Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- So far I've seen this trojan being dropped by Emotet or coming from malspam with password protected docs.
- Domains:
- automatically.site
- charolined.pw
- cimedaorb.pw
- dekcod.host
- delborp.pw
- detnuorhposol.pw
- detpek.pw
- dluow.pw
- ecneuq.host
- econofsky.pw
- egalfnoc.pw
- ekaew.host
- eltta.host
- emirpa.host
- esehsilpxe.pw
- foxpartsearch.com
- freshwallet.at
- gnirra.pw
- hondt.whitefide.com
- iamther.org
- ipswine.pw
- labadegmc.com
- lanoj.pw
- listmyfloor.com
- litsiniog.pw
- logan.exchange
- nrevig.host
- obediently.site
- outsidered.pw
- resuminia.pw
- ruolf.host
- seirfa.pw
- snoissenert.pw
- stsigoloib.pw
- tfulf.host
- vipnow.live
- whoisther.com
- ylnomed.pw
- ytilac.pw
- controved.pw
- stencident.host
- outsidered.pw
- Fast Flux network:
- 104.223.76.206
- 178.21.8.42
- 185.65.202.12
- 185.101.94.40
- 185.129.49.19
- 185.174.173.140
- 185.197.75.161
- 185.223.163.26
- 185.238.136.67
- 188.120.236.10
- 195.69.187.56
- 198.251.83.27
Add Comment
Please, Sign In to add comment
