FIN7 C2s:

cdn41.space
cdn46.space
cdn45.space
cdn35.space
cdn30.space
cdn34.space
cdn32.space
cdn43.space
cdn37.space
cdn42.space
cdn27.space
cdn25.space
cdn36.space
cdn33.space
cdn40.click
cdn31.space
cdn38.space
eprst431.boo
cdn1124.net
cdn1701.com

DiceLoader C2:

193.124.24.51:443
38.135.52.151:273

NetSupport:

5.8.63.140
185.174.102.62
109.107.170.126
193.233.206.23


URLs:

wall-street-journal.link
sapconcur.pro
concur.pm
advancedipscannerapp.com
workable.uk.com
wsj.wf
wsj.re
wsj.pm
wsj.wales
asana.tel
advanced-ip-scanner.link
concur.re
concur.skin
asana.wf
blackrock.wf
blackrock.re
lexisnexis.day
quicken-install.com
vkontakte.in
autodesk.pm
7-zip.cfd
meet-go.click
winscp-install.com
webex-install.com
investing.wf
pgadmin.link
asana.pm
aimp.day
workday.pm
www.any-connectcisco.com

Files:

csvde.exe - b6f12d39edbfe3b33952be4329064b35
Adobe_017301.zip - e7b1fb0ef5dd20f4522945b902803f10
svchostc.exe - 0740803404a58d9c1c1f4bd9edaf4186
svchostc.py - 782621d1062a8fc7d626ceb68af314e5
DiceLoader - bb0a503a83b1f9833c3d3d08784b78a8