Formbook_Stealer_IOCs_30-01-2019

#Formbook #Stealer #Trojan
------------------------------
30-01-2019			IOC's
------------------------------
Main object- "win32.exe"
	url	http://23.249.161.100/jae/win32.exe
	sha256	f2a24f11eb69b0b239355b0948bb09e585d2ad639e48ff350b876780f7128089
	sha1	44af74247b6a00d29643a755097d11e2e8372a22
	md5	a86145c76a7ce5ba98bde1d3441de3c7
DNS requests
	domain	www.dianji66.com
	domain	www.testawesomedomainlogan2.com
	domain	www.stockchampionparts.com
	domain	www.ebazarone.com
	domain	www.912cb.com
	domain	www.cartafinancial.info
	domain	www.nkydolls.com
	domain	www.tv-cable.com
	domain	www.rrbfpmpu.com
Connections
	ip	45.61.140.149
	ip	54.236.217.56
	ip	23.245.142.222
	ip	23.20.239.12
HTTP/HTTPS requests
	url	http://www.rrbfpmpu.com/jw/?P08=WAaxAjs4ZH1UcAZNNqOuy/feC2LeMXa+PVAL8ngvs7IbQHedlGYF3ZBBUqYdaDe03/MsIA==&0rh=WHl0V4FPZ&sql=1
	url	http://www.dianji66.com/jw/?P08=j7GGiKLJCH63TBQuFakcmWSgQqQUP+lEgkuNtnsgkssBehdm6FQej1CaB9bLtc/TgFap6w==&0rh=WHl0V4FPZ
	url	http://www.stockchampionparts.com/jw/?P08=+ilieCAHR7un5q7lczzAvXLJjiOYr7e4fcafr+GaY4wrJ1EH1B2bgn6VnNNZW4dZGneFBg==&0rh=WHl0V4FPZ&sql=1
	url	http://www.stockchampionparts.com/jw/
	url	http://www.912cb.com/jw/?P08=DfAplDZ5uavmoDdwT+VCJ453KrKj4Q7laV67HVTQI3/Laf0as7x23XRZqdn50RuOTkya1g==&0rh=WHl0V4FPZ&sql=1
	url	http://www.912cb.com/jw/
	url	http://www.tv-cable.com/jw/?P08=fzagBiyK6vgTrOCxds6GtlWi+za1/Gq1p8gGcBM9LhH5rYeMt/Gq0Sfi0qDuaU5aBcNa3w==&0rh=WHl0V4FPZ&sql=1
	url	http://www.tv-cable.com/jw/