Idsohtu_IOCs_2019-12-24_12_04.txt

Idsohtu_IOCs_2019-12-24_12_04

Malware Famaily: Idsohtu

SHA256:
390b9ad98e2e73e0e7fcc7b52c889f0c0a9126a358d0959e88e42d3158847f10
a7924e6fc2a624d7347f554267f75f43694ef04fd37ae5171d23576165008ec6
bd80d53b0f7a290d388f0ee2a07443e00e38264b44a9853a8cb8f83928bca73a
f061b5abab544f814981ac8a268385a04aba00187a632d9c82f201835a0e97fc

IPs:
113[.]106[.]48[.]72
119[.]147[.]80[.]20

Domains:
res[.]duduniu[.]cn

URL:
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/dseb[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/gajp[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/ghfot[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mtbill[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mulone1[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/mulone2[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/psip[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/PSvr[.]dat,
http://res[.]duduniu[.]cn:8088/iprotectinit/bak/1/upopup[.]dat,

#malware #OSINT #IOC
#Idsohtu