Vidar_IOCs_2019-12-02_12_04.txt

#Vidar #Arkei  #malware #OSINT #IOC

MD5s:
151395ebfa539a612c85f039cb1a9dd7
6cb7ff4bb6571b869116da769524b89b
b826bb2b62dab956a48a12d4e27ea3a5

IPs:
104[.]123[.]71[.]136
104[.]123[.]71[.]144
104[.]123[.]71[.]152
104[.]123[.]71[.]155
161[.]117[.]178[.]42
167[.]172[.]184[.]185
185[.]132[.]53[.]138
192[.]35[.]177[.]64
205[.]185[.]216[.]10
205[.]185[.]216[.]42
208[.]95[.]112[.]1
72[.]0[.]765[.]121
8[.]208[.]24[.]200

Domains:
bitbucket[.]org
fastupdate1[.]top
fastupdate2[.]top
fastupdate3[.]top
fastupdate4[.]top
foxupdate1[.]me
foxupdate2[.]me
homeporno228[.]com
legion17[.]com
thepleasurelive[.]com

URL:
http://bitbucket[.]org/discover-please/go/downloads/setup_c[.]exe,
http://bitbucket[.]org/fairlike/cloud/downloads/setup_c[.]exe,
http://bitbucket[.]org/fastuploads/2019/downloads/CLIPPER[.]exe,
http://bitbucket[.]org/fastuploads/2019/downloads/mix[.]exe,
http://bitbucket[.]org/fastuploads/2019/downloads/setup_m[.]exe,
http://fastupdate1[.]top/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2,
http://fastupdate1[.]top/gate1[.]php?a=true,
http://fastupdate2[.]top/test/eu/1[.]exe,
http://fastupdate2[.]top/test/eu/2[.]exe,
http://fastupdate3[.]top/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2,
http://fastupdate3[.]top/gate1[.]php?a=true,
http://fastupdate4[.]top/test/eu/1[.]exe,
http://fastupdate4[.]top/test/eu/2[.]exe,
http://foxupdate1[.]me/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2,
http://foxupdate1[.]me/gate1[.]php?a=true,
http://foxupdate2[.]me/test/eu/1[.]exe,
http://foxupdate2[.]me/test/eu/2[.]exe,
http://homeporno228[.]com/api/check[.]get,
http://homeporno228[.]com/api/gate[.]get?p1=0&p2=9&p3=0&p4=0&p5=0&p6=0&p7=0&p8=0&p9=0&p10=XHGYtnGxLbn5h53ucC3NqXTa9DEhjUNoO2na,
http://homeporno228[.]com/api/gate[.]get?p1=0&p2=9&p3=0&p4=0&p5=0&p6=0&p7=0&p8=0&p9=1&p10=EVqmsXu6Nb2qkIqLWzfcvnbY7ys3yC0GYyfY7w==,
http://legion17[.]com/legion17/welcome,
http://thepleasurelive[.]com/,
http://thepleasurelive[.]com/237,
http://thepleasurelive[.]com/399,
http://thepleasurelive[.]com/freebl3[.]dll,
http://thepleasurelive[.]com/freebl3[.]dll?ddosprotected=1,
http://thepleasurelive[.]com/mozglue[.]dll,
http://thepleasurelive[.]com/msvcp140[.]dll,
http://thepleasurelive[.]com/nss3[.]dll,
http://thepleasurelive[.]com/softokn3[.]dll,
http://thepleasurelive[.]com/vcruntime140[.]dll,