Главная страница » IOC
0
6 месяцев
IOC

Latrodectus Backdoor IOCs - VII

security

Unidentified 111 (он же: Latrodectus, BLACKWIDOW, Latrodectus, Lotus) - впервые обнаруженный в октябре 2023 года BLACKWIDOW представляет собой бэкдор, написанный на языке C, который взаимодействует по протоколу HTTP с помощью запросов, зашифрованных с помощью RC4. Вредонос способен выполнять команды обнаружения, запрашивать информацию о машине жертвы, обновлять себя, а также загружать и выполнять EXE, DLL или шелл-код. Предполагается, что вредонос был разработан LUNAR SPIDER, создателями вредоносной программы IcedID (она же BokBot).

Indicators of Compromise

IPv4 Port Combinations

  • 144.76.231.240:10000

Domains

  • bazarunet.com
  • greshunka.com
  • klemanzino.net
  • krinzhodom.com
  • leroboy.com
  • mazinom.com
  • tiguanin.com

URLs

  • http://161.97.170.81/ceptics/wp-content/plugins/share-private-fls/shared
  • http://185.219.220.149/bim.msi
  • http://188.119.112.115/DLPAgent.msi
  • http://193.203.203.40/vfs.msi
  • http://194.54.156.91/dsa.msi
  • http://azucania.com.ar/wp-content/plugins/share-private-fls/shared
  • http://besparta.com/markaworks/wp-content/plugins/share-private-fls/shared
  • http://dsengineer.in/wp-content/plugins/share-private-fls/shared
  • http://especial.cargasproprias.org/wp-content/plugins/share-private-fls/shared
  • http://gertioma.top/o.jpg
  • http://onemascot.com/wp-content/plugins/share-private-fls/shared
  • http://vridhifashions.com/wp-content/plugins/share-private-fls/shared
  • http://www.loja.consolata.pt/news/wp-content/plugins/share-private-fls/shared
  • http://www.skytechtraders.com/wp-content/plugins/share-private-fls/shared
  • https://790wolseleymanagement.com/wp-content/plugins/share-private-fls/shared
  • https://99homes.co/wp-content/plugins/share-private-fls/shared
  • https://aavishkaar-palampur.org/wp-content/plugins/share-private-fls/shared
  • https://abd.com.tr/wp-content/plugins/share-private-fls/shared
  • https://abhitaak.com/wp-content/plugins/share-private-fls/shared
  • https://alealealpargatas.com/wp-content/plugins/share-private-fls/shared
  • https://alsiga.com/wp-content/plugins/share-private-fls/shared
  • https://ariesjagnivas.com/wp-content/plugins/share-private-fls/shared
  • https://aryanlogisticpune.in/wp-content/plugins/share-private-fls/shared
  • https://bar.dosdevelopers.com/wp-content/plugins/share-private-fls/shared
  • https://bazarunet.com:8041/bazar.php
  • https://blog.multitamamedia.com/wp-content/plugins/share-private-fls/shared
  • https://brikule.cz/wp-content/plugins/share-private-fls/shared/?check=true
  • https://camerabaoha.com/wp-content/plugins/share-private-fls/shared/?check=true
  • https://christianbookindia.com/wp-content/plugins/share-private-fls/shared
  • https://compresoresdetornillo.com.pe/wp-content/plugins/share-private-fls/shared
  • https://contractnerds.com/wp-content/plugins/share-private-fls/shared
  • https://coronacreatives.com/wp-content/plugins/share-private-fls/shared
  • https://cricrapid.com/wp-content/plugins/share-private-fls/shared
  • https://cricrapid.com/wp-content/plugins/share-private-fls/shared/
  • https://cytotecsolutions.com/wp-content/plugins/share-private-fls/shared
  • https://deadvogados.com/wp-content/plugins/share-private-fls/shared
  • https://dealerpertamini.com/wp-content/plugins/share-private-fls/shared
  • https://delight.mv/wp-content/plugins/share-private-fls/shared
  • https://dhlawfirm.site/wp-content/plugins/share-private-fls/shared
  • https://dickypommini.com/wp-content/plugins/share-private-fls/shared
  • https://didacweb.xyz/intuitionbycg/wp-content/plugins/share-private-fls/shared
  • https://digitalpinnaclepub.com/?3
  • https://digitalssystems.com/wp-content/plugins/share-private-fls/shared
  • https://dimozti1.org/security_check/
  • https://djibg.eu/wp-content/plugins/share-private-fls/shared
  • https://dolasimuka.com/wp-content/plugins/share-private-fls/shared
  • https://doulosarts.com.br/wp-content/plugins/share-private-fls/shared
  • https://dpmpommini.com/wp-content/plugins/share-private-fls/shared
  • https://dreamhomesonali.com/wp-content/plugins/shortcurl/
  • https://ebs-company.xyz/wp-content/plugins/share-private-fls/shared
  • https://elitpuro1.com/wp-content/plugins/share-private-fls/shared
  • https://equranteacher.net/wp-content/plugins/share-private-fls/shared
  • https://espaciodiseno.es/wp-content/plugins/share-private-fls/shared
  • https://firebasestorage.googleapis.com/v0/b/case-419310.appspot.com/o/CZCzc1LrbT%2FDocument_b48_15w635167-5740247h6548-3238a9.js?alt=media&token=f0362973-0cf1-48c9-ae4c-8745ccf5e867
  • https://friendswekeep.vecloffy.co.za/vecloffy/wp-content/plugins/share-private-fls/shared
  • https://gaming-gears.com/wp-content/plugins/share-private-fls/shared
  • https://gifdemo.com/gps_sunum/wp-content/plugins/share-private-fls/shared
  • https://gifdemo.com/mertmetdemo/wp-content/plugins/share-private-fls/shared
  • https://goasoftwarecompany.com/Doxa_Organic/wp-content/plugins/share-private-fls/shared
  • https://greshunka.com:8041/admin.php
  • https://grupobudeguer.com/wp-content/plugins/share-private-fls/shared
  • https://guidespharma.com/wp-content/plugins/share-private-fls/shared
  • https://hadjer.boutique/wp-content/plugins/share-private-fls/shared
  • https://hakelectromechanical.com/wp-content/plugins/share-private-fls/shared
  • https://hawaiismartshopper.com/wp-content/plugins/share-private-fls/shared
  • https://himeraveteriner.com/himera-v1/wp-content/plugins/share-private-fls/shared
  • https://hunarghar.org.pk/wp-content/plugins/share-private-fls/shared
  • https://hvg.si/wp-content/plugins/share-private-fls/shared
  • https://infojobone.com/wp-content/plugins/share-private-fls/shared
  • https://isomicrotich.com/test/
  • https://ivtmarkets.com/wp-content/plugins/share-private-fls/shared
  • https://jarinamaers.shop/live/
  • https://jasarenovasibangunrumahmalang.com/wp-content/plugins/share-private-fls/shared
  • https://jms.edu.np/wp-content/plugins/share-private-fls/shared
  • https://jobsportal360.com/wp-content/plugins/share-private-fls/shared
  • https://joshiwater.com/wp-content/plugins/share-private-fls/shared
  • https://karamelitses.gr/wp-content/plugins/share-private-fls/shared
  • https://kartsiotis.net/wp-content/plugins/share-private-fls/shared
  • https://ladakhescapades.com/wp-content/plugins/share-private-fls/shared
  • https://lew-hoad.com/wp-content/plugins/share-private-fls/shared
  • https://lle.uz/wp-content/plugins/share-private-fls/shared
  • https://lurningbuff.com/wp-content/plugins/share-private-fls/shared
  • https://mahmoud-radwan.com/wp-content/plugins/share-private-fls/shared
  • https://manuurulwaahid.sch.id/wp-content/plugins/share-private-fls/shared
  • https://mathsclass.vn/wp-content/plugins/share-private-fls/shared/?check=true
  • https://mbdashcam.com/wp-content/plugins/share-private-fls/shared
  • https://meletesergon.gr/wp-content/plugins/share-private-fls/shared
  • https://mining.jaguarmall.in/code/core/database/press/wp-content/plugins/share-private-fls/shared
  • https://mixstore.com.mx/wp-content/plugins/share-private-fls/shared
  • https://mozkraty.org/wp-content/plugins/share-private-fls/shared
  • https://mundo-felpa.es/wp-content/plugins/share-private-fls/shared
  • https://mydesinger.com/wp-content/plugins/share-private-fls/shared
  • https://myquickandeasy.com/wp-content/plugins/share-private-fls/shared
  • https://narutoanimes.com/wp-content/plugins/share-private-fls/shared
  • https://new.botellaflaske.com/wp-content/plugins/share-private-fls/shared
  • https://nickicecream.gr/wp-content/plugins/share-private-fls/shared
  • https://nobledeals.co.ke/wp-content/plugins/share-private-fls/shared
  • https://nyklawyer.com/wp-content/plugins/share-private-fls/shared
  • https://opengameirar.com/test/
  • https://panakalresidence.com/wp-content/plugins/share-private-fls/shared
  • https://parthait.com/wp-content/plugins/share-private-fls/shared
  • https://patriziamarazzi.com/wp-content/plugins/share-private-fls/shared
  • https://pavicomsa.com/wp-content/plugins/share-private-fls/shared
  • https://penjualanpommini.com/wp-content/plugins/share-private-fls/shared
  • https://ponyevent.vn/wp-content/plugins/share-private-fls/shared
  • https://portstanleycalipso.com/wp-content/plugins/share-private-fls/shared
  • https://ptcmbp.com/wp-content/plugins/share-private-fls/shared
  • https://puntobar.cl/wp-content/plugins/share-private-fls/shared
  • https://rilomenifis.com/test/
  • https://sanvikevents.com/wp-content/plugins/share-private-fls/shared
  • https://shredderindia.com/wp-content/plugins/share-private-fls/shared/?check=true
  • https://slot.hoki66.com/wp-content/plugins/share-private-fls/shared
  • https://smartoptiontrade.online/account/wp-content/plugins/share-private-fls/shared
  • https://sociallysnap.com/wp-content/plugins/share-private-fls/shared
  • https://startmast.shop/live/
  • https://storage.googleapis.com/braided-turbine-435813-n7.appspot.com/R7qofdzG3K/Document-20-13-22.js
  • https://storage.googleapis.com/braided-turbine-435813-n7.appspot.com/VA8PBxartt/Document-20-17-57.js?
  • https://streetpulsedev.wpengine.com/wp-content/plugins/share-private-fls/shared
  • https://subwaymenu.uk/wp-content/plugins/share-private-fls/shared
  • https://summerlanddogtraining.com/wp-content/plugins/share-private-fls/shared
  • https://svango.com/wp-content/plugins/share-private-fls/shared
  • https://take3llcphotobooth.com/TakeNew/wp-content/plugins/share-private-fls/shared
  • https://templarstore.com/wp-content/plugins/share-private-fls/shared
  • https://template.majestic-corporation.com/wp-content/plugins/share-private-fls/shared
  • https://testing.vidharm.com/wp-content/plugins/share-private-fls/shared
  • https://thecocopacific.com/wp-content/plugins/share-private-fls/shared
  • https://themetafounders.com/web/chris-csp/wp-content/plugins/share-private-fls/shared
  • https://themusclemob.themetafounders.com/wp-content/plugins/share-private-fls/shared
  • https://things101dev.wpengine.com/wp-content/plugins/share-private-fls/shared
  • https://tiguanin.com:8041/bazar.php
  • https://tirtaningnusantara.com/wp-content/plugins/share-private-fls/shared
  • https://tomitakaengenharia.com.br/wp-content/plugins/share-private-fls/shared
  • https://toptradingoption.com/account/wp-content/plugins/share-private-fls/shared
  • https://tour.culturetoursja.com/wp-content/plugins/share-private-fls/shared
  • https://turkishmarinesurvey.com/wp-content/plugins/share-private-fls/shared
  • https://ubo8.cc/wp-content/plugins/shortcurl/
  • https://vcfiling.pk/wp-content/plugins/share-private-fls/shared
  • https://vhs.decospaacloud.in/wp-content/plugins/share-private-fls/shared
  • https://vilape.online/wp-content/plugins/share-private-fls/shared
  • https://vincecomfort.com/social/wp-content/plugins/share-private-fls/shared
  • https://vnfreetourguides.com/wp-content/plugins/share-private-fls/shared
  • https://vridhifashions.com/wp-content/plugins/share-private-fls/shared
  • https://warriorstaging.wpengine.com/wp-content/plugins/share-private-fls/shared
  • https://wecancity.org/ahmed/wp-content/plugins/share-private-fls/shared
  • https://wernugemar.com/test/
  • https://wisdomlawacademy.com/wp-content/plugins/share-private-fls/shared
  • https://wlfw.themetafounders.com/wp-content/plugins/share-private-fls/shared
  • https://www.bodegabudeguer.com/wp-content/plugins/share-private-fls/shared
  • https://www.crickrocket.com/wp-content/plugins/share-private-fls/shared
  • https://www.darkknight-media.com/tasawer/wp-content/plugins/share-private-fls/shared
  • https://www.eurotravel.com.gr/wp-content/plugins/share-private-fls/shared
  • https://www.ferentino.org/wp-content/plugins/share-private-fls/shared
  • https://www.fit4life.es/wp-content/plugins/share-private-fls/shared
  • https://www.hawaiiislandmidweek.com/wp-content/plugins/share-private-fls/shared
  • https://www.hitplus.fr/2018/click.php?url=https://cutt.ly/seU8MT6t#F8i_bfW
  • https://www.kathatours.com/wp-content/plugins/share-private-fls/shared
  • https://www.loja.consolata.pt/news/wp-content/plugins/share-private-fls/shared
  • https://www.meilinhotels.com/wp-content/plugins/share-private-fls/shared
  • https://www.qi-code.com/wp-content/plugins/share-private-fls/shared
  • https://www.tajimateknikservis.com/wp-content/plugins/share-private-fls/shared
  • https://www.tatuhirdavat.com/wp-content/plugins/share-private-fls/shared
  • https://www.topinoxsenegal.com/wp-content/plugins/share-private-fls/shared
  • https://www.valex-dz.com/wp-content/plugins/share-private-fls/shared
  • https://www.vccg.com.au/wp-content/plugins/share-private-fls/shared
  • https://www.wonderwritings.com/wp-content/plugins/share-private-fls/shared
  • https://youpickcarepackages.com/wp-content/plugins/share-private-fls/shared
  • https://zatracon.com/wp-content/plugins/share-private-fls/shared
  • https://zeemark.in/wp-content/plugins/share-private-fls/shared
  • https://zk1construction.com/wp-content/plugins/share-private-fls/shared

SHA256

  • 0a42503e19d36070db3b03249cad33c73ee941b7af32170f25234ac5f3a30823
  • 1b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa
  • 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
  • 2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb
  • 3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980
  • 3f7a5830f2edc0a5d6943b6a5eabe28f8e26a5ecd7a729495efc4f09f1500fc2
  • 47bb93ef08aaa7a067d06e44647e4707ae19b85de3f2ee665016b7ce57dd8119
  • 53e65d071870f127bc6bf6c8e8ddfd131558153513976744ee7460eeb766d081
  • 59eed9c82f60210e2a58df96fe1ab54a7bb96d2c5e7d5d3cc3b16de433b9958b
  • 5c7a3bd2baa8303354d8098b8d5961f111e467002bb0c6fee120825b32798228
  • 617e31e9f71b365fe69719d3fc980d763e827a4f93d0e776d1587d0bfdb47674
  • 677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470
  • 6ab1bee44804b0821933c7b20bbdc92deb6a21fd587a51d43761ba1500c2149d
  • a9fa025fe912c8ad5e6566c675e045732c4d89f4187bfd94c4e916dd9fe25417
  • af0fe3b31d44de22f067f8f2c17cbfc88598d734b3f4d767b90480d3b53a334c
  • bb9203ca1305e47a2ec1443a640efcd5e2c7d11223184639729673579e12967e
  • e31eaa04f39c59b97532303ae0cd41ddf8a24295bad8956d92b618b66bfecd1c
  • f60c7e2cd7078584e1fb2eacd6270c314f1e23f76a4cd78c5d13eec215f0e41c
  • fcb578b52a686ed9b202295cbae84e20e0533caa4f8b6fffce6ee9f74ce33268
Комментарии: 0
Похожие записи
0
9 дней
IOC

Latrodectus Backdoor IOCs - Part 15

security
Unidentified 111 (он же: Latrodectus, BLACKWIDOW, Latrodectus, Lotus) - впервые обнаруженный в октябре 2023 года BLACKWIDOW представляет собой бэкдор, написанный на языке C, который взаимодействует по
0
26 дней
IOC

Необычные вредоносные программы последнего времени

security
В последнее время эксперты компании Palo Alto Networks обнаружили несколько новых образцов вредоносного программного обеспечения (ВПО), обладающих уникальными характеристиками, что затрудняет их атрибуцию и определение функциональности.