dyreza c2 status.

https://www.virustotal.com/en/file/55e8bb7d018f6f7571aefaa14df6169859b7f80a14f34af96a604a45afd16ce2/analysis/

sup from techhelplist.com

based on when proxies jumped certs, you can see which proxies have the same tier 2. There were clearly 2+ groups in this sample. they are also back to using fields like 0z5CzuyoGUyt3Qbz4wjDvop
--------------------------------------------------------------------------------------------------------------------
150.129.49.163:443			up group1			abuse@sikkacable.com
159.224.247.133:4443			up group2			noc@triolan.com
172.73.21.168:4443			up group2			abuse@rr.com
173.248.22.227:443			up group1			abuse@chibardun.net
178.18.75.159:4443			up group2			radovan.jakubko@presnet.sk
185.37.169.172:443			up group1			unknown
188.255.145.111:4443			up group1			abuse@oriontelekom.rs
188.255.145.121:443			down/wrong port?		abuse@oriontelekom.rs
190.110.214.50:443			up group1			unknown
193.13.37.183:443			down				abuse@swip.net
195.189.19.156:443			up group2			postmaster@vit.net.ua
197.210.196.26:443			up group1			unknown
197.210.199.11:443			up group1			unknown
197.210.214.12:443			up group1			unknown
199.120.97.238:4443			up group2			abuse@netins.net
199.127.54.6:4443			up group1			ispnalerts@marktwain.net
199.127.55.101:4443			up group1			ispnalerts@marktwain.net
206.248.12.19:4443			up group1			zodell@sctelcom.com gwhitley@sctelcom.com
206.248.15.194:4443			up group1			zodell@sctelcom.com
208.90.85.112:4443			up group2			abuse@xplornet.com
209.169.171.191:443			up group2			abuse@derytelecom.ca
209.169.187.196:443			up group2			abuse@derytelecom.ca
209.32.67.128:443			up group1			abuse@wiktel.com
209.40.238.170:443			down				noc@browndognetworks.com
216.228.173.18:4443			up group2			nocsupport@bendbroadband.net
31.134.100.179:443			up group1			abuse@detronics.sk
31.170.85.128:4443			up group1			abuse@tesatel.sk
45.46.50.225:443			up group?			abuse@rr.com
45.46.51.81:443				up group1			abuse@rr.com
46.238.89.52:443			up group2			abuse@inea.com.pl
46.249.181.138:4443			up group1			abuse@splius.lt
50.24.53.233:4443			up group1			abuse@suddenlink.net
50.24.94.197:4443			up group1			abuse@suddenlink.net
64.141.86.154:4443			up group2			abuse@shawbusinesssolutions.ca
64.184.184.60:443			down				jbusch@straitisp.com
67.221.146.148:4443			up group2			opsteam@rhizone.ca
67.221.156.188:4443			up group2			opsteam@rhizone.ca
67.221.195.53:4443			up group1			jwatkins@mwdata.net
67.222.205.69:443			down				abuse@abbnebraska.com
69.193.145.138:4443			up group2			abuse@rr.com
70.121.191.206:4443			up group1			abuse@rr.com
74.63.200.66:443			down				abuse@limestonenetworks.com
74.75.204.74:443			up group1			abuse@rr.com
85.248.2.228:443			up group1			abuse@benestra.sk
91.143.29.101:4443			up group2			megalog@megalog.ru
91.143.29.138:443			up group2			megalog@megalog.ru
91.235.162.167:443			up group2			biuro@integron.pl
93.175.224.143:4443			up group2			support@netassist.ua
93.185.4.90:4443			up group2			abuse@c2net.cz
94.154.106.26:443			up group?			unknown
95.170.224.118:4443			up group2			lir@rupkki.sk
97.68.231.42:4443			up group2			abuse@rr.com,ip-mgmt@mybrighthouse.com
98.102.44.38:4443			up group2			abuse@rr.com