>samit_hota
Back to IOCs
G006450 indicators

Remcos — Indicators of Compromise

Samit Hota·
#ioc#remcos

Overview

Indicators of compromise associated with Remcos. 50 indicators listed below, linked to the G0064 adversary profile.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port23.94.197.120:2404July 19, 202677%
ip:port62.60.226.68:24044July 19, 2026100%
ip:port185.149.24.6:2405July 17, 2026100%
ip:port185.236.203.99:58798July 17, 2026100%
ip:port102.220.160.105:2404July 16, 202675%
ip:port204.44.93.75:14641July 16, 202675%
ip:port204.44.93.75:14642July 16, 202675%
ip:port103.186.64.138:2404July 16, 202675%
ip:port64.89.161.94:2404July 16, 202675%
ip:port204.44.93.75:14648July 15, 202675%
ip:port204.44.93.75:14649July 15, 202675%
ip:port185.115.164.59:7723July 15, 202675%
ip:port103.83.86.48:2404July 15, 202675%
ip:port103.11.41.10:17328July 15, 202675%
ip:port204.44.69.214:14646July 15, 202675%
ip:port192.255.195.147:14645July 15, 202675%
ip:port124.198.132.119:5220July 15, 202675%
ip:port103.11.41.10:62452July 15, 202675%
ip:port103.11.41.10:10443July 15, 202675%
domainpajp.oragh8kaso1.comJuly 15, 202675%
domaingros59kalmso1.duckdns.orgJuly 15, 202675%
domaingros59kalmso2.duckdns.orgJuly 15, 202675%
domainmetromachine.4nmn.comJuly 15, 202675%
domainarmcobarriersuppliers.duckdns.orgJuly 15, 202675%
domainarmcobarriersuppliersbk.duckdns.orgJuly 15, 202675%
ip:port102.220.160.104:2404July 15, 202675%
ip:port161.248.179.182:37171July 15, 202675%
ip:port130.12.182.47:2404July 15, 202675%
ip:port194.59.31.232:2404July 15, 202675%
ip:port165.227.80.236:443July 15, 202675%
ip:port160.25.72.34:2404July 15, 202675%
ip:port85.206.168.238:4646July 14, 202675%
ip:port45.74.7.107:5691July 14, 202675%
ip:port185.115.164.59:53353July 14, 202675%
ip:port155.103.71.115:15608July 14, 202675%
ip:port103.83.86.48:1616July 14, 202675%
domainoudwaubach.nlJuly 14, 202675%
ip:port82.29.72.65:3467July 14, 202675%
domainwkstazionmagat.obrigadocristiano.spaceJuly 14, 2026100%
ip:port46.151.182.38:8080July 14, 202675%
domainconnectus.cristianoobrigado.shopJuly 14, 202675%
ip:port173.231.188.245:21075July 14, 202675%
ip:port216.9.225.38:14649July 14, 202675%
ip:port204.44.69.214:14647July 14, 202675%
ip:port192.255.195.147:14647July 14, 202675%
ip:port185.115.164.60:65531July 14, 202675%
ip:port185.115.164.60:11883July 14, 202675%
ip:port172.111.169.69:56090July 14, 202675%
ip:port46.183.222.96:465July 14, 202675%
ip:port204.44.69.214:14644July 14, 202675%

Related content

Adversary Profile

APT33: Iran's Evolving Cyber Espionage and Destructive Capabilities

Adversary Profile

Gorgon Group (G0078): Hybrid Threat Actor Profile

Adversary Profile

Nigerian BEC Syndicate: SilverTerrier (G0083) Threat Profile

Adversary Profile

LazyScripter Threat Profile: Targeting Airlines and Global Workforce

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call