Malware IOC 20201217

Malware IOC 20201217
LokiBot
HASH
60e1a1e1cfb4c93fe83656a4b8347463

URL
hxxp://gulshanti[.]com/wp-admin/five/fre.php

FormBook
HASH
951d2b772ffeb027748d1b36f99a9a55
1562becba4f926150ced8f08a42c9111

C&C
www.saindustrialhemp[.]com

AZORult
HASH
fd939a3904f193104bb985b3bb4700d9
8ffafa832e6e9a941c2b87a7c75d6d27

C&C
paratuseventos[.]cl

Cyberpunk勒索病毒
HASH
21983453453435435738912738921

NanoCore RAT
HASH
cf43cb75fa3dda2a2365c2bcd963f822
0adc904560849ea95779be034c12e4da

C&C
hawkloger.shortcm[.]li
corsi111.myq-see[.]com

buerloader
HASH
64196c73fde1578c805cd9175aab70e5
18cb83fa82fb14788d5a1cbafcd9bb28

URL
hxxp://149.3.170[.]55/sd-lod/servises.exe

qbot
HASH
0ab5d82db3541b40b3ef56d03efe8a3f
c300a4f9d885116a4ebf30250dbda77e

Covid-20勒索病毒
HASH
6cd502e46b712ac7984fe3c9f694dfec1fa6d3552f80db8502ca18d30050053f

Parrot勒索病毒
HASH
E558A2A844DA6F98239B46ED54DFED87

Credential Stealer
HASH
a1f2606102e59bbc1a6de8912378821e83c32f31f6a402e8f3993ef966746b07
dd3087a377ee3d1959f6c17b1b13e5972d1783dfd708bd084150e44c30e3af6e
d8483908dc0a18c4b51bfe962279816c910fedbad1961e5c5ed081c250cc5f76
1994f37501d7fc3038129db09babc5ef67d5ab4c93a95b3b59bf2b5ffa1592ff
0078c476753613a78ff9e8f621fd28c1279c0981d519c44212b9d02e5fb4c81c
bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd
27d9eb869eea6c713c6f109eca867844e2feceb0783bda2b78f7a92dffc833f6

C&C
93.115.23[.]48
94.103.94[.]186
2.56.215[.]97
199.192.29[.]202
5.39.223[.]162

Ursnif
C&C
fortiol[.]com

DangerousPassword APT
HASH
bfd2bbfbd00f6164ad08d088a407240f

URL
hxxps://drive.google[.]com/file/d/1WDRu9W9B_47Uundpnr0jL1do2hY9E5dP/view

Kimsuky APT
HASH
fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b

URL
hxxp://www.hahae[.]co[.]kr/new3/ISAF/Libs/php/cross.php?op=1&dt=1214&uid=01