Malicious_IOCs_2019-12-24_12_04.txt

Malicious_IOCs_2019-12-24_12_04

Malware Famaily: Malicious

SHA256:
0810f1e1b014228476c9a7f91d4202686d7509234ffa18cd43bf000336825eb3
1979363c4e12e30113a61a6bcd4507f1bad8f4225efd104e47b50c7446ecc527
48d59d8e0bbc2088e12a1294d2396ee96b0c40cb84d6fff3467ea7b021cc7310
7362536c7850fc0afe1469e2b44259fa793480778a675972b236da72eb4a6aef
79723cbc2234e26aae3111b8c7b6711da68a46d01e5808598a1492e49c331f60
ca3ad3ac161709f3c3ce1c2e63fd4a612ac2d987bf2fa321284c6e4e8c64c93b
clamav:Txt.Downloader.Generic-6810205-0,

IPs:
1[.]0[.]0[.]100
1[.]0[.]0[.]25
112[.]82[.]242[.]163
113[.]106[.]48[.]72
116[.]211[.]100[.]137
116[.]211[.]100[.]181
116[.]211[.]100[.]182
118[.]25[.]165[.]228
119[.]147[.]80[.]20
120[.]132[.]48[.]228
125[.]77[.]142[.]201
134[.]175[.]107[.]117
140[.]249[.]60[.]229
162[.]241[.]173[.]131
162[.]241[.]216[.]20
169[.]254[.]255[.]254
180[.]150[.]178[.]242
180[.]150[.]179[.]27
183[.]95[.]89[.]203
184[.]28[.]188[.]179
188[.]127[.]227[.]76
202[.]107[.]193[.]171
2[.]1[.]0[.]26
23[.]35[.]171[.]27
23[.]52[.]0[.]137
23[.]52[.]0[.]138
23[.]52[.]0[.]139
23[.]52[.]0[.]144
23[.]52[.]0[.]145
23[.]52[.]0[.]147
23[.]52[.]0[.]152
23[.]52[.]0[.]153
23[.]52[.]0[.]154
23[.]52[.]0[.]155
23[.]52[.]0[.]160
23[.]52[.]0[.]162
23[.]52[.]0[.]163
23[.]52[.]0[.]168
23[.]52[.]0[.]169
23[.]52[.]0[.]170
23[.]52[.]0[.]171
23[.]52[.]0[.]176
23[.]52[.]0[.]177
23[.]52[.]0[.]178
23[.]52[.]0[.]179
23[.]52[.]0[.]184
23[.]52[.]0[.]185
23[.]52[.]0[.]186
23[.]60[.]139[.]27
3[.]0[.]3[.]10
95[.]217[.]99[.]22

Domains:
brekatrinado[.]red
dssp[.]stnts[.]com
dssp[.]workday360[.]cn
e[.]dangeana[.]com
exceptionalsanta[.]pro
exceptionalsanta[.]red
fmjstorage[.]com
happysantacows[.]red
log[.]r9j43[.]cn
l[.]raidmedia[.]com[.]cn
ocsp[.]int-x3[.]letsencrypt[.]org
ocsp[.]thawte[.]com
pubg[.]heymoney[.]cn
res[.]duduniu[.]cn
sisipiciliko[.]pro
th[.]symcd[.]com
tuijian[.]workday360[.]cn
update[.]bainv[.]net
u[.]raidmedia[.]com[.]cn
v2api[.]v6[.]cn
www[.]ecowis[.]com
youtop-engine[.]stnts[.]com

URL:
http://brekatrinado[.]red/data3[.]php?2E6F3FE1ABC798B0,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=newicon_shellstart&data=&gid=1905353524&mac=18C086CD4732&pcname=Host&bootid=3C2433D3B92A46D33E2AD4B8C038A5BD&start=TRUE&&version=2[.]1[.]0[.]26&cid=EABAFDC9&ccid=0&tgid=&p=AAAmc3RhcnQ9VFJVRSYmdmVyc2lvbj0yLjEuMC4yNiZjaWQ9RUFCQUZEQzkmY2NpZD0wJnRnaWQ9AAAAAA==,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_desktopstart&data=&gid=1905353524&mac=18C086CD4732&pcname=Host&bootid=3C2433D3B92A46D33E2AD4B8C038A5BD&version=2[.]1[.]0[.]26&cid=EABAFDC9&ccid=00000000&iconNum=100&tgid=&p=AAAmdmVyc2lvbj0yLjEuMC4yNiZjaWQ9RUFCQUZEQzkmY2NpZD0wMDAwMDAwMCZpY29uTnVtPTEwMCZ0Z2lkPQAAAAAA,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_playvideo_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&version=7[.]10[.]0319[.]1207&info=plugin_run@origin=Steam[.]exe&plugid=18011501&ccid=FFFFFFFF,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_sth_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&plugver=1[.]0[.]0[.]1002&act=plugin_exit,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_sth_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&plugver=1[.]0[.]0[.]1002&act=plugin_run,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_douyuflow_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&module=init%20cfg%20error&version=1[.]0[.]0[.]25&cid=,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_douyuflow_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&module=plug_sslsrv&version=1[.]0[.]0[.]25&cid=,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_show_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=&plugver=1[.]0[.]0[.]25&act=init%20show%20cfg%20error,
http://e[.]dangeana[.]com/pubg/union_plugin_769d7d5b819009a2910d5750ef6d7056_XMNetSpeeder_3[.]0[.]3[.]10_qd12_v3[.]exe,
http://happysantacows[.]red/data3[.]php?2E6F3FE11D4EBB5D,
http://log[.]r9j43[.]cn/terminal/start-up,
http://ocsp[.]int-x3[.]letsencrypt[.]org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgR2zmso4BF%2FR%2BnIRwZIatRIrw%3D%3D,
http://ocsp[.]thawte[.]com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D,
http://pubg[.]heymoney[.]cn/api?q=SUVWa3JIR0Z2djZpZER5Z1B2RHhIT0hUUFNVRnk2cHJncG5CQkRhcytmbz0=,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/dseb[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/gajp[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/ghfot[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mtbill[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mulone1[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mulone2[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/psip[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/PSvr[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/upopup[.]dat,
http://th[.]symcd[.]com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D,
http://youtop-engine[.]stnts[.]com/v2/icon?cid=EABAFDC9&ccid=00000000&bootid=3C2433D3B92A46D33E2AD4B8C038A5BD&pcname=Host&mac=18C086CD4732&scheme=0,

#malware #OSINT #IOC
#Malicious