IOCs 30_6_2021

 






(1)

File Name

PO#EIMG_501367089.pdf.exe

Created process

PO#EIMG_501367089.pdf.exe

Connected (Ip/Dns)

www[.]mortgagemegloans[.]com, www[.]blueathue[.]com, www[.]bexleyheathdmcc[.]xyz, www[.]fourcornersfreight[.]com, www[.]xgegqs[.]com, www[.]beckerconta[.]com

MD5

3844b2ba67af80e3d7d7253122644810

SHA256

93eb2094dae2d9f36e52bc880594818e203973d1e62e2b2db76cd39804ff0323

Family

Formbook

 


(2)

File Name

Sridhar Insurance Broker P LTD Profoma Invoice.exe

Created process

Sridhar Insurance Broker P LTD Profoma Invoice.exe

Connected (Ip/Dns)

www[.]scopio[.]info, www[.]norcalppe[.]net, www[.]juniornesbitt[.]com, www[.]coderoy[.]com, www[.]cotruyenmochoa[.]xyz, www[.]cotruyenmochoa[.]xyz, www[.]penetrationtest[.]pro, www[.]rx-jl[.]com

MD5

27eebb17c78baf4ec67d92802a3b1544

SHA256

9015a3d36c6f378e870487b60ae7854376f55d0959444303691fb4f51d7b7420

Family

Formbook

 

(3)

File Name

Shipping docs 956-09 & Delivery.r00

Created process

Shipping docs 956-09 & Delivery.exe

Connected (Ip/Dns)

www[.]pantheoncases[.]com, www[.]blogafonte[.]com, www[.]eclorui[.]com, www[.]wwwgraciescottage[.]com, www[.]navyugitsolutions[.]com, www[.]angelademarco[.]com, www[.]thecode[.]community, www[.]rhexlux[.]com, www[.]bidatauction[.]net, www[.]hardrock[.]site, www[.]88q858[.]com, www[.]kate[.]chat, www[.]thepassiveincomecreator[.]com

MD5

8c6c7579ec387dd807ff19406fa59b1f

SHA256

8f1b5ca4327254de68549660364615e722dfd1a12f1a101a239fb918d9734dc5

Family

Formbook

 

(4)

File Name

Urgent! confirmation of Invoicepayment.exe

Created process

Urgent! confirmation of Invoicepayment.exe

Connected (Ip/Dns)

www[.]softwarefully[.]com, www[.]burnvioletinternational[.]com, www[.]lessismoreee[.]com, www[.]databolism[.]com, www[.]sneakyhenry[.]com, www[.]x1699[.]com, www[.]sems-iress2016[.]com, www[.]floraseriestrilogy[.]com, www[.]theatricsvirtual[.]com

MD5

5d795e196dd6a162a9316480acff2f6d

SHA256

72c6697907363b49b380a98519bd1301562ed640b1d4d98f5a4bc08cddeb5ab7

Family

Formbook

 

(5)

File Name

facturas y datos bancarios.PDF____________________________________.bat

Created process

facturas y datos bancarios.PDF____________________________________.bat.exe

Connected (Ip/Dns)

63[.]141[.]228[.]141/32[.]php/a1NQk98eWCWX2

MD5

677e43a1196be7e0a774a6745fb411e3

SHA256

aa08b9395415b671ca5c4d36a90bb6b6c241f18ba211f93408c10231c3b04ba6

Family

Lokibot

 

(6)

File Name

RFQ202106VR2.pdf.exe

Created process

RFQ202106VR2.pdf.exe

Connected (Ip/Dns)

apponline97[.]ir

MD5

65de792976737dd35343b2f30ba93dd2

SHA256

0ecc2f2a0346ca13361092909a8587927ab52b9532ae7b6d69367546369b31bd

Family

Lokibot

 

(7)

File Name

Zahtjev za ponudu 29·06·2021·pdf.exe

Created process

Zahtjev za ponudu 29·06·2021·pdf.exe

Connected (Ip/Dns)

63[.]141[.]228[.]141/32.php/S7zr5v1fXI3Rb

MD5

b403a643dc65aa6e5e1a2fede3ceda29

SHA256

c603192b53053eae5e0dbe579efb44d9ede6ff0f6874a7a7586ade0dcffc7072

Family

Lokibot

 

(8)

File Name

EOU907665787754.COM.exe

Created process

EOU907665787754.COM.exe

Connected (Ip/Dns)

pakilogs2020[.]xyz

MD5

b70e5ba1d460943683b625756ca68d64

SHA256

0970bb89de66cfb334d0d4d55f92c0f62aee871728218dd9945454697ba13252

Family

Lokibot

 

(9)

File Name

INV+QUOTATION #1053517.06.2021.jpeg.exe

Created process

INV+QUOTATION #1053517.06.2021.jpeg.exe

Connected (Ip/Dns)

79[.]134[.]225[.]7

MD5

94e7faab20f782e0819089d7493b9f83

SHA256

b00853366a3a3c03d3ba03c880c07e974efbb4525b0967d54cd3295f1d8d46c9

Family

Nanocore

 


(10)

File Name

PROFORMA INVOICE.doc

Created process

PROFORMA INVOICE.doc.exe

Connected (Ip/Dns)

Tzitziklishop[.]ddns[.]net[.]xyz

MD5

ee4f0ee74e0170c7ae1733210d7f1a79

SHA256

dbb9a8d74695467d8275771763de5a45deb0f32d32b107af9c7fd50a0113316e

Family

Nanocore


(11)

File Name

COVID-19-TEST-fdp.scr

Created process

COVID-19-TEST-rcs.pdf.exe

Connected (Ip/Dns)

6[.]tcp[.]ngrok[.]io

MD5

9c460f535bce6d3a8f4775be6e15fe67

SHA256

9ac2eebb6058f29156d1847b34be9a1970df8f45a51c6ee604218ca5171915aa

Family

Quasar RAT


(12)

File Name

60dc99_Outbyte-PC-Repa.zip

Created process

UKuwXoarX5zMhmpHdpqNANFv.exe

Connected (Ip/Dns)

Motiwa[.]xyz, uyg5wye[.]2ihsfa[.]com, rdanoriran[.]xyz, api[.]ip[.]sb, g-partners[.]top, zedaumalev[.]xyz, game2030[.]site

MD5

13cb1e4f2926e4c7665df454e67cb582

SHA256

40a2d7b3a8e780edc2f28414a45f63adaa5481c9cad7d316731c235967179e20

Family

Vidar


(13)

File Name

RFQ-20210629.gz

Created process

RFQ-20210629.exe

Connected (Ip/Dns)

box5363[.]bluehost[.]com

MD5

458673f84273c31c51385239c702baec

SHA256

afa146b598814bc0d04bbea34a992eddd67ff4eac850497e5eb0c1a27a8eb895

Family

Agent Tesla


(14)

File Name/Url

035e286f0b1c50844dcf7dccb7312036.exe

Created process

035e286f0b1c50844dcf7dccb7312036.exe

Connected (Ip/Dns)

Icando[.]ug, nothinglike[.]ac[.]ug, lizzzqua[.]ac[.]ug, lizard[.]ac[.]ug

MD5

035e286f0b1c50844dcf7dccb7312036

SHA256

69e75e57bc4a09c9a3d7726b28423d10df5b0224177ebfa43930668efd0af5da

Family

Azorult


(15)

File Name

3f1eb883bca3190418d1905ed4b017f4.vir

Created process

3f1eb883bca3190418d1905ed4b017f4.vir.exe

Connected (Ip/Dns)

Abemuggs[.]com/forum/viewtopic.php

MD5

3f1eb883bca3190418d1905ed4b017f4

SHA256

ac4662fd3a9989138cdd56723d590b1ae41de9b55e497368d601d9e747fa1a83

Family

Pony


(16)

File Name

3f1eb883bca3190418d1905ed4b017f4.vir

Created process

3f1eb883bca3190418d1905ed4b017f4.vir.exe

Connected (Ip/Dns)

Abemuggs[.]com/forum/viewtopic.php

MD5

3f1eb883bca3190418d1905ed4b017f4

SHA256

ac4662fd3a9989138cdd56723d590b1ae41de9b55e497368d601d9e747fa1a83

Family

Pony

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA



Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Phishing Attacks 9_4_2021

Conti Ransomware