2019-06-13 Ursnif/Gozi IOCs

SENDERS OBSERVED
kcampbell@flcps.com

URSNIF PAYLOAD URLS
http://ckvhss79yo87u.com/p109/mv.php?l=topsv1.dat
http://ckvhss79yo87u.com/p109/mv.php?l=topsv2.dat
http://ckvhss79yo87u.com/p109/mv.php?l=topsv3.dat
http://ckvhss79yo87u.com/p109/mv.php?l=topsv4.dat
http://ckvhss79yo87u.com/p109/mv.php?l=topsv5.dat

URSNIF LOADER SERVERS/INFECTION TRAFFIC
http://dnv9619cathy.xyz
https://r96hfhardyee5.com

URSNIF PAYLOAD FILE HASH
0b939bfd5c93cd03b060717d0390179b
1d00e78029de64570e6684cb18f5e894
8bfc7ccad057b0b361bca28f173d71fa
98784bc7e1fddd59f8e0689a4b645cf5
db84d56d987a3abb152f506137641602

FOLLOW-UP MALWARE - ICEDID
http://gishti.com/wp-content/uploads/2019/06/asiodn1293.rar

ICEDID RAR FILE HASH
8731ecf64815e8089ce2bc8f7a4a3ec7

FOLLOW-UP MALWARE - DRIDEX
185.175.58.9
192.48.88.191
195.123.212.196