nhin cai lon ma may 9999.exe
Classification: Malicious
nhin cai lon ma may 9999.exe is a malicious file sample (Windows 64-bit executable). Linked to Remcos malware.
Detection summary
- 0 antivirus detections
- 21 IDS alerts
- 0 processes observed
- 30 contacted hosts
- 27 DNS requests
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2026-10-18 06:45:05 | 2026-10-18 06:45:05 | malicious-activity | |
| Remcos | Triage | 2026-10-18 05:42:14 | 2026-10-18 05:42:14 | malicious-activity | S0332 Remcos |
Tags
remcos remotehost discovery persistence rat suricata malicious new_domainSample information
- Filenames
- nhin cai lon ma may 9999.exe
- File type
- PE32+ executable for MS Windows 5.02 (GUI), x86-64 ...
- MD5
b53b7acc772f2be6bf1eac3fc093c59b- SHA-1
dda8c54073708354632c857996522fbb27c5f6aa- SHA-256
b7ff563a4540b5af5d96f74fa4d03a564724f4cad4b3739a36e137f47ac3a48b- First indexed
- 2026-10-18 05:42:14
- Last updated
- 2026-10-18 06:45:05
Network contacts
104.21.33.22 104.21.68.172 172.67.198.151 104.21.46.212 172.67.156.100 172.67.159.112 172.67.223.113 104.21.72.112 172.67.208.68 104.21.89.77 104.21.28.87 104.21.59.81 172.67.184.79 172.67.148.91 104.21.42.158 104.21.0.166 104.21.19.87 104.21.50.46 104.21.75.136 104.21.49.147 172.67.221.133 172.67.170.204 104.21.21.204 104.21.3.123 172.67.157.156 172.67.142.51 104.21.23.10 104.21.25.4 104.21.43.191 172.67.200.192
DNS requests
61116222b2.buzz 999betslot.vip abgstore.com.co afribus.co arkaan.cc backdoor.qh88b3.com backdoor.qh88eu.com backdoor.rajaslot5000.cc doyanslot.us ee88-e888-com.cc eficiencia-energetica.co ex88.jp.net fifa55hr.com fifa55red.me fifareport.com indiaplus.co juad888.us qh88b3.com qh88eu.com qq88.fan rajaslot5000.cc slot235-son.co.uk superautoslot.vip tk88lighting.in.net tritonplus.co way2ship.in webnghean.com