Redaman_Trojan_IOCs_06-02-2019

#Redaman #Trojan
-----------------------
06-02-2019		IOC's
-----------------------
Main object- "b0b865f0fd6cea141d23cb00d6c3b909fd361f633a11c9ff7adb964288f9a745.bin.gz"
	sha256	27d8c78b82530e26d001d84fdd8a5a6e94d8b3c428ea29a183fc8400e20eb69d
	sha1	b3e352e515931d6a32e139c8dd808e2ba2581f3e
	md5	526b5ba068a5439c86b968ad2588f9dd
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Temp\Rar$EXa1036.1989\Çàêðûâàþùèå äîê-û ôåâðàëü.exe	df86acbc23343f0634fed0c78464ba72cb7f0ad58c7b68232f349a5a68b5c7bb
	sha256	C:\Users\admin\AppData\Local\Temp\AB8.tmp	48f7706ea1cf48f53bcd1c14186c1e572f2e70ad6dc9277ed69d90bf025ec476
DNS requests
	domain	peername.net
	domain	namecoin.cyphrs.com
Connections
	ip	52.36.204.116
	ip	93.123.80.47
	ip	185.203.117.161
	ip	188.165.200.156
HTTP/HTTPS requests
	url	http://185.203.117.161/index.php