-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathTA551 IOCs - Domains & Hosts
346 lines (334 loc) · 7.22 KB
/
TA551 IOCs - Domains & Hosts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
# TA551 IOCs
# Cybercrime gangs are increase using the threat actor Shatak/TA551 template to spread malware with Office documents.
# From Ursnif/Gozi to IcedID, passing through Valak. It emerged in recent campaigns that are hitting many countries.
# Cyber security experts believe that this practice could be a trend. The attacks that exploit it in fact hit everywhere worldwide, from Europe (especially Italy and Germany) to the United States.
# Moreover, the template is used in many ways.
# - Highly suspicious domains
#
# Source: https://otx.alienvault.com/user/343GuiltySpark/pulses
#
# UPDATED: 15-11-2020
#
# Every link reported should be considered harmefull and could result in an unwanted malware download.
#
# *****The list is released without any warranty to the end users.*****
#
# *** This list contains domains and hosts ***
# ********************************************************************************************************************************************************************
#---------------------------------------------------------------------------------------
# Additional IcedID / Shathak / TA551 IOCs - 20 October 2020
# Source: https://otx.alienvault.com/pulse/5f8ed52f98d6180e693b4d13
# Domains
defthebest.club
elliekg.com
gjcz2j8.com
greerknees.top
isolatedglubus.top
ixrbph.com
k8qdr07.com
kleeslikreff.top
luxcarlegend.club
mwnb93z.com
ossxj1.com
pizzaeaters.top
posipako.top
rusoldat.click
touchification.pw
ud7vzlt.com
xydf0m.com
ym5zuxo.com
zcbw6z7.com
#---------------------------------------------------------------------------------------
# Additional TA551 / Shathak / IcedID IOCs - 15 October 2020
# Source: https://otx.alienvault.com/pulse/5f884cfa6d9da2deba878fa4
# Domains
akfumi.com
aqdcyy.com
ar99xc.com
bn50bmx.com
c7cyzl.com
dsv3tk.com
foud7v4.com
h4dv4c1w.com
huntysmally.top
i5hibsc.com
krwrf1.com
mbc8xtc.com
minishtab.cyou
novemberdejudge.cyou
osohc6.com
pdtcgw.com
qczpij.com
smalleryurta.club
sryvplanrespublican.cyou
suddekaster.best
t72876p.com
tynupd.com
vwofdq.com
vx1sz8.com
wqmxf8k.com
xoxofuck.cyou
yg2zdng.com
#---------------------------------------------------------------------------------------
# Thallium attacks, same template as TA551
# Source: https://otx.alienvault.com/pulse/5f85b30b85e5af091b489f2b
# Domains
atwebpages.com
getenjoyment.net
medianewsonline.com
myartsonline.com
mygamesonline.org
mypressonline.com
onlinewebshop.net
scienceontheweb.net
sportsontheweb.net
# Hosts
0.0.0.0 busyday.atwebpages.com
0.0.0.0 goldbin.myartsonline.com
0.0.0.0 kenyanews.atwebpages.com
#---------------------------------------------------------------------------------------
# Additional IcedID/Shathak/TA551 IOCs - 24 Septemeber 2020
# Source: https://otx.alienvault.com/pulse/5f6c886816048f4af4c8511e
# Domains
antologymaster.pw
astedolo.asia
b82uw6.com
droidattac.cyou
epgymd.com
gswxig.com
headtroller.pw
lokopotio.pw
m7zfuu.com
mddgdia.com
qtudtro.com
smavellpolia.cyou
sqgdzi.com
vragafraga.beer
vxsi5p2.com
wertigohol.click
#---------------------------------------------------------------------------------------
# TA551/Shathak/IcedID additional IOCs - 18 September 2020
# Source: https://otx.alienvault.com/pulse/5f64c01fd1d4316a4de55fe7
# Domains
c6ut9we.com
g94ju4.com
gaagachelo.cyou
gjb3sd1.com
ldrmercury.casa
ldrstar.casa
m6vtrk.com
odnovoennbundes.cyou
p3gcak.com
pvi24bu.com
ue4j6g.com
xgsxdae.com
#---------------------------------------------------------------------------------------
# Shathak/IcedID/TA551 additional IOCs - 17 September 2020
# Source: https://otx.alienvault.com/pulse/5f63310e74d23fc7fbeca72d
# Domains
ab94z0.com
allpikoloserdzwe.cyou
bl3cavy.com
c1c2l0i.com
cztixxy.com
fffufk.com
loadro3.casa
loadwe4.casa
obnaprimezert.cyou
safj3ng.com
sipmptomsledy.top
sprbumazna.club
swf1fas.com
tq9kma.com
uragapediculez.top
vdnu32a.com
vsav42a.com
#---------------------------------------------------------------------------------------
# Additional TA551 IOCs - 21 August 2020
# Source: https://otx.alienvault.com/pulse/5f3fdfedcedefadd19614431
# Domains
rolifo23.top
babafirst.top
mintrillion.club
thirdava.cyou
cheapoilz.best
vuv7s5k.com
ty5uaq.com
ehy2iyq.com
apparatto.top
c0sfgh.com
wirrhb.com
babafourth.club
ltdcsz.com
g8pf47.com
musorru.top
#---------------------------------------------------------------------------------------
# 2020-08-18-TA551-IOCs-for-IcedID
# Source: https://otx.alienvault.com/pulse/5f3ec01e2543cf84848ef391
# Domains
apparatto.top
babafirst.top
rolifo23.top
c0sfgh.com
ehy2iyq.com
g8pf47.com
thirdava.cyou
vuv7s5k.com
repository.click
babafourth.club
wirrhb.com
mintrillion.club
musorru.top
ty5uaq.com
ltdcsz.com
cheapoilz.best
#---------------------------------------------------------------------------------------
# TA551 (Shathak) Word docs push IcedID (Bokbot)
# Source: https://otx.alienvault.com/pulse/5f2d6455719f8b1d5d3f254a
# Domains
pt48tir.com
northkorisla.co
ed9fb4.com
qazyaquanauti.co
oyomc2z.com
xk625lf.com
j9b8q8.com
osog5n.com
vebk1x.com
ch4ck0j.com
sv51gh.com
leaderfreeder.co
dywb3va.com
juveperdhue.top
pncq6h.com
scgi76.com
#---------------------------------------------------------------------------------------
# Evolution of Valak, from Its Beginnings to Mass Distribution (TA551)
# Source: https://otx.alienvault.com/pulse/5f1e265b13d0276c7c53e863
# Domains
repository.click
awh93dhkylps5ulnq-be.com
sx-facemask.com
c88gpm21qoal18bmk.com
oaw5ibkcxru.com
hzo0aut97bfu7zweb.com
bbfjjf8.com
klt9x5q3tj.com
xcjhb30ton.com
d9q944ord8l-tydx.com
k4xqhb6u4fo.com
v4x99v.com
h6e2at7du07f7a2ip.com
bdd1b2i68gj.com
amc4we.com
00otg18ixk6o8kows.com
m4tz0of0xi8o3brr.com
his3t35rif0krjkn.com
ebh3zy1l0l66zt144-ph.com
ft23fpcu5yabw2.com
xumti39cg1kuf9t2y.com
d7uap.com
kuvk07l2dzj6wfc.com
voaxd.com
hlyctn2zx8zyjox1.com
xljksdu.com
tpc2snch0g7njxjq.com
ws3adlfkm1.com
wnrfa9y.com
dy5x1.com
nwwgbluv65j6g0xgr-xk.com
j20d7b.com
m8pwsczg0bbzw48j7.com
pk3ehqmow0a.com
l95dtz8.com
lj2xwtcr7920v8.com
bangrajan.org
ya66lsx81lwxocgey.com
u8pmg.com
nbwvg2egflr8t2da1-wo.com
rlb9lmt.com
a8xui1akl9gjqucfa.com
hges2gnmvvv8mv8yi.com
zp9x80h.com
gwn2649pm.com
k1n3pxnd5e6x2h09a-df.com
ttcfv.com
je85oemozig2x4yq.com
wfpyutf.com
xolzrorth.com
5u2mr.com
k0llld9j.com
bqoxits0mu0ga6aul.com
gx6995.com
hswawuo7c8axfxw3.com
e2o4bd6sh2b1sjk56-fv.com
f0hc7osjnl2vi61g.com
j4abq17dqadmb4hz.com
amgvgrlm2w41l2lt373.com
58tiy.com
e5ud9xh7fppe78y.com
landcareus.com
siicg8lgad.com
le7dv4wry1qy0dozb-df.com
v0rzpbu.com
xsiv7v4qzjq6rdmpp.com
2zvdoq8grm7vwed20-zz.com
ls9areetm1cxszmsg-ck.com
fdhwgm.com
p7hne.com
nrhlxbt9covscex9b.com
gandael6.com
j5sfioue15kxqs.com
gr223t.com
kzex9vp0jfw6a8up1.com
eto9ve1.com
m2mfbpsqgq0e2e20.com
qqm9lv.com
d6rc53.com
qut6oga5219bf00e.com
kwjqbk2fw9p8q5y.com
mbzrrt.com
se66ndx04fofu3sqv.com
g7bxxcu.com
eed9jqjd4b600bu2b-md.com
grumnoud.com
a4zy33hbmhxx70w9q.com
herzqvtpb99m0cn.com
turjaxqqzwyfzy6a.com
pui4p.com
dwniu8n.com
c1vfsbk.com
jzi0hc.com
edszkas7gimk7v.com
sktrutx.com
g009clvp1l7.com
gma7im.com
ft6gw.com
x0fopmxsq5y2oqud.com
9bgnq.com
iibb9j93k0z.com
w0j3oq.com
ws3lfkm.com
a0enorc6of7.com
qut69bf00e.com
adersr4utx.com
fz782ze.com
e7xfxb.com
vrsv2haqaq3xy6x.com
c1j4xptyujjpyt8.com
fw6rzlxc.com
chersoicryss.com
50pm4.com
9nag0.com
ihgd1u.com
yfpyutf.com
fepz41.com
ebwz497.com
ofxvp.com
a9nq0z.com
zs6eb.com
m1rd9egxfxinnsoq.com
xekolw77fzn-pwzb.com
siicg8lgadurupkt.com
# Hosts
0.0.0.0 www.nasproje.com