2019-09-20-danabot-iocs

* VBS network connections:
194.32.78[.]85:443
31.214.157.14:80

* Domains:
minopells[.]xyz|194.32.78[.]85
seioooi[.]xyz|31.214.157[.]14

* Domains found in Explorer.EXE memory:
buismashallah[.]at
ey7kuuklgieop2pq[.]onion

* URLs found in Explorer.EXE memory:
hxxp://shoshanna[.]at/images/eEfnxMewtb/I9AeYNwCfQwIkCRhm/J1IBuvozvG67/pg_2Fy9xcSI/_2BcFNX0PkJz5t/6rTcnU_2B99DMTDSnXxUo/fcYxNb7xVXRxkiUw/nCLQNj8qHQqYQiY/biGuPIoNP_2F_2BlbN/exCxLKQJy/YIjke6u6Rx4nDEdET

* Explorer.EXE network connections:
151.251.23[.]210:80
79.136.8[.]168:80

* DNS records for Explorer.exe query for shoshanna[.]at:

shoshanna.at: type A, class IN, addr 201.189.177.2
shoshanna.at: type A, class IN, addr 46.209.12.222
shoshanna.at: type A, class IN, addr 151.251.23.210
shoshanna.at: type A, class IN, addr 91.201.175.46
shoshanna.at: type A, class IN, addr 124.195.215.242
shoshanna.at: type A, class IN, addr 31.5.167.149
shoshanna.at: type A, class IN, addr 217.27.35.117
shoshanna.at: type A, class IN, addr 197.255.225.117
shoshanna.at: type A, class IN, addr 89.215.216.77
shoshanna.at: type A, class IN, addr 37.34.225.14

and

shoshanna.at: type A, class IN, addr 79.136.8.168
shoshanna.at: type A, class IN, addr 188.254.186.158
shoshanna.at: type A, class IN, addr 95.158.162.200
shoshanna.at: type A, class IN, addr 201.189.177.2
shoshanna.at: type A, class IN, addr 46.10.66.102
shoshanna.at: type A, class IN, addr 46.237.80.152
shoshanna.at: type A, class IN, addr 151.251.23.210
shoshanna.at: type A, class IN, addr 37.247.216.118
shoshanna.at: type A, class IN, addr 91.201.175.46
shoshanna.at: type A, class IN, addr 188.112.188.207

* At later stage there were webinjects in Explorer.EXE memory with this domain:
vaunuty[.]online