Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Ursnif IOCs:
- Dropping URLS from juxe1.xap to juxe10.xap
- and from atri1.xap to atri10.xap
- http://wolthorifi.com/TYJ/wwnox.php?l=juxe1.xap
- http://yaticaterm.com/TYJ/wwnox.php?l=juxe3.xap
- http://aedictiect.com/TYJ/wwnox.php?l=atri4.xap
- http://weamosicad.com/TYJ/wwnox.php?l=atri3.xap
- http://madcoversite.com/mobile/dojsnad123.rar - 0/70 on VT
- https://www.virustotal.com/en/url/4ed62b8bac84fc42b0f8df70f4630fe1ba3a7796a63691db84b482ae37459dc5/analysis/
- Domains:
- wolthorifi.com
- yaticaterm.com
- aedictiect.com
- weamosicad.com
- madcoversite.com
- C2:
- qibrandiat.com
- hafthornaz.com
- alepronder.com
- ichrogeada.com
- ornicaropt.com
- dirminebat.com
- IPs:
- 54.36.137.118
- 54.36.137.119
- 54.36.137.120
- 54.36.137.121
- 54.39.218.118
- 54.39.218.119
- 54.39.218.120
- 54.39.218.125
- 54.39.218.126
- 54.39.218.127
Add Comment
Please, Sign In to add comment
