IOCs 29_6_2021

 








(1)

File Name

sa.exe

Created process

sa.exe

Connected (Ip/Dns)

4[.]tcp[.]ngrok[.]io

MD5

30b1a6fd0d23ef282bf3ed037a0260e0

SHA256

4996bb255f3e794df30758e1e75fe544abe40aefe7d77a1d777619aa41c1d8d6

Family

njRAT

 


(2)

File Name

Invoice.exe

Created process

Invoice.exe

Connected (Ip/Dns)

www[.]jinshifj[.]com, www[.]rep[.]place, www[.]xn--egegncel-95a.com, www[.]thehindufestival[.]com, www[.]plny[.]xyz, www[.]23237a2371.info, www[.]daviddelavariservices[.]space, www[.]ollipsisparents.com

MD5

a540145448761c79d6aa512a1db384ad

SHA256

b500e490e3aed21ac17d1bd9fe295628a6fc2682613f6971b765373b8ee706f6

Family

Formbook

 

(3)

File Name

PO_DEA83657-ARF.doc.7z

Created process

PO_DEA83657-ARF.doc.exe

Connected (Ip/Dns)

www[.]devastateclo[.]com, www[.]janbosun.com, www[.]keochatluong.com, www[.]420rankings[.]com, www[.]lindsaysgill[.]com, www[.]heatingandairtulsa[.]com, www[.]secretpal[.]club, www[.]the427group[.]com,

MD5

8c6c7579ec387dd807ff19406fa59b1f

SHA256

8f1b5ca4327254de68549660364615e722dfd1a12f1a101a239fb918d9734dc5

Family

Formbook

 

(4)

File Name

Predracun je prilozen.zip

Created process

Predracun je prilozen.exe

Connected (Ip/Dns)

www[.]tempestchs[.]com, www[.]garnier.red, www[.]drainthe.com, www[.]zzful[.]com, www[.]cursosaprovados[.]com, www[.]sumaholesson.com, www[.]msmenders[.]com, www[.]spacecoasthondaevent[.]com, www.aztecnort[.]com, www[.]rbcoq[.]com,

MD5

9edfba1d6330213ca6459f6f6b4da8fa

SHA256

23da27bac1030552416242a052e2500e49ffe811a518468126a402cbd48ed1e9

Family

Formbook

 

(5)

File Name

datos bancarios y facturaa.pdf____________________________________________________.bat.exe

Created process

datos bancarios y facturaa.pdf____________________________________________________.bat.exe

Connected (Ip/Dns)

63[.]141[.]228[.]141,

MD5

f1f1d8afa0035746d2e0b48683d86ba3

SHA256

b633c2d7add6d107541f26935e6a6e864ed9e6ededbab7fd0aedcb7dd3f3bc80

Family

Lokibot

 

(6)

File Name

FINAL INVOICE.doc

Created process

FINAL INVOICE.exe

Connected (Ip/Dns)

katchobinnas[.]duckdns[.]org, zzeroirt[.]duckdns[.]org

MD5

beb701c8c9a2a0c6ca4d963ed427de0b

SHA256

3f9f1f9f7da54d10ec218399a2e099dca56961d8c01f52e196d0cfd442c2194d

Family

Nanocore

 

(7)

File Name

DHL_PARCEL.exe

Created process

DHL_PARCEL.exe

Connected (Ip/Dns)

79[.]134[.]225[.]55

MD5

fedaefc7272e361867145848cb35c246

SHA256

82c4be21fed9665af735f8e13d650bae8fc9c0c59c80535969e8158b9c857d9e

Family

Nanocore

 

(8)

File Name

purchase order.exe

Created process

purchase order.exe

Connected (Ip/Dns)

ericfresh[.]duckdns[.]org

MD5

83ca7702d915e168ba1d680fbdfa13bf

SHA256

1cc4f59fef33a8415be46074aeb2f596c736d26364ef20fa53c6915968c48640

Family

Nanocore

 

(9)

File Name

Rules & Regulation (IRR)_pdf.exe

Created process

Rules & Regulation (IRR)_pdf.exe

Connected (Ip/Dns)

cato[.]fingusti[.]club

MD5

21a48450c02033c7ec5c7a689e5b5c63

SHA256

009a336f3bae013c379a21bcfdbbcd9642984cb613dbe59ccff8d2e7c50c32b3

Family

Remcos

 

(10)

File Name

2trb2FUS3fxN17iYK6_CiJp8.exe

Created process

2trb2FUS3fxN17iYK6_CiJp8.exe

Connected (Ip/Dns)

freeprivacytoolsforyou[.]xyz

MD5

08ca0e52948460c5c2f82791a1ddb2fc

SHA256

6a91a4affa1ec1e4e06492a200ed0365f21a2576f065852944fd7fb362ed1370

Family

Vidar


(11)

File Name

saa.exe

Created process

saa.exe

Connected (Ip/Dns)

monoshock[.]ddns[.]net

MD5

0bed72242ce8533b9ee47bddc30e568a

SHA256

47aff55c9ce118566b557e9866ae0445f90393fb5338886ede0b2fcc0a4d94d7

Family

Quasar RAT


(12)

File Name

AL Naser General Services PO609521.exe

Created process

AL Naser General Services PO609521.exe

Connected

oksuc[.]com/wp-admin/ncexnq/

MD5

c6099579a1d9cbe8a747a46fce3e0907

SHA256

b6ff5d41d744f289b0e536d5e7c244490ade99fcc44772d645648e6c9f769a6c

Family

Agent Tesla


(13)

File Name

Enquiry ref. MMJKM10113691.exe

Created process

Enquiry ref. MMJKM10113691.exe

Connected (Ip/Dns)

mail[.]totalkitchensandbathrooms[.]com[.]au

MD5

dc3417726e196240cf5b03bb00561e6e

SHA256

ebf2bf210764dcaf2ee0019cca80cc1c0f147671635bae9371c421d170794c29

Family

Agent Tesla


(14)

File Name/Url

https://keygenit.com

Created process

I_O0MPKND84NX5r.exe

Connected (Ip/Dns)

kvaka[.]li

MD5

dc3417726e196240cf5b03bb00561e6e

SHA256

ebf2bf210764dcaf2ee0019cca80cc1c0f147671635bae9371c421d170794c29

Family

Azorult



If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA


Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Phishing Attacks 9_4_2021

Conti Ransomware