Formbook_Trojan_IoCs_02-10-2019

#Formbook #Trojan
--------------------------------
02-10-2019
--------------------------------
Main object- "zomdoz.png"
	url	http://www.csday.site/pure/zomdoz.png
	sha256	9e68391284fca66246676fedc610e54abda9f00546a9ea3b2c20ba2ccc7dd35b
	sha1	d430f7d5af736b972af9a7c42d622e67a59daf7e
	md5	8a84bfe1d301790d1e0b3d91d2e588eb
DNS requests
	domain	sltnet.in
	domain	art-offers.online
	domain	lafourmi83.net
	domain	robertsrenovation.com
	domain	xifancode.com
	domain	baihuirsj.com
	domain	segestavacanze.com
Connections
	ip	176.223.132.209
	ip	153.92.6.144
	ip	23.107.185.242
	ip	195.110.124.154
HTTP/HTTPS requests
	url	http://sltnet.in/cm/js/main/
	url	http://sltnet.in/cm/js/main/?-ZLTih=7hjPjCNMLSiGeceoAqz5CI4+67EVvuVkdW26WVPMIHlGGwX4gyEXHqD9Qa3gnHJyAa9oQg==&2d=llzDUf
	url	http://robertsrenovation.com/cm/js/main/?-ZLTih=7NgeOCO6O4slzXvhqRkTRo/Vo0fVL/3CL/t3vpSDuYPycxlJvSfm4cWrUhgkskafYLgLDw==&2d=llzDUf&sql=1
	url	http://robertsrenovation.com/cm/js/main/
	url	http://segestavacanze.com/cm/js/main/?-ZLTih=Ap0mW10VhOl3I2IWaix4e6uPFq71JLgNXQsRRYdJQEJWnQkY0rHE2KWrrYj6O8jbum4sSA==&2d=llzDUf&sql=1
	url	http://segestavacanze.com/cm/js/main/
	url	http://baihuirsj.com/cm/js/main/
	url	http://baihuirsj.com/cm/js/main/?-ZLTih=BlrIIo7IKcEvQSCgk8MZJENtSBXZekSj13Iduzpcl3J+4ztXdwUs9Je24z4q5lwrVcpA5Q==&2d=llzDUf&sql=1