nhin cai lon ma may 999.exe
Classification: Malicious
nhin cai lon ma may 999.exe is a malicious file sample (Windows 64-bit executable). Linked to Remcos malware.
Detection summary
- 0 antivirus detections
- 21 IDS alerts
- 0 processes observed
- 29 contacted hosts
- 27 DNS requests
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2026-10-18 06:45:05 | 2026-10-18 06:45:05 | malicious-activity | |
| Remcos | Triage | 2026-10-18 05:40:57 | 2026-10-18 05:40:57 | malicious-activity | S0332 Remcos |
Tags
remcos remotehost discovery rat suricata malicious new_domainSample information
- Filenames
- nhin cai lon ma may 999.exe
- File type
- PE32+ executable for MS Windows 5.02 (GUI), x86-64 ...
- MD5
e3e847720ff40be2390f3b2cfc2d681a- SHA-1
b6cb7f22ff0143bdcafc06239c2fc254085f8d3f- SHA-256
cdbd7f132be0b70ef592b5be7a2d3d4fff48e85e432ceac3b9dbfda4d6d85ca2- First indexed
- 2026-10-18 05:40:57
- Last updated
- 2026-10-18 06:45:05
Network contacts
172.67.157.156 172.67.197.63 104.21.13.66 172.67.142.51 172.67.156.100 104.21.66.108 104.21.94.124 172.67.182.246 104.21.23.10 104.21.89.77 104.21.28.87 172.67.219.27 104.21.43.191 104.21.29.40 172.67.163.133 172.67.128.30 104.21.19.87 172.67.200.192 172.67.177.77 104.21.59.81 172.67.163.172 104.21.25.4 104.21.39.137 172.67.200.82 172.67.130.177 172.67.148.91 104.21.0.166 104.21.81.22 172.67.156.247
DNS requests
61116222b2.buzz 999betslot.vip abgstore.com.co afribus.co arkaan.cc backdoor.qh88b3.com backdoor.qh88eu.com backdoor.rajaslot5000.cc doyanslot.us ee88-e888-com.cc eficiencia-energetica.co ex88.jp.net fifa55hr.com fifa55red.me fifareport.com indiaplus.co juad888.us qh88b3.com qh88eu.com qq88.fan rajaslot5000.cc slot235-son.co.uk superautoslot.vip tk88lighting.in.net tritonplus.co way2ship.in webnghean.com