Pterodo_Backdoor_IoC's_02-09-2019

#Pterodo #Backdoor #Trojan
-----------------------------
02-09-2019
-----------------------------
Main object- "49243f52ea56a3624f6fee8a2f7a916d0b97eb4fd08de760440be108439d52c9.bin.gz"
	sha256	e20898fc9e691fb8bd4788d53d380efa4fd5bfbc7d78b5b4720c9ba3646e4872
	sha1	36cc4ea06cc1b1da02c3b95756f3a807a96a803b
	md5	2bf8d2a23705af43b4f4f3680bfe90e8
Dropped executable file
	sha256	C:\Users\admin\Desktop\49243f52ea56a3624f6fee8a2f7a916d0b97eb4fd08de760440be108439d52c9.bin	49243f52ea56a3624f6fee8a2f7a916d0b97eb4fd08de760440be108439d52c9
	sha256	C:\Users\admin\AppData\Roaming\23623.txt	a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
DNS requests
	domain	kornet-ua.ddns.net
Connections
	ip	188.225.24.161
HTTP/HTTPS requests
	url	http://kornet-ua.ddns.net/