IOC - Ongoing Ursnif Banking Trojan Phishing Campaign

IOC

File DOC MD5:
0D8C0A37B1B502873A0A915D0559135C
139103391187F1815002EE459CA18944
214670C43C9B1C7F0524DE99250CFB33
34FAF0E34C1F6A7AFA74CFC2466665C1
443A64E67A101511A1DD4D87010608A5
5BA5395AF7CE040A969CD535FF4CB867
5C17450FE11900385DAE2025FBF5AA7B
66577CE10DD7550D1DD54B6DFA409A4B
681682169C7B4DC4483C9B8F7F75AE1F
75F7DB9C8DBDC98BCB91D78FD435F8C2
8D0D64BADBEC02F341BE3A0B96EAEEEE
969293C0C6A1F7F265378C3A4E806610
9A8D25B71308168FD357B44E6507C2C9
9DF418676FA409B76DAA6D08EACC83D9
A154FFF1572D8FB67AD37491449DF487
A2626EB7F114E2B999AAF52ED3167B47
B3DDC826D65BDBAEF52EAC5524B95860
B82A0C08DF847470B21FA81EEEA2D918
C33DE58C333AFF4A107DAC6D6317D580
C4A209B5BE703675E8233A109AA3FEB0
C778CC39B58BCA11558074A9C3D600D4
D7F273320534BE032819F4A8AC5BB2D8
D96C3D656D7A6FB252344AB3553D082B
DCAA0663FFB4858479B9A2DAE3651A98
E614754DA733BFC4F41E2D191170242F


File EXE MD5:
A51E01AEA30DE8B559438D2CFC051AF0


URL:
http://krqweugmjasndasidhnjqwewq[.]com/ANY/itpros.class
http://krqweugmjasndasidhnjqwewq[.]com/ANY/itprosa.class
http://krqweugmjasndasidhnjqwewq[.]com/ANY/itprosb.class
http://krqweugmjasndasidhnjqwewq[.]com/ANY/itprosc.class
http://krqweugmjasndasidhnjqwewq[.]com/ANY/itprosd.class
http://krqweugmjasndasidhnjqwewq[.]com/NOIT/testv.php?l=itmaker1.class
http://krqweugmjasndasidhnjqwewq[.]com/NOIT/testv.php?l=itmaker2.class
http://krqweugmjasndasidhnjqwewq[.]com/NOIT/testv.php?l=itmaker3.class
http://krqweugmjasndasidhnjqwewq[.]com/NOIT/testv.php?l=itmaker4.class
http://krqweugmjasndasidhnjqwewq[.]com/NOIT/testv.php?l=itmaker5.class