://107.175.88.100/img/remcos_a.daturl
453e775ba32c43699a47bbfb2f0c9675f523d2a90c903a0e069086658d76485chash
9f8e25e8b2b3fd1185e663d1060d0d43f620897f7ef5353738dec2078672171ahash
4f722dfacbe424bcde50dfc36e8629748f2721474c34978e28eb7c4e45ce4318hash
741cc13f514227ce73d22363e5488730dc56028cde4970a8eb734c447a46faabhash
4f4dfad2cd9ff21d88353f568982655c240bee96a4034b05e6c1efacb515622ehash
54706d8d39e619a4e7e5a882d304dc34a86d9756da1f0be9df420ac60b8847abhash
8422a58a2a94670547dd37df0fab8e90hash
94cb6668e88d1326be58b31e001c81b245396401hash
6a794a8e3184d505573cc23c957b78b11a7eb89317ae2a82bbaa1195c310da0ehash
c4db84797f4994b5abe481903534fe300f2b4d5chash
ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833hash
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353ahash
61321510045ef68e4e20672cb1b130a2632d7b3cb1c3c8348c4c5e300d0d8a19hash
f57da923e5b75ea46065584301fe67aa5f37998630447b53242050397ee93a8fhash
004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504bhash
3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6hash

Another file to check? Run a file hash reputation check.