Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Dropping URLs:
- http://pivactubmi[.]com/tyclam/fressr.php?l=creb[1-14].tkn
- http://abderfiene[.]com/tyclam/fressr.php?l=creb[1-14].tkn
- http://kicensinfa[.]com/tyclam/fressr.php?l=wike[1-14].tkn
- http://abeelepach.com/tyclam/fressr.php?l=wike[1-14].tkn
- C2:
- aershariar.com
- biesbetiop.com
- roqualdlio.com
- zardinglog.com
- imminesenc.com
- zosmogroel.com
- qibricrias.com
- sycingshbo.com
- kircherche.com
- toforemedi.com
- IPs:
- 46.30.42.99
- 46.29.160.75
- 82.146.62.41
- 137.74.220.12
- 162.244.32.180
- 185.246.155.131
- 185.174.172.247
- 194.58.56.29
- 194.58.56.36
- I also noticed that all of the recent domains are registered to the same email [email protected], so here is the list of all the domains associated with this address, which lexically matched previous Ursnif/Gozi domains:
- abderfiene.com
- acondrotsa.com
- aershariar.com
- altwativar.com
- aornallace.com
- bancreacor.com
- biesbetiop.com
- buxementer.com
- caentivage.com
- cibcbanks.com
- cibcbanks.net
- coenessmor.com
- dekatamato.com
- dewirasute.com
- fileisafe.com
- foonvelera.com
- foxerwoman.com
- hazzanaphi.com
- isatawatag.com
- janunterse.com
- jimatankot.com
- jimptendon.com
- kammorogan.com
- killoberil.com
- ledibermen.com
- levocumbut.com
- meeflutret.com
- mochigokat.com
- nublatoste.com
- pivactubmi.com
- potoshihar.com
- rapworeepa.com
- roqualdlio.com
- sototokoto.com
- sutogeneor.com
- tolinatogr.com
- tubpariang.com
- usteouraph.com
- wegatamata.com
- whestraper.com
- zardinglog.com
Add Comment
Please, Sign In to add comment
