Vidar_IOCs_2019-12-09_12_52.txt

#Vidar #malware #OSINT #IOC

SHA256:
1c275c53f83f2aa4916dfd47439fae8740907718dc9fa41604107a14d39621aa
40ebd67ff8278c9efc6aa90e9bd4221ed9155369c90ba25bfe699c2d418f6610
e497bd74a134b10d6bd5385cd59fe4c60758bc5135c970422cb868e6f801ce02
ee0a4e00992382159296ee165789910fc41b1bfebd702a724e783300e72ba027

IPs:
104[.]114[.]77[.]146
104[.]114[.]77[.]155
104[.]123[.]71[.]136
104[.]123[.]71[.]144
104[.]123[.]71[.]155
169[.]239[.]129[.]65
185[.]244[.]149[.]55
192[.]35[.]177[.]64
198[.]54[.]115[.]179
205[.]185[.]216[.]10
208[.]95[.]112[.]1
72[.]247[.]211[.]138
72[.]247[.]211[.]146
8[.]208[.]10[.]193
8[.]209[.]74[.]215

Domains:
789456123[.]monster
bitbucket[.]org
legion17[.]net
lowupdate3[.]top
lowupdate4[.]top
softupdate1[.]me
softupdate2[.]me
xylolle[.]com
ybookfli[.]net

URL:
http://789456123[.]monster/setup-ydm[.]exe
http://bitbucket[.]org/itself-spring/down/downloads/setup_c[.]exe
http://bitbucket[.]org/miceants/files/downloads/setup_c[.]exe
http://bitbucket[.]org/presscircle/cloud/downloads/setup_c[.]exe
http://legion17[.]net/legion17/welcome
http://lowupdate3[.]top/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2
http://lowupdate3[.]top/gate1[.]php?a=true
http://lowupdate4[.]top/test/eu/1[.]exe
http://lowupdate4[.]top/test/eu/2[.]exe
http://softupdate1[.]me/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2
http://softupdate1[.]me/gate1[.]php?a=true
http://softupdate2[.]me/test/eu/1[.]exe
http://xylolle[.]com/
http://xylolle[.]com/237
http://xylolle[.]com/freebl3[.]dll
http://xylolle[.]com/mozglue[.]dll
http://xylolle[.]com/msvcp140[.]dll
http://xylolle[.]com/nss3[.]dll
http://xylolle[.]com/softokn3[.]dll
http://xylolle[.]com/vcruntime140[.]dll
http://ybookfli[.]net/
http://ybookfli[.]net/237
http://ybookfli[.]net/freebl3[.]dll
http://ybookfli[.]net/mozglue[.]dll
http://ybookfli[.]net/msvcp140[.]dll
http://ybookfli[.]net/nss3[.]dll
http://ybookfli[.]net/softokn3[.]dll
http://ybookfli[.]net/vcruntime140[.]dll