Shade_IOCs_2019-12-24_12_04.txt

Shade_IOCs_2019-12-24_12_04

Malware Famaily: Shade

SHA256:
e5849bf606de6c57d525fd9a6e64552e8e421ddc4135d991afadf4be0bde310c

IPs:
0[.]0[.]0[.]0
1[.]0[.]0[.]100
1[.]0[.]0[.]25
116[.]211[.]100[.]137
116[.]211[.]100[.]181
116[.]211[.]100[.]182
125[.]77[.]142[.]201
140[.]249[.]60[.]229
183[.]95[.]89[.]203
202[.]107[.]193[.]171
3[.]0[.]3[.]10

Domains:
dssp[.]stnts[.]com
dssp[.]workday360[.]cn
e[.]dangeana[.]com
pubg[.]heymoney[.]cn
tuijian[.]workday360[.]cn

URL:
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_playvideo_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&version=7[.]10[.]0319[.]1207&info=plugin_run@origin=Steam[.]exe&plugid=18011501&ccid=FFFFFFFF,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_sth_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&plugver=1[.]0[.]0[.]1002&act=plugin_exit,
http://dssp[.]stnts[.]com:8888/?opt=put&mq=plug_sth_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=3824&plugver=1[.]0[.]0[.]1002&act=plugin_run,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_douyuflow_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&module=init%20cfg%20error&version=1[.]0[.]0[.]25&cid=,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_douyuflow_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&module=plug_sslsrv&version=1[.]0[.]0[.]25&cid=,
http://dssp[.]workday360[.]cn:8888/?opt=put&mq=plug_show_start&data=&gid=1905353524&mac=18C086CD4731&pcname=Host&bootid=754AD125D3B751ACE8B1A3A675057E5C&cid=&plugver=1[.]0[.]0[.]25&act=init%20show%20cfg%20error,
http://e[.]dangeana[.]com/pubg/union_plugin_769d7d5b819009a2910d5750ef6d7056_XMNetSpeeder_3[.]0[.]3[.]10_qd12_v3[.]exe,
http://pubg[.]heymoney[.]cn/api?q=SUVWa3JIR0Z2djZpZER5Z1B2RHhIT0hUUFNVRnk2cHJncG5CQkRhcytmbz0=,

#malware #OSINT #IOC
#Shade