Download Attachments
1
a
Date added: February 10, 2020 12:36 amAdded by: adminFile size: 383 KBDownloads: 43
Remcos is a RAT type malware which means that attackers use it to perform actions on infected machines remotely. This malware is extremely actively caped up to date with updates coming out almost every single month.
TypeTrojan Originex-USSR territory First seen1 June, 2016 Last seen9 February, 2020
2020-02-08 21:12:20.981585 IP 192.168.86.25.56271 > 46.4.22.188.80: Flags [P.], seq 2260857165:2260857557, ack 24046668, win 16425, length 392: HTTP: GET /a/a.exe HTTP/1.1
2020-02-08 21:12:21.096476 IP 46.4.22.188.80 > 192.168.86.25.56271: Flags [P.], seq 1:1370, ack 392, win 123, length 1369: HTTP: HTTP/1.1 301 Moved Permanently
301
Moved Permanently
The document has been permanently moved.LiteSpeed Web Server
Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.
2020-02-08 21:12:29.915772 IP 192.168.86.25.56272 > 198.96.95.42.80: Flags [P.], seq 980367087:980367245, ack 2427136781, win 16425, length 158: HTTP: GET /a/a.bin HTTP/1.1
2020-02-08 21:12:29.973133 IP 198.96.95.42.80 > 192.168.86.25.56272: Flags [P.], seq 1:232, ack 158, win 237, length 231: HTTP: HTTP/1.1 200 OK
2020-02-08 21:12:29.915772 IP 192.168.86.25.56272 > 198.96.95.42.80: Flags [P.], seq 980367087:980367245, ack 2427136781, win 16425, length 158: HTTP: GET /a/a.bin HTTP/1.1
2020-02-08 21:12:29.973133 IP 198.96.95.42.80 > 192.168.86.25.56272: Flags [P.], seq 1:232, ack 158, win 237, length 231: HTTP: HTTP/1.1 200 OK
2020-02-08 21:12:30.160111 IP 198.96.95.42.80 > 192.168.86.25.56272: Flags [P.], seq 103892:105352, ack 158, win 237, length 1460: HTTP_*..V..P......:o7.P....H....eA...
...$...L.@:.i.y.......c.H!.G..N.?..+4.8RzF... "...n......l..D..[..C2....#M..v...^...S.p Ur_..5[b...|.&E...3.../..*{..K.'.y...;.h9.P..,..t..f.a./k0$.Q.q….=B…V…w…..mog.6.7.P.XjxO.X…T…..}>…-s.n(<..uW…~…:J…2cI.’..E)…….d..]Y…..eA…
…$…L.@:.i.y…….c.H!.G..N.?..+4.8RzF… “…n……l..D..[..C2….#M.’..E)…….d..]Y…..eA…
…$…L.@:.i.y…….c.H!.G..N.?..+4.8RzF… “…n……l..D..[..C2….#M..v…^…S.p Ur_..5[b…|.&E…3…/..{..K.’.y…;.h9.P..,..t..f.a./k0$.Q.q....=B...V...w.....mog.6.7.P.XjxO.X...T..\...}>...-s.n(<..uW...~...:J...2cI.'..E).......d..]Y.....eA...
...$...L.@:.i.y.......c.H!.G..N.?..+4.8RzF... "...n......l..D..[..C2....#M..v...^...S.p Ur_..5[b...|.&E...3.../..*{..K.'.y...;.h9.P..,..t..f.a./k0$.Q.q….=B…V…w…..mog.6.7.P.XjxO.X…T…..}>…-s.n(<..uW…~…:J…2cI.’..E)…….d..]Y…..eA…
…$…L.@:.i.y…….c.H!.G..N.?..+4.8RzF… “…n……l..D..[..C2….#M.’..E)…….d..]Y…..eA…
…$…L.@:.i.y…….c.H!.G..N.?..+4.8RzF… “…n……l..D..[..C2….#M..v…^…S.p Ur_..5[b…|.&E…3…/.. {..K.’.y…;.h9.P..,..t..f.a./k0$.Q.q....=B...V...w.....mog.6.7.P.XjxO.X...T..\...}>...-s.n(<..uW...~...:J...2cI.'..E).......d..]Y.....eA...
...$...L.@:.i.y.......c.H!.G..N.?..+4.8RzF... "...n......l..D..[..C2....#M..v...^...S.p Ur_..5[b...|.&E...3.../..*{..K.'.y...;.h9.P..,..t..f.a./k0$.Q.q….=B…V…w…..mog.6.7.P.XjxO.X…T…..}>…-s.n(<..uW…~…:J.
2020-02-08 21:12:30.161350 IP 198.96.95.42.80 > 192.168.86.25.56272: Flags [P.], seq 127252:127272, ack 158, win 237, length 20: HTTP_*..V..P..... :o7.P.........d..]Y.....eA...
..
2020-02-08 21:12:33.822577 IP 192.168.86.25.56273 > 198.96.95.42.80: Flags [P.], seq 3026874668:3026874826, ack 2251535379, win 16425, length 158: HTTP: GET /a/a.bin HTTP/1.1
E....'@.......V.._*…P.jq,.3..P.@)….GET /a/a.bin HTTP/1.1
2020-02-08 21:13:15.419664 IP 91.193.75.248.1005 > 192.168.86.25.56274: Flags [P.], seq 209:235, ack 2299, win 65, length 26
Please follow and like us:
