Vidar_IOCs_2019-11-28_14_12.txt

#Vidar #Arkei #malware #OSINT #IOC

MD5s:
2f3376d35213ff2bab75eebc1d03f860
ad389201c02e4edbeff9b26be6b0ea58
b25319df966068115875420ca1a82d57
d1519f6b5a5acb5065917f13916deb18

IPs:
104[.]123[.]71[.]144
104[.]123[.]71[.]152
104[.]123[.]71[.]155
13[.]107[.]4[.]50
167[.]172[.]184[.]185
18[.]205[.]93[.]0
18[.]205[.]93[.]1
18[.]205[.]93[.]2
185[.]132[.]53[.]138
192[.]35[.]177[.]64
205[.]185[.]216[.]10
208[.]95[.]112[.]1
67[.]27[.]97[.]126
72[.]0[.]343[.]121
8[.]208[.]24[.]200


Domains:
bitbucket[.]org
crarepo[.]com
ddtupdate1[.]top
ddtupdate2[.]top
homeporno228[.]com
legion17[.]com
sslupdate1[.]top
sslupdate2[.]top

URL:
http://167[.]172[.]184[.]185/choto/forty2711_00_million10_6cr33[.]exe,
http://bitbucket[.]org/discover-please/go/downloads/setup_c[.]exe,
http://bitbucket[.]org/fastuploads/2019/downloads/setup_m[.]exe,
http://crarepo[.]com/,
http://crarepo[.]com/237,
http://crarepo[.]com/83,
http://crarepo[.]com/freebl3[.]dll,
http://crarepo[.]com/freebl3[.]dll?ddosprotected=1,
http://crarepo[.]com/mozglue[.]dll,
http://crarepo[.]com/msvcp140[.]dll,
http://crarepo[.]com/nss3[.]dll,
http://crarepo[.]com/softokn3[.]dll,
http://crarepo[.]com/vcruntime140[.]dll,
http://ddtupdate1[.]top/gate2[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=28,
http://ddtupdate1[.]top/gate2[.]php?a=true&ssid=with_out_sid,
http://ddtupdate2[.]top/test/us/1[.]exe,
http://ddtupdate2[.]top/test/us/2[.]exe,
http://homeporno228[.]com/api/check[.]get,
http://homeporno228[.]com/api/gate[.]get?p1=0&p2=9&p3=0&p4=0&p5=0&p6=0&p7=0&p8=0&p9=1&p10=EVqmsXu6Nb2qkIqLWzfcvnbY7ys3yC0GYyfY7w==,
http://legion17[.]com/legion17/welcome,
http://sslupdate1[.]top/gate1[.]php?a=bbed3e55656ghf02-0b41-11e3-8249id=2,
http://sslupdate1[.]top/gate1[.]php?a=true,
http://sslupdate2[.]top/test/eu/1[.]exe,
http://sslupdate2[.]top/test/eu/2[.]exe,