MalwareBreakdown's Pastebin

9,254 45,284 4 years ago

Name / Title	Added	Expires	Hits	Syntax
08/10/2020: ZLoader Campaign IOCs	Aug 10th, 2020	Never	5,100	None	-
08/05/2020: ZLoader Campaign IOCs	Aug 5th, 2020	Never	6,418	None	-
07/20/2020: ZLoader Campaign IOCs	Jul 20th, 2020	Never	2,515	None	-
07/17/2020: ZLoader Campaign IOCs	Jul 17th, 2020	Never	3,937	None	-
07/15/2020: ZLoader Campaign IOCs	Jul 15th, 2020	Never	1,959	None	-
07/14/2020: ZLoader Campaign IOCs	Jul 14th, 2020	Never	1,729	None	-
07/09/2020: ZLoader Campaign IOCs	Jul 9th, 2020	Never	1,477	None	-
07/08/2020: ZLoader Campaign IOCs	Jul 8th, 2020	Never	2,471	None	-
07/07/2020: ZLoader Campaign IOCs	Jul 7th, 2020	Never	2,323	None	-
07/06/2020: ZLoader Campaign IOCs	Jul 6th, 2020	Never	2,429	None	-
07/02/2020: ZLoader Campaign IOCs	Jul 2nd, 2020	Never	1,972	None	-
07/01/2020: ZLoader Campaign IOCs	Jul 1st, 2020	Never	1,716	None	-
06/29/2020: ZLoader Campaign IOCs	Jun 29th, 2020	Never	1,252	None	-
06/25/2020: ZLoader Campaign IOCs	Jun 25th, 2020	Never	1,893	None	-
06/24/2020: ZLoader Campaign IOCs	Jun 24th, 2020	Never	1,395	None	-
06/23/2020: ZLoader Campaign IOCs	Jun 23rd, 2020	Never	1,912	None	-
06/22/2020: ZLoader Campaign Switches to OSTAP!	Jun 22nd, 2020	Never	184	None	-
06/19/2020: ZLoader Campaign IOCs	Jun 20th, 2020	Never	1,955	None	-
06/18/2020: ZLoader Campaign IOCs	Jun 18th, 2020	Never	2,129	None	-
06/10/2020: ZLoader Campaign IOCs	Jun 10th, 2020	Never	1,392	None	-
06/05/2020: ZLoader Campaign IOCs	Jun 5th, 2020	Never	1,819	None	-
06/01/2020: ZLoader Campaign IOCs	Jun 1st, 2020	Never	944	None	-
05/27/2020: ZLoader Campaign IOCs	May 27th, 2020	Never	1,306	None	-
05/26/2020: ZLoader Campaign IOCs	May 26th, 2020	Never	834	None	-
05/25/2020: ZLoader Campaign IOCs	May 25th, 2020	Never	824	None	-
05/04/2020: ZLoader Campaign IOCs	May 4th, 2020	Never	700	None	-
04/22/20: ZLoader DGA Domains	Apr 22nd, 2020	Never	158	None	-
04/21/20: ZLoader IOCs	Apr 21st, 2020	Never	163	None	-
ZLoader IOCs	Apr 20th, 2020	Never	1,052	None	-
04/20/20: ZLoader DGA Domains	Apr 20th, 2020	Never	1,095	None	-
04/17/20: ZLoader DGA Domains	Apr 17th, 2020	Never	606	None	-
04/16/20: ZLoader DGA Domains	Apr 16th, 2020	Never	713	None	-
04/15/20: ZLoader DGA Domains	Apr 15th, 2020	Never	599	None	-
04/14/20: ZLoader DGA Domains	Apr 14th, 2020	Never	725	None	-
Typosquatting, ZeroPark, and RIG EK	Oct 9th, 2019	Never	4,430	None	-
Recent LokiBot and AZORult IOCs	Aug 25th, 2019	Never	4,499	None	-
Emotet 05/16/18	May 16th, 2018	Never	431	None	-
Untitled	Apr 9th, 2018	Never	310	None	-
03/21/18 Pre-landing page	Mar 21st, 2018	Never	1,791	None	-
Emotet	Mar 13th, 2018	Never	302	None	-
Unpacked pre-landing page	Mar 11th, 2018	Never	1,525	None	-
Unpacked	Mar 11th, 2018	Never	1,512	None	-
RIG EK Pre-Landing Page	Mar 7th, 2018	Never	1,581	None	-
Untitled	Mar 1st, 2018	Never	414	None	-
PI2983793.doc macro	Jan 9th, 2018	Never	1,680	None	-
invoice_327504.doc macro	Sep 11th, 2017	Never	247	None	-
Chrome_Font.js	Sep 6th, 2017	Never	272	None	-
Mozilla_Font.js	Sep 6th, 2017	Never	287	None	-
Downloader from 08/28/17	Aug 30th, 2017	Never	202	VBScript	-
Decoded & cleaned "Roboto Condensed" Social Engineering Page	Aug 30th, 2017	Never	288	None	-
Static properties of Ramnit sample	Aug 21st, 2017	Never	509	None	-
Cleaned and commented IMG_1391.js from GlobeImposter malspam	Aug 8th, 2017	Never	366	None	-
1.bat	Aug 7th, 2017	Never	249	None	-
194.58.60.51/usa/	Jul 5th, 2017	Never	267	JavaScript	-
Photo.js from RELST campaign	Jun 28th, 2017	Never	216	None	-
POST request from Pushdo/Cutwail botnet	Jun 27th, 2017	Never	549	None	-
RELST domain holyxxxmamapumpum.pw	Jun 6th, 2017	Never	276	JavaScript	-
JS from RELST campaign	Jun 6th, 2017	Never	227	JavaScript	-
Domains registered to support@alialiservices.com	Jun 5th, 2017	Never	774	None	-
Photo.js deobfuscated and commented	Jun 5th, 2017	Never	275	JavaScript	-
Photo.js	Jun 5th, 2017	Never	293	JavaScript	-
miragenotax.pw	Jun 5th, 2017	Never	261	None	-
Obfuscated ArialFont JScript file	Jun 5th, 2017	Never	297	JavaScript	-
sennymotial[.]pw	Jun 5th, 2017	Never	434	None	-
ad code script found on 333sport.info	Jun 4th, 2017	Never	389	JavaScript	-
Original landing page	Mar 7th, 2017	Never	973	None	-
RIG's new pre-landing page	Mar 7th, 2017	Never	387	None	-
Commented JavaScript from RIG's pre-landing page	Mar 7th, 2017	Never	342	None	-
Cleaned and commented JavaScript	Feb 19th, 2017	Never	298	None	-
stockholmads.info, returns RIG EK "pre-landing" page	Feb 19th, 2017	Never	246	None	-
Original full file	Feb 19th, 2017	Never	342	None	-
JavaScript	Feb 19th, 2017	Never	228	None	-
Compromised sites led to fake Flash Player download	Feb 11th, 2017	Never	620	None	-
pseudoDarkleech script	Sep 22nd, 2016	Never	250	None	-
Malspam zip'd .wsf leads to Locky (.zepto)	Sep 3rd, 2016	Never	237	None	-
Rig EK Landing Page	Sep 2nd, 2016	Never	446	None	-
Untitled	Aug 4th, 2016	Never	244	None	-
90.156.141.35	Feb 11th, 2016	Never	190	None	-
79.175.182.138	Feb 11th, 2016	Never	302	None	-
190.97.163.155	Feb 11th, 2016	Never	180	None	-
Query for the following IPs and the domains the resolved to	Feb 7th, 2016	Never	717	None	-
Query for 185.31.208.233 and 185.31.208.236 on 2/7/2015	Feb 7th, 2016	Never	182	None	-
Query for the 85.143.217.70 and 85.143.217.214 on 2/7/2015	Feb 7th, 2016	Never	194	None	-
Query for the 94.156.77.41 and 94.156.77.57 on 2/7/2015	Feb 7th, 2016	Never	188	None	-
Query for the following IPs/domains on 2/7/2015	Feb 7th, 2016	Never	2,055	None	-
Query for 62.4.23.6 on 2/7/2015	Feb 7th, 2016	Never	186	None	-
Query for 62.4.23.4 on 2/7/2015	Feb 7th, 2016	Never	190	None	-
Untitled	Feb 7th, 2016	Never	172	None	-