Emotet_Feodo_IOC's_23-07-2018

#Emotet #Feodo #Banking #Malware
--------------------------------
23-07-2018			IOC's
--------------------------------
Main object- "Invoice-44427428-071818"
	url	http://www.discalotrade.com/Jul2018/US/INVOICE-STATUS/Invoice-44427428-071818/
	sha256	fa05f24ab5e8d90f668bc44454f9f8b442e5be868ab2122a88cae56a67066ad9
	sha1	019a2cc798c01beba26bc90dd03c8a11203f0a09
	md5	262ef289d5beb97872ed70bc70e8a512
DNS requests
	domain	hydrocarbonreports.com
	domain	hawkinscs.com
	domain	ajx3.com
	domain	grupovisionpr.com
	domain	kazak.zendo.in.ua
Connections
	ip	162.144.141.220
	ip	46.63.95.126
	ip	70.40.200.66
	ip	104.244.125.235
	ip	96.127.180.130
HTTP/HTTPS requests
	url	http://hawkinscs.com/uBmDMGkJ
			C2:
			http://108.246.196.73/
			http://129.89.95.199/
			http://129.89.95.110/
			http://97.89.253.146/
			http://71.52.70.233:8080/
			http://104.231.112.63:8080/
			http://73.4.58.41/
			http://142.44.244.100/
			http://80.11.163.139:8080/
			http://71.214.17.130:443/
			http://216.21.168.27:443/
			http://86.191.189.233/
			http://65.175.135.119:8443/
			http://108.170.54.171:8080/
			http://149.62.173.247:8080/
			http://203.45.160.97:8090/
			http://69.203.91.33:8090/
			http://118.190.60.27:20/
			http://222.214.218.192:4143/
			http://71.244.60.231:4143/
			http://73.183.145.218:8443/
			http://50.92.101.60:465/
			http://194.88.246.242:443/
			http://199.119.78.9:443/
			http://46.105.131.87/
			http://97.105.96.246:7080/
			http://201.103.149.80:8080/
			http://78.47.182.42:8080/
			http://118.244.214.210:443/
			http://194.150.118.8:443/
			http://46.105.131.69:8080/
			http://70.25.63.178:7080/
			http://157.7.164.23:8080/
			http://146.185.170.222:8080/
			http://27.50.89.209:8080/
			http://213.112.99.246:7080/
			http://199.119.78.38:443/
			http://72.172.196.22:7080/

	url	http://hydrocarbonreports.com/0
			C2:
			http://187.155.30.88:8080/
			http://72.172.196.22:7080/
			http://98.163.53.175:443/
			http://75.71.154.27:8080/
			http://70.183.177.22/
			http://142.44.244.100/
			http://213.112.99.246:7080/
			http://73.4.58.41/
			http://108.170.54.171:8080/
			http://149.62.173.247:8080/
			http://97.105.96.246/
			http://70.25.63.178:7080/
			http://173.165.110.17:443/
			http://69.203.91.33:8090/
			http://71.214.17.130:443/
			http://86.191.189.233/
			http://149.28.245.24/
			http://222.214.218.192:4143/
			http://104.231.112.63:8080/
			http://80.11.163.139:8080/
			http://46.105.131.87/
			http://203.45.184.52/
			http://78.47.182.42:8080/
			http://203.45.160.97:8090/
			http://118.190.60.27:20/
			http://46.105.131.69:8080/
			http://201.103.149.80:8080/
			http://199.119.78.38:443/
			http://50.92.101.60:465/
			http://194.88.246.242:443/
			http://71.244.60.231:4143/
			http://146.185.170.222:8080/
			http://27.50.89.209:8080/
			http://199.119.78.9:443/
			http://118.244.214.210:443/
			http://157.7.164.23:8080/
			http://194.150.118.8:443/

	url	http://grupovisionpr.com/GJjBPh
			C2:
http://108.246.196.73/
			http://129.89.95.199/
			http://129.89.95.110/
			http://97.89.253.146/
			http://73.4.58.41/
			http://104.231.112.63:8080/
			http://142.44.244.100/
			http://71.52.70.233:8080/
			http://216.21.168.27:443/
			http://65.175.135.119:8443/
			http://80.11.163.139:8080/
			http://108.170.54.171:8080/
			http://86.191.189.233/
			http://71.214.17.130:443/
			http://69.203.91.33:8090/
			http://149.62.173.247:8080/
			http://222.214.218.192:4143/
			http://203.45.160.97:8090/
			http://118.190.60.27:20/
			http://71.244.60.231:4143/
			http://97.105.96.246:7080/
			http://194.88.246.242:443/
			http://50.92.101.60:465/
			http://199.119.78.9:443/
			http://70.25.63.178:7080/
			http://46.105.131.87/
			http://194.150.118.8:443/
			http://201.103.149.80:8080/
			http://46.105.131.69:8080/
			http://118.244.214.210:443/
			http://73.183.145.218:8443/
			http://78.47.182.42:8080/
			http://27.50.89.209:8080/
			http://146.185.170.222:8080/
			http://157.7.164.23:8080/
			http://72.172.196.22:7080/
			http://213.112.99.246:7080/
			http://199.119.78.38:443/

	url	http://ajx3.com/akDJlHl	[Account Suspended] [any.run: https://app.any.run/tasks/f6eb602e-c088-4e63-b715-f68ab7d6ebdb]
	url	http://kazak.zendo.in.ua/7G4P	[Web page not found] [Any.run: https://app.any.run/tasks/a887a40a-beb5-41a8-b981-f1729d1c5613]
-------------------------------
Main object- "UK14024097_2018_07_22.doc"
	sha256	9eb5ebf4950818df9294072543535ab5bf97a9af906b2c14909a7c79445250cf
	sha1	424d456e7e8a09a1cddb821b8f7eeb9b0dc3effb
	md5	b591371308b94b1ca5545841fb64fbd7
DNS requests
	domain	suidi.com
	domain	spprospekt.com.br
	domain	regenerationcongo.com
	domain	sportpony.ch
	domain	procoach.jp
Connections
	ip	103.104.196.74
	ip	54.199.162.91
	ip	199.250.196.31
	ip	191.6.198.84
	ip	80.74.144.231
HTTP/HTTPS requests
	url	http://suidi.com/IdWaI
			C2:
			http://108.246.196.73/
			http://129.89.95.110/
			http://129.89.95.199/
			http://73.4.58.41/
			http://97.89.253.146/
			http://104.231.112.63:8080/
			http://71.52.70.233:8080/
			http://142.44.244.100/
			http://80.11.163.139:8080/
			http://86.191.189.233/
			http://65.175.135.119:8443/
			http://216.21.168.27:443/
			http://149.62.173.247:8080/
			http://71.214.17.130:443/
			http://203.45.160.97:8090/
			http://108.170.54.171:8080/
			http://69.203.91.33:8090/
			http://118.190.60.27:20/
			http://222.214.218.192:4143/

	url	http://spprospekt.com.br/WCH
			C2:
			http://129.89.95.110/
			http://108.246.196.73/
			http://129.89.95.199/
			http://97.89.253.146/
			http://71.52.70.233:8080/
			http://142.44.244.100/
			http://73.4.58.41/
			http://104.231.112.63:8080/
			http://65.175.135.119:8443/
			http://80.11.163.139:8080/
			http://216.21.168.27:443/
			http://86.191.189.233/
			http://71.214.17.130:443/
			http://108.170.54.171:8080/
			http://69.203.91.33:8090/
			http://203.45.160.97:8090/
			http://149.62.173.247:8080/
			http://118.190.60.27:20/
			http://71.244.60.231:4143/
			http://222.214.218.192:4143/
			http://194.88.246.242:443/
			http://50.92.101.60:465/
			http://199.119.78.9:443/
			http://78.47.182.42:8080/
			http://194.150.118.8:443/
			http://73.183.145.218:8443/
			http://97.105.96.246:7080/
			http://46.105.131.87/
			http://118.244.214.210:443/
			http://201.103.149.80:8080/
			http://46.105.131.69:8080/
			http://70.25.63.178:7080/
			http://157.7.164.23:8080/
			http://146.185.170.222:8080/


	url	http://sportpony.ch/R1c	[Web page not found] [Any.run: https://app.any.run/tasks/b656e2d4-b3d3-408d-bf5a-1485c89b4da2]
	url	http://regenerationcongo.com/imiK6	[OpenDir] [Webserver running but empty] [Any.run: https://app.any.run/tasks/3d33e036-b892-4acf-b2c5-fc90073fa0c9]

	url	http://procoach.jp/newfolde_r/Q8G8Tdg
			C2:
			http://108.246.196.73/
			http://129.89.95.110/
			http://129.89.95.199/
			http://97.89.253.146/
			http://73.4.58.41/
			http://104.231.112.63:8080/
			http://142.44.244.100/
			http://71.52.70.233:8080/
			http://80.11.163.139:8080/
			http://65.175.135.119:8443/
			http://216.21.168.27:443/
			http://149.62.173.247:8080/
			http://108.170.54.171:8080/
			http://71.214.17.130:443/
			http://86.191.189.233/
			http://222.214.218.192:4143/
			http://71.244.60.231:4143/
			http://118.190.60.27:20/
			http://69.203.91.33:8090/
			http://97.105.96.246:7080/
			http://73.183.145.218:8443/
			http://199.119.78.9:443/
			http://50.92.101.60:465/
			http://194.88.246.242:443/
			http://203.45.160.97:8090/
			http://201.103.149.80:8080/
			http://194.150.118.8:443/
			http://46.105.131.69:8080/
			http://118.244.214.210:443/
			http://46.105.131.87/
			http://78.47.182.42:8080/
			http://157.7.164.23:8080/
			http://27.50.89.209:8080/
			http://146.185.170.222:8080/
			http://199.119.78.38:443/
			http://70.25.63.178:7080/
			http://213.112.99.246:7080/
			http://72.172.196.22:7080/
---------------------------------------------
Main object- "HRI-Monthly-Invoice"
	url	http://www.groovezasia.com.mm/pdf/En_us/Purchase/HRI-Monthly-Invoice
	sha256	8ea83c07ae4a1c039413819c320e66c40f4e5728a7e0988551fb4896b0bfe0fe
	sha1	a652914d3548c63cdbeb2676ef316e2ec0381c80
	md5	3ba4a8e1667dc16bf26ca1451e32d265
DNS requests
	domain	www.ocyoungactors.com
	domain	inicjatywa.edu.pl
	domain	www.brands2life.b2ldigitalprojects.com
	domain	mironovka-school.ru
	domain	baute.org
Connections
	ip	198.71.233.87
	ip	104.236.33.143
	ip	212.192.193.2
	ip	69.65.3.251
	ip	79.96.84.157
HTTP/HTTPS requests
	url	http://www.ocyoungactors.com/NzGucd
			C2:
           http://97.89.253.146/
           http://108.246.196.73/
           http://129.89.95.199/
           http://129.89.95.110/
           http://104.231.112.63:8080/
           http://73.4.58.41/
           http://71.52.70.233:8080/
           http://142.44.244.100/
           http://65.175.135.119:8443/
           http://80.11.163.139:8080/
           http://86.191.189.233/
           http://216.21.168.27:443/
           http://149.62.173.247:8080/
           http://108.170.54.171:8080/
           http://71.214.17.130:443/
           http://203.45.160.97:8090/
           http://69.203.91.33:8090/
           http://118.190.60.27:20/
           http://71.244.60.231:4143/
           http://194.88.246.242:443/
           http://222.214.218.192:4143/
           http://73.183.145.218:8443/
           http://199.119.78.9:443/
           http://50.92.101.60:465/
           http://78.47.182.42:8080/
           http://118.244.214.210:443/
           http://97.105.96.246:7080/
           http://46.105.131.87/
           http://201.103.149.80:8080/
           http://46.105.131.69:8080/
           http://194.150.118.8:443/
           http://70.25.63.178:7080/
           http://72.172.196.22:7080/
           http://157.7.164.23:8080/
           http://199.119.78.38:443/
           http://27.50.89.209:8080/
           http://146.185.170.222:8080/
           http://213.112.99.246:7080/

	url	http://inicjatywa.edu.pl//c0j1N57
			C2:
           http://194.88.246.242:443/
           http://108.246.196.73/
           http://129.89.95.110/
           http://97.89.253.146/
           http://129.89.95.199/
           http://104.231.112.63:8080/
           http://73.4.58.41/
           http://142.44.244.100/
           http://65.175.135.119:8443/
           http://71.214.17.130:443/
           http://216.21.168.27:443/
           http://149.62.173.247:8080/
           http://203.45.160.97:8090/
           http://222.214.218.192:4143/
           http://71.244.60.231:4143/
           http://71.52.70.233:8080/
           http://118.190.60.27:20/
           http://86.191.189.233/
           http://108.170.54.171:8080/
           http://69.203.91.33:8090/
           http://80.11.163.139:8080/

	url	http://mironovka-school.ru/dvc
			C2:
		   http://97.89.253.146/
           http://129.89.95.110/
           http://129.89.95.199/
           http://108.246.196.73/
           http://71.52.70.233:8080/
           http://73.4.58.41/
           http://104.231.112.63:8080/
           http://80.11.163.139:8080/
           http://142.44.244.100/
           http://69.203.91.33:8090/
           http://65.175.135.119:8443/
           http://216.21.168.27:443/
           http://71.214.17.130:443/
           http://108.170.54.171:8080/
           http://86.191.189.233/
           http://149.62.173.247:8080/
           http://203.45.160.97:8090/
           http://118.190.60.27:20/
           http://222.214.218.192:4143/
           http://71.244.60.231:4143/
           http://194.88.246.242:443/
           http://199.119.78.9:443/
           http://50.92.101.60:465/
           http://73.183.145.218:8443/
           http://46.105.131.87/
           http://97.105.96.246:7080/
           http://194.150.118.8:443/
           http://201.103.149.80:8080/
           http://46.105.131.69:8080/
           http://157.7.164.23:8080/
           http://146.185.170.222:8080/
           http://27.50.89.209:8080/
           http://70.25.63.178:7080/
           http://78.47.182.42:8080/
           http://118.244.214.210:443/
           http://72.172.196.22:7080/
           http://213.112.99.246:7080/
           http://199.119.78.38:443/

	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
			C2:
           http://108.246.196.73/
           http://129.89.95.199/
           http://129.89.95.110/
           http://97.89.253.146/
           http://73.4.58.41/
           http://104.231.112.63:8080/
           http://142.44.244.100/
           http://71.52.70.233:8080/
           http://216.21.168.27:443/
           http://65.175.135.119:8443/
           http://80.11.163.139:8080/
           http://71.214.17.130:443/
           http://86.191.189.233/
           http://108.170.54.171:8080/
           http://149.62.173.247:8080/
           http://69.203.91.33:8090/
           http://71.244.60.231:4143/
           http://194.88.246.242:443/
           http://118.190.60.27:20/
           http://222.214.218.192:4143/
           http://203.45.160.97:8090/
           http://199.119.78.9:443/
           http://78.47.182.42:8080/
           http://46.105.131.87/
           http://50.92.101.60:465/
           http://97.105.96.246:7080/
           http://73.183.145.218:8443/
           http://118.244.214.210:443/
           http://194.150.118.8:443/
           http://201.103.149.80:8080/
           http://46.105.131.69:8080/
           http://157.7.164.23:8080/
           http://70.25.63.178:7080/
           http://199.119.78.38:443/
           http://146.185.170.222:8080/
           http://27.50.89.209:8080/

	url	http://baute.org/CkVAHWZ
			C2:
           http://129.89.95.110/
           http://108.246.196.73/
           http://129.89.95.199/
           http://97.89.253.146/
           http://73.4.58.41/
           http://104.231.112.63:8080/
           http://80.11.163.139:8080/
           http://142.44.244.100/
           http://71.52.70.233:8080/
           http://216.21.168.27:443/
           http://65.175.135.119:8443/
           http://86.191.189.233/
           http://149.62.173.247:8080/
           http://71.214.17.130:443/
           http://108.170.54.171:8080/
           http://118.190.60.27:20/
           http://69.203.91.33:8090/
           http://222.214.218.192:4143/
           http://71.244.60.231:4143/
           http://203.45.160.97:8090/
           http://199.119.78.9:443/
           http://194.88.246.242:443/
           http://73.183.145.218:8443/
           http://78.47.182.42:8080/
           http://97.105.96.246:7080/
           http://50.92.101.60:465/
           http://118.244.214.210:443/
           http://46.105.131.87/
           http://194.150.118.8:443/
           http://70.25.63.178:7080/
           http://201.103.149.80:8080/
           http://46.105.131.69:8080/
           http://146.185.170.222:8080/
           http://199.119.78.38:443/
           http://157.7.164.23:8080/
           http://72.172.196.22:7080/
           http://27.50.89.209:8080/
           http://213.112.99.246:7080/
--------------------------------------------
Main object- "Direct-Deposit-Notice"
	url	http://www.iqmauinsa.com/files/En_us/ACCOUNT/Direct-Deposit-Notice
	sha256	5c5de7d0665c5e4d758dff79f28f49439060968d7407d23fbd0e5765ae1afbd1
	sha1	9f564905d4bbc59dc2db45cf465befba2b430933
	md5	88f52e5f6440250d1ae641b828e380e0
DNS requests
	domain	www.ocyoungactors.com
	domain	inicjatywa.edu.pl
	domain	baute.org
	domain	www.brands2life.b2ldigitalprojects.com
	domain	mironovka-school.ru
Connections
	ip	104.236.33.143
	ip	198.71.233.87
	ip	212.192.193.2
	ip	69.65.3.251
	ip	79.96.84.157
HTTP/HTTPS requests [Duplicates]
	url	http://www.ocyoungactors.com/NzGucd
	url	http://inicjatywa.edu.pl//c0j1N57
	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
	url	http://mironovka-school.ru/dvc
	url	http://baute.org/CkVAHWZ
------------------------------------------
Main object- "Invoice-281035"
	url	http://micronet-solutions.com/sites/EN_en/ACCOUNT/Invoice-281035
	sha256	5c5de7d0665c5e4d758dff79f28f49439060968d7407d23fbd0e5765ae1afbd1
	sha1	9f564905d4bbc59dc2db45cf465befba2b430933
	md5	88f52e5f6440250d1ae641b828e380e0
DNS requests
	domain	inicjatywa.edu.pl
	domain	www.ocyoungactors.com
	domain	mironovka-school.ru
	domain	baute.org
	domain	www.brands2life.b2ldigitalprojects.com
Connections
	ip	104.236.33.143
	ip	198.71.233.87
	ip	212.192.193.2
	ip	69.65.3.251
	ip	79.96.84.157
HTTP/HTTPS requests [Duplicates]
	url	http://www.ocyoungactors.com/NzGucd
	url	http://inicjatywa.edu.pl//c0j1N57
	url	http://mironovka-school.ru/dvc
	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
	url	http://baute.org/CkVAHWZ
---------------------------------------------
Main object- "Payment"
	url	http://drspin.co.uk/default/EN_en/Payment-and-address/Payment
	sha256	c011dac61b378855f21de86fa5ed04e05f8d0c7dd2ac1a973af1bca5d027aee7
	sha1	0f19d303243802c8886283e22508664fff30109a
	md5	393c2cc801cf758fc518dfba8ebb68d5
DNS requests
	domain	inicjatywa.edu.pl
	domain	www.ocyoungactors.com
	domain	mironovka-school.ru
	domain	www.brands2life.b2ldigitalprojects.com
	domain	baute.org
Connections
	ip	104.236.33.143
	ip	198.71.233.87
	ip	69.65.3.251
	ip	212.192.193.2
	ip	79.96.84.157
HTTP/HTTPS requests [Duplicates]
	url	http://www.ocyoungactors.com/NzGucd
	url	http://mironovka-school.ru/dvc
	url	http://inicjatywa.edu.pl//c0j1N57
	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
	url	http://baute.org/CkVAHWZ
-----------------------------------------
Main object- "INV-51975928298.doc"
	sha256	b0a3467855aacfb4f21328b42362a13783050da6062818d1874a3c6e665233df
	sha1	c52223584a353aa789b323e601c6cd0ce25ae49b
	md5	b95cb9566691bc218f0fb77c2ef4144b
DNS requests
	domain	inicjatywa.edu.pl
	domain	www.ocyoungactors.com
	domain	www.brands2life.b2ldigitalprojects.com
	domain	mironovka-school.ru
	domain	baute.org
Connections
	ip	104.236.33.143
	ip	212.192.193.2
	ip	198.71.233.87
	ip	69.65.3.251
	ip	79.96.84.157
HTTP/HTTPS requests [Duplicates]
	url	http://www.ocyoungactors.com/NzGucd
	url	http://inicjatywa.edu.pl//c0j1N57
	url	http://mironovka-school.ru/dvc
	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
	url	http://baute.org/CkVAHWZ
--------------------------------------
Main object- "Invoice-61029"
	url	http://vii-seas.com/pdf/En/DOC/Invoice-61029
	sha256	224020e8ccf4c8625c4f51540470c064af551c6a9937eebb100b2e0a65b1c1d7
	sha1	733edaef9461688ebf05c8ecd7fb6bc0ca1123ce
	md5	ea661ff04cb11e70d2d341b2e3e608d6
DNS requests
	domain	inicjatywa.edu.pl
	domain	www.ocyoungactors.com
	domain	baute.org
	domain	mironovka-school.ru
	domain	www.brands2life.b2ldigitalprojects.com
Connections
	ip	198.71.233.87
	ip	69.65.3.251
	ip	212.192.193.2
	ip	104.236.33.143
	ip	79.96.84.157
HTTP/HTTPS requests [Duplicates]
	url	http://www.ocyoungactors.com/NzGucd
	url	http://inicjatywa.edu.pl//c0j1N57
	url	http://mironovka-school.ru/dvc
	url	http://www.brands2life.b2ldigitalprojects.com/wp-content/uploads/2017/Ma6
	url	http://baute.org/CkVAHWZ
--------------------------------------------
Main object- "FACT-KP-74964-2124.doc"
	sha256	fe336b0772b8cf39836d7294e9c566086818f31599f23fc1952a81a245f24674
	sha1	64ecba58056b4fcc6a40c736be53fbd87b120543
	md5	ed10147aaaa1f7db2d193d7cfb9ac424
DNS requests
	domain	www.mecanique-vivante.com
	domain	lucatek.com
	domain	markfilm.pl
	domain	loens-apotheke-im-facharztzentrum-verden.de
	domain	lumieres-vie-madagascar.fr
Connections
	ip	213.186.33.2
	ip	37.17.224.63
	ip	213.186.33.19
	ip	87.98.239.19
	ip	94.23.64.24
HTTP/HTTPS requests
	url	http://www.mecanique-vivante.com/QIeLsMUm
			C2:
		   http://187.192.180.144:995/
           http://67.68.235.25:50000/
           http://190.154.42.106:8080/
           http://110.142.247.110/
           http://189.207.27.120/
           http://189.157.20.25:8443/
           http://162.251.81.235:4143/
           http://104.236.24.85:8080/
           http://190.130.236.183/
           http://89.186.26.180:8080/
           http://24.244.177.40:8080/
           http://187.189.210.58:8080/
           http://62.212.34.102:8080/
           http://201.174.147.134:8080/
           http://49.212.135.76:443/
           http://189.153.146.187/
           http://148.240.32.203:443/
           http://37.120.175.15/
           http://27.109.24.214:443/
           http://200.124.245.125:443/
           http://80.227.184.182/
           http://210.2.132.43/
           http://133.242.208.183:8080/
           http://208.84.149.100:8080/
           http://89.186.26.179:8080/
           http://190.146.128.35:8080/
           http://173.175.79.89/
           http://203.198.129.4:8080/

	url	http://markfilm.pl/tbsMZRq
			C2:
           http://190.154.42.106:8080/
           http://67.68.235.25:50000/
           http://189.157.20.25:8443/
           http://187.192.180.144:995/
           http://189.207.27.120/
           http://104.236.24.85:8080/
           http://162.251.81.235:4143/
           http://110.142.247.110/
           http://190.130.236.183/
           http://24.244.177.40:8080/
           http://187.189.210.58:8080/
           http://89.186.26.180:8080/
           http://201.174.147.134:8080/
           http://189.153.146.187/
           http://62.212.34.102:8080/
           http://49.212.135.76:443/
           http://37.120.175.15/
           http://148.240.32.203:443/
           http://200.124.245.125:443/
           http://210.2.132.43/
           http://80.227.184.182/
           http://27.109.24.214:443/
           http://173.175.79.89/
           http://190.146.128.35:8080/
           http://133.242.208.183:8080/
           http://89.186.26.179:8080/
           http://208.84.149.100:8080/
           http://203.198.129.4:8080/


	url	http://lucatek.com/T9aG9LNRQ8
			C2:
		   http://187.192.180.144:995/
           http://67.68.235.25:50000/
           http://190.154.42.106:8080/
           http://189.157.20.25:8443/
           http://110.142.247.110/
           http://189.207.27.120/
           http://190.130.236.183/
           http://162.251.81.235:4143/
           http://104.236.24.85:8080/
           http://89.186.26.180:8080/
           http://24.244.177.40:8080/
           http://187.189.210.58:8080/
           http://62.212.34.102:8080/
           http://201.174.147.134:8080/
           http://49.212.135.76:443/
           http://37.120.175.15/
           http://189.153.146.187/
           http://148.240.32.203:443/
           http://200.124.245.125:443/
           http://27.109.24.214:443/
           http://80.227.184.182/

	url	http://lumieres-vie-madagascar.fr/KPeROw
			C2:
           http://67.68.235.25:50000/
           http://190.154.42.106:8080/
           http://187.192.180.144:995/
           http://189.157.20.25:8443/
           http://189.207.27.120/
           http://110.142.247.110/
           http://162.251.81.235:4143/
           http://104.236.24.85:8080/
           http://190.130.236.183/
           http://24.244.177.40:8080/
           http://187.189.210.58:8080/
           http://89.186.26.180:8080/
           http://62.212.34.102:8080/
           http://201.174.147.134:8080/
           http://189.153.146.187/
           http://37.120.175.15/
           http://49.212.135.76:443/
           http://148.240.32.203:443/
           http://200.124.245.125:443/
           http://210.2.132.43/
           http://27.109.24.214:443/
           http://80.227.184.182/
           http://133.242.208.183:8080/
           http://173.175.79.89/
           http://190.146.128.35:8080/
           http://208.84.149.100:8080/
           http://89.186.26.179:8080/
           http://203.198.129.4:8080/