Rewterz Threat Alert – Indicators of Compromise – Malware IP’s and Domains Observed

Analysis Summary

Different threat indicators are observed in phishing campaigns dropping malicious url’s. Threat indicators are provided.

Impact

• Andromeda/Gamarue
• Banking Trojan
• Emotet
• Infostealer
  
• NanoCore
  
• Nemucod
  
• Occamy
  
• Qakbot
  
• RAT
  
• Trickbot
  
• Ursnif
  
• Worm
  
• ZeroAccess

Indicators of Compromise

IP (s)/ Hostname(s)

194.5.99[.]152
103.119.144[.]250
69.89.31[.]139
192.185.5[.]208
162.241.218[.]118
208.51.63[.]229
149.56.84[.]195

URLs

• differentia[.]ru
• disorderstatus[.]ru
• cuoxxscrhhvggevhkurnqphigp[.]com
• w40clementinauug[.]com
• ask.excedese[.]xyz
• d2inaklscrgsah.cloudfront[.]net
• gl[.]immereeako[.]info

Remediation

• Block threat indicators at respective controls
• Always be aware of the suspicious emails sent by unknown senders
• Never click on the link/attachments sent by unknown senders