Авторы вредоносного ПО внесли в XLoader, чтобы скрыть инфраструктуру C2. Теперь стало сложнее обнаружить реальные серверы C2 среди легитимных доменов, используемых Xloader в качестве "дымовой завесы". XLoader является преемником Formbook и дважды обновлялся с момента предыдущей публикации CPR о XLoader.
Indicators of Compromise
IPv4
- 162.0.214.189
- 162.0.216.5
- 162.0.216.71
- 162.0.222.70
- 162.0.223.146
- 162.0.223.94
- 162.0.224.219
- 162.0.225.82
- 162.0.231.105
- 162.0.231.244
- 162.0.233.154
- 162.0.233.84
- 162.0.238.116
- 162.0.238.238
- 162.213.253.206
- 192.64.116.180
- 198.54.112.103
- 199.188.206.146
- 199.192.17.24
- 199.192.18.217
- 199.192.23.164
- 199.192.23.209
- 199.192.25.68
- 199.192.26.170
- 199.192.28.149
- 199.192.29.43
- 199.192.29.61
- 199.192.30.112
- 199.192.30.127
- 199.192.30.202
- 199.192.30.247
- 199.192.31.5
- 31.220.18.33
- 45.132.241.87
- 45.15.25.154
- 63.250.44.164
- 66.29.130.171
- 66.29.133.181
- 66.29.140.185
- 66.29.142.52
- 66.29.142.85
- 66.29.143.39
- 66.29.145.216
- 66.29.154.112
- 66.29.154.157
- 66.29.155.108
- 66.29.155.250
- 66.29.155.51
- 68.65.121.125
- 68.65.121.46
Domains
- abros88.com
- alpeshpate.com
- amenosu.com
- aminsfy.com
- ammarus.com
- arabatas.com
- arches2.com
- b8ceex.com
- ban-click.com
- bantasis.com
- becbares.com
- becu84ts.com
- bendisle.com
- beputis4.com
- berdisen.com
- besasin09.com
- binbin-ads.com
- blackbait6.com
- blendeqes.com
- bra866.com
- bracunis.com
- brasbux.com
- brass-tip.info
- breskizci.com
- bubu3cin.com
- budistx.com
- buge-link.com
- bumabagi.com
- bupis44.info
- buresdx.com
- busipe6.com
- busy-clicks.com
- butsins.com
- butuns.com
- cablinqee.com
- catdanos.com
- ceser33.com
- cesiesis.com
- ci-ohio.com
- cinasing.com
- click-tokens.com
- coalmanses.com
- cobere9.com
- cures8t.com
- cusio3c.com
- cusmose.com
- cutos2.com
- dain6544.com
- dashmints.com
- davinci65.info
- dempius.com
- ducer.info
- dugerits.com
- earches3.com
- erisibu85.com
- fellasies.com
- fendoremi.com
- finsith.com
- finsits.com
- fraiuhs.com
- funtabse.com
- gamusemenu.com
- gate334.com
- gesips.com
- gimbases.com
- gingure.com
- gogoma3.com
- gulebic.com
- gunnipes.com
- heinousas.com
- high-clicks.com
- high-clicks2.com
- highpacts.com
- hugefries3.com
- hughers3.com
- hype-clicks.com
- jervinse.com
- keepitng.com
- kraines3.com
- lopsrental.lease
- mecitiris.com
- mimihin.com
- minimi36.com
- minismi2.com
- moreosin.com
- motarasag.com
- motarase.com
- motometics.com
- moukse.com
- munixc.info
- n4sins.com
- nerosbin.info
- neurosise.com
- nifaji.com
- norllix.com
- noun-bug.com
- nropes.com
- nu865ci.com
- nutri6si.com
- ocvcoins.com
- pedorc.com
- piecebin.com
- plick-click.com
- pordges.com
- price-hype.com
- private-clicks.com
- probinns.com
- ranbix.com
- range4tis.com
- rap8b55d.com
- rapibest.com
- rastipponmkh.com
- recbi56ni.com
- redandseven.com
- sacremots.com
- saint444.com
- sanfireman.info
- sasanos.com
- seo-clicks6.com
- serenistin.com
- side-clicks.com
- tangodo9.info
- tes5ci.com
- travelsagas.com
- trc-clicks.com
- tumpiums.com
- wecuxs.com
MD5
- 8d85df16ced80502c796649e4c806d31
- ce866938b246a89fd98fc6a6f666d21c
- f891f22cd94c80844fcfe6fddb4b7912
SHA256
- 041992cc47137cb45d4e93658be392bb82cdc7ec53f959c6af4761d41dfc9160
- 59048fa3b523121866f79a8a2f7a3c9c7cf609a98be5a1ec296030de2353d559
- 77ed8c0589576ecaf87167bc9e178b15da57f7b341ea2fda624ecc5874b1464b
- 862fba20ce7613356018ca44f665819522f862f040b34410a58892229aba6d9c
- a7023d5b16691b20334955294a80c10d435e24048f6416d1b3af3c58d0b48954
- c3bf0677dfcb32b35defb6650e1f81ccfa2080e934af6ef926fd378091a25fdb
- d56e8522cf147e2b964a5a03e51a17d24d4cb3a4a20f36ef3fd3caeda0b105f3
- e704bc09c7da872b5d430d641e9bd7c8c396cf79ea382870e138f88d166df4a8