From d8b79ff39759521fb227ea59bb22d32ff25d2189 Mon Sep 17 00:00:00 2001 From: StrangerealIntel <54320855+StrangerealIntel@users.noreply.github.com> Date: Mon, 7 Oct 2019 23:47:15 +0200 Subject: [PATCH] Update Malware Analysis 04-10-2019.md --- .../04-10-2019/Malware Analysis 04-10-2019.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/cybercriminal groups/TA505/04-10-2019/Malware Analysis 04-10-2019.md b/cybercriminal groups/TA505/04-10-2019/Malware Analysis 04-10-2019.md index db1ff7c..c7c5c14 100644 --- a/cybercriminal groups/TA505/04-10-2019/Malware Analysis 04-10-2019.md +++ b/cybercriminal groups/TA505/04-10-2019/Malware Analysis 04-10-2019.md @@ -100,6 +100,23 @@ |windows-wsus-en.com|Domain C2| |Xerox Scan_84676113847687.XLS|8741346FB8D6C2F4CA80FA2B176F162AF620F86C5FFC895C84346BE22BDAA976| |Xerox.csv|566745CE483F3DC1744C757DD7348CE0844BAF5DB8CDF28F242CCD86B91496C0| +|151.139.237.11|IP Requested| +|162.125.66.1|IP Requested| +|172.217.16.141|IP Requested| +|45.63.11.216|IP Requested| +|54.83.52.76|IP Requested| +|96.44.166.189|IP Requested| +|a78e87d350c8cf3f6d7db126c5fadd7d837aef23df01194fc0973561cd20818e.xls|A78E87D350C8CF3F6D7DB126C5FADD7D837AEF23DF01194FC0973561CD20818E| +|C:\Users\admin\AppData\Roaming\libMongo1.dll|4414195087F01719270AE41F45953139CAF2F24A10C96D56EB28EA6601DD17E0| +|C:\Users\admin\Downloads\request.xls|34242C2D4A3EF625A6DA375B85B34A3FD3CAFB04442A438378D1153FD355159C| +|dropbox-download.com|Domain Requested| +|hxxps://dropbox-download[.]com|HTTP/HTTPS requests| +|hxxps://dropbox-download[.]com/?05041770570340|HTTP/HTTPS requests| +|hxxps://dropbox-download[.]com/?05610068412737|HTTP/HTTPS requests| +|hxxps://dropbox-download[.]com/?35277620367160|HTTP/HTTPS requests| +|hxxps://dropbox-download[.]com/download.php|HTTP/HTTPS requests| +|request.xls|A78E87D350C8CF3F6D7DB126C5FADD7D837AEF23DF01194FC0973561CD20818E| +|windows-msd-update.com|Domain C2| ###### This can be exported as JSON format [Export in JSON](https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/cybercriminal%20groups/TA505/04-10-2019/IOC_TA505_07-10-19.json)