Mekotio 17112021

**** PRESENTE INFORMACIÓN HA SIDO COMPARTIDA CON FINES DE INVESTIGACIÓN ****

IoC Nueva campaña Troyano "Mekotio"

1.- Origen de la amenaza:

De:	Serviciodepagos-15403996
Fecha:	17 nov 2021 11:13
Asunto:	✅ Fwc: ¡Advertencia! Factura Vencida. - ( 302258451469 )

Return-Path: <[email protected]>
Received: from hostlaraz (static.89.42.69.159.clients.your-server.de. [159.69.42.89])


2.- Entrega:

http://viv.az/112021/16/005SB33FF/00/?id/AQMkADAwATYwMAItZjIyAGUtZGU5My0wMAItMDAKAEYAAAON7YLP5Z99SqeVMkDuw
http://www.kekovapansiyon.com/itp/files/winmail/cache.php
http://www.kekovapansiyon.com/itp/files/winmail/
http://www.jeanbryan.com.br/capa/smoothness/datepicker/09S506/00202C308077T605SS1B9.zip

3.- Instalación:

0dc9eaae5216a434ad59013f4dabcd572e17cde2d9b1ec4703102934b33ff8e8 --> 00202C308077T605SS1B9.zip
5049d61d59d9b84fed1d97ff90519fd6745766b592291182c964b9bacce884c7 --> 00F10L16065ST33B09852C30Q.msi
9a4d6a98b4c0be4155203af12110ea0f61d475eeb258b8b4e40102c9fe0c4f92 --> H006S201105092A6mH.msi
19f9a30d2df3b278b1df0a0cdc13f11ca5f535488c5311475947f3e90a573e97 --> YwdZPqtYXR.dll

4.- Comando y control:

015b786e6e592477d2ddb6f84293f896eeb8e4da12987185ebc98d5ff6affaa0
01a247845af95531ef5012382ff65ef8f4fb44e78d600d15068fd767aa64ed6c
038a26eb245195b1d26263fce335704b8bffa3dd03080da10907eabaa21186ff
0407e903168c11958dfbf43d4efb4aaeed19e66779caac25e7aa5762fb349965
19ed743f57ebc813a9de0281466bd5b03ae60e98f1493f7e80101c521b27686b
21600fb5703667feb508c77fbe9d0b9fad421c5a9e4f3e8d74d40ae51cc640f8
2467b67f742d6c3594aa5ac38c18214bac0716b8d75372d8168019da58d669d8
25520a467e690b88443ac92016cdd8b3d1de38b4b584179f46469812ba0e2c0f
27800695ed3438ff5047caf59d7ebff15f4b66cbd972c64005ad7f7e37a8876a
290ba968d4653b73196dbddd85b04f16ac5f189847ae44d719a0073f6c720250
29dad20b7cabb9b5f6959c2513832e3233730dd5cdfe005a8b08f89b62eec924
2c787051be4f1703d79e082875739eac475560c8f03b89afd51b04a0ad12b792
2e618b3701cdff2f027d249c7a4bca75143ce6a87c80823b2bf025b336cb890c
336247155c2df59f0d3ed0e6ebabbe9f2a5abcaaedc24844fabeba77564a82eb
3d86aff13acfc782c050a5969139cbc60f19fbd91edb7a4d2cbb85131a4829da
3ee64076abfce7f9d1b5749ac7dafbfd163370526f3e15fcc479595ffdadf0bc
43c0ce8424ab15c0c1009590ddee7853d231cf26e944a96b61fa1640fd72d570
47818488083e71b442ebc937ae7fd9fc6718c4ea5197e8a167142a72c7b7c28b
51e2f21ef6cd1b2b01b8d1f815f282b53a57beba58eedc576c905e4f8d6ce1c1
5531352f18b8786d46bfe1ded1a8371520aa60a4d54eba07733285452e8b175e
5603e3f86f280ce316efdc58f209a1ea3aa2b50ab66db9dcdfb46178bbbf201c
567f1072794ba7bb26f8fe2f4f545230b09c9dc63e3bc83249920e6c5dc65fdf
57c64237eb0b783532b02ea42ef830832f69ef1d33da5ca10a22731758d4374a
5976626aa6cf532602d27d54e1d9cb392072d811930d0c424f1de7abb4398cde
5b297640deb80f12daf8d64da02be95a635b1ef50d7c09732fe79d75bf9e536b
6387b0eebe19bc4e876519a809f5254c441d813497b2e8604c332c469d447ba9
63e62c7cf1ab51fb8ed5dea2d1284625d559b57a6a70f31cca031e37cae36f8d
650330d3fd2c29b7eee449da3165c4b5c62054f55c186f66138ae75a8ef92681
69920f2d5a6536bc2a5323ba6db13c2de48eaf2fe11b653c62b1ca91d498fc90
7021274e1819acb4f8411b4b5c859acfa247a27f23b6a9aa7a624f170aa54c1a
79931783fb2eff8b059995733289dc6b99c891e7150105846f3c022b552c9385
7b21bf9fc3e8d504a1f42726985d3da1c212f33e664b9fbcc50318eda9690f84
90aa78845f5f5379be2ab01edc5a7820bf2d3a44116298183409699ef44694d5
a1500f6b703939570435f0b8a0e7f5a507e4b58e1a8f12e42a1adf28e91419bd
a867b08a91450491a1a7bac89b087e743c9dc68edc8c37f2fa320b609485c5bd
ad9aee2cbddadf5a8aa59b94126e582bb9461e946a14158bb60e4bcd6cb8f908
b81529e2236128e20c14aefb65ce56e094def1998b8ead92049936cfe7b2761b
bb9439dd2cd67502cdc9754cafabb82dbff73b22cffdafcc47890a8eb4500bc6
c81c61f77031c6d0d7c61c1ffb5d16dd55353a24db2705144ba1840319e75f4c
ca129db5e3671e7b12fc361677b64d2f9887b21883c3cf6cf41a7b4d24b46b26
cb14fc8dbec3ddee6f482babb0794f034c72ccc493a8c044a585b115a4fea6a2
cf854a1170792d25a4afec6911255c031c48fab850c4601d3efaeda72438553b
cff54654d6e8ddff22e89a8d6864aa0b78e1fe2b88368d044071c88c19ce49e0
d3076e44022b3efeba99f58ef91fab7d945eeb9115403a9839917521766ecbfe
d315048848a43aacf4a5e96f149f9db9c7b339c2c433af8f62f92eb482ae66cf
db18b5a34159015bde509719e407d3e8f221f7a015acc74bb9e2db9b8d04ada4
db5656d22c755eaa87b71f1dd60f5c2e0271d6e0d526a418cf8a11c6bd57e049
dd0ea55da46affcddd0baee7e88f0864df8f092c99a59dcda90e42aeb32f0794
dd5cd169e5b5ef25b567d6a9be31ca138dc50d3c9eb1f0c24d04d2feb2b0f197
de57254bd0666f24fd53eb20131a3432a832bc0e9c5dd7c6e466003a526421fc
e768d9025f36ffca3816f05fbffad797bbfe80209a22078963e3f1adf433a1cc
f40aafc5d94871800f4bc920b50b634286f95aa236c3bfdf6a539935d999a6a2
f7ecff5e51e867320253845beb51b0c7442b07a4795b9f3447aa8adcd8b302eb
f83d754078f73af1eb60a4a7d19ecfaa165939996b6d5330b8c4692c216acabf
f964a0ae87b94c862f9624062f023d552c88d928c088bdfcd0cb6daa146b3525
fdcb621b320b1964e43a97dbff00beb95cdab6af21978d32cfab5ec5582c4002

34.117.59.81
canary.discord.com
81.59.117.34.bc.googleusercontent.com
blog.discord.com
bugs.discord.com
discord.com
click.discord.com
customer-connect1.com
feedback.discord.com
gateway.discord.gg
host.io
http://ipinfo.io/json
i18n.discord.com
ifconfig.me
ipinfo.dev
ipinfo.io
iresponse.tech
l2.discord.com
maltego.ipinfo.io
myexternalip.com
pax.discord.com
pixel.ipinfo.io
printer.discord.com
ptb.discord.com
safety.discord.com
staging2.ipinfo.io
staging.ipinfo.io
status.discord.com
streamkit.discord.com
support-dev.discord.com
support.discord.com
utukku.net
www.discord.com
www.fuckmyip.com
www.host.io
www.ifconfig.me
www.ipecho.net
www.ipinfo.dev
www.ipinfo.io
www.myexternalip.com
zendesk1.discord.com
zendesk2.discord.com
zendesk3.discord.com
zendesk4.discord.com