2020-03-30 Ursnif(Dreambot) infection chain using RIGEK

<Date>
2020-03-30

<Subject>
Ursnif(Dreambot) infection chain using RIGEK via Malvertising target Japan

<Compromised>
makemoneyeazzywith.me

<RIG Landing>
109.68.213.130

<Smokeloader C2>
bealkian.today
ferymspaniumryou.today
offwhiteoallrightou.today
tophundretgoods.today

<Ursnif Payload C2/MD5>
girlaina.fun
6A0D71295E1F71A2F7FA7EB4DA12C0CA

<Ursnif(Dreambot)C2 Domain>
alfabanjrrd.agency
bsberbakh.agency
cdastroitod.today
cmguffiong.today
dampometiktd.today
dstopdaltdsd.agency
glmrakobesad.agency
ilupitdrope4.agency
lbusinesd.agency
lkakaushkid.agency
lostellazikdht.today
lotlybankied.agency
mozetradugis.today
nlembdasd.agency
pikazanhsd.agency
schepsdik.today
slaungdt.today
sstrousihhsd.agency
ssvetleitef.today
stanetvsemxs.today
stkraevoirdslf.today
tasinhromiidw3.agency
ymulenrougas.agency

<Config>
soft=3
version=214131
server=12
id=4011
crc=1