# Copyright (c) 2014-2023 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Reference: https://twitter.com/James_inthe_box/status/1193539893000986624 # Reference: https://www.virustotal.com/gui/ip-address/130.185.238.32/relations # Reference: https://www.virustotal.com/gui/file/179349534f184774b18b7dbcf7442a537fe640e373f5c4cc6b39d3076240c11b/detection # Reference: https://www.virustotal.com/gui/file/9cc448001e8ed355520e26c328d33f1b8031b26796923608cdf920fb6617dbb2/detection # Reference: https://www.virustotal.com/gui/file/b078b3cba73f7dc905d395b014f610000ab37cc1500be00d64ce48c7cd9378b2/detection http://130.185.238.32 coinstolkbr79.dyndns.org # Reference: https://twitter.com/reecdeep/status/1291002877633331201 # Reference: https://app.any.run/tasks/1c5c1fef-a022-4143-b3d8-e365a38b8a20/ # Reference: https://www.virustotal.com/gui/file/8df61999996b08c2f77e53869f75e2ea399f1bad5a5dc5d5969f4b5e9d8d5751/detection 142.11.212.211:8081 pizzacircusbarcelona.com # Reference: https://twitter.com/JAMESWT_MHT/status/1291013627680624642 167.114.217.220:9090 # Reference: https://twitter.com/Dashowl/status/1296886074053099520 http://173.0.54.19 # Reference: https://twitter.com/JAMESWT_MHT/status/1303248634507657216 155.138.137.44:3030 # Reference: https://twitter.com/K_N1kolenko/status/1328605692643713025 146.59.193.20:1948 # Reference: https://twitter.com/ESETresearch/status/1390263927859208193 # Reference: https://twitter.com/ESETresearch/status/1390263930833063938 binanceassistance.com spotifyannounce.com # Reference: https://twitter.com/johnk3r/status/1524847789766852630 24.152.38.130:4398 # Reference: https://twitter.com/da_667/status/1530296455981936646 # Reference: https://www.virustotal.com/gui/ip-address/167.114.88.99/relations # Reference: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season/ 167.114.43.27:4433 belfaro.com.br iuc1tab1tatitbw.freedynamicdns.org iuc1tag1sjsdtbb.freedynamicdns.org iuc1tan1xatmtkk.freedynamicdns.org iuc1tan1xqs4tjf.freedynamicdns.org iuc1tas1satjtjo.freedynamicdns.org iuc1tas1xao3taf.freedynamicdns.org iuc1tbb0sqpmtak.freedynamicdns.org iuc1tbs0taoztjw.freedynamicdns.org iuc1tbw0sasztjb.freedynamicdns.org iuc1tbw1xjoztko.freedynamicdns.org iuc1tjf0satltbs.freedynamicdns.org iuc1tjj0uas0tbs.freedynamicdns.org iuc1tjk0sqpltbo.freedynamicdns.org iuc1tjk0xqpltbo.freedynamicdns.org iuc1tko1sqs5tjg.freedynamicdns.org # Reference: https://twitter.com/JAMESWT_MHT/status/1531566144594841601 http://20.187.91.219 20.187.91.219:44441 # Reference: https://twitter.com/1ZRR4H/status/1549261002725679105 # Reference: https://www.virustotal.com/gui/ip-address/20.70.2.177/relations http://20.70.2.177 a404140024b44.servehalflife.com a40494449.servehalflife.com a4049475a475955.servehalflife.com a404e4306.servecounterstrike.com a40595c5747595c.servehalflife.com a41534548.servequake.com a425b4159455043.zapto.org a44504159455043.zapto.org a44504605.zapto.org a44504959.zapto.org a44524358475241.servehalflife.com a4452435e475959.servehalflife.com a445b525b.zapto.org a454b4603.zapto.org a45504205455053.zapto.org a45504603.zapto.org a455b5303.zapto.org a455b5e02455b42.zapto.org a46404600.zapto.org a46405259.zapto.org a46405e00455b5a.zapto.org a464b4205455a5a.zapto.org a464b534b.zapto.org a46524b5b.servehalflife.com a46594b5a.servehalflife.com a4742475f475858.servehalflife.com a49405305.zapto.org a4940534b.zapto.org a495b5258.zapto.org a4a585057.servequake.com a4b42435b475155.servehalflife.com a4b424b5a.servehalflife.com a4b42505f.servehalflife.com a4b425c57475144.servehalflife.com a4b52505a.servehalflife.com a4b525c06475151.servehalflife.com a4b59505f.servehalflife.com a4c454c5d.servecounterstrike.com ftpbtag1sjoztbf.freedynamicdns.org ftpbtao1sztitjf.freedynamicdns.org ftpbtbs0uatmtko.freedynamicdns.org ftpbtjw0xaphtaw.freedynamicdns.org ftpxtak1wqo1tjk.freedynamicdns.org ftpxtan0xas5tab.freedynamicdns.org ftpxtjj0uaphtar.freedynamicdns.org iuc1tbw0tas4tab.freedynamicdns.org iuc1tjg0xjsftbo.freedynamicdns.org iuc1tjn1tjo3tjs.freedynamicdns.org iuc1tjs0xasftbo.freedynamicdns.org xacjtjozxaw3.freedynamicdns.org xaxhtbkzsqcm.freedynamicdns.org # Reference: https://twitter.com/ankit_anubhav/status/1555521068734902272 premierecombate.eastus.cloudapp.azure.com # Reference: https://twitter.com/ankit_anubhav/status/1555815597769863168 # Reference: https://www.virustotal.com/gui/ip-address/20.115.83.63/relations http://54.39.194.67 amixtubinemasterx.com beacocosmasterx.top centroempresarialkutsni.com customdefivewrs.top dextelmacwordsx.top domanekiewex.top empresarialkutsni.com empresarialkutsnicorp.com empresarialmixtur.ml empresarialmixtur.tk empresarialwebcustom.top mixtubinemasterx.com mixtubinemasterxnet.com /$NOTADIGITALFISCAL # Reference: https://github.com/CronUp/Malware-IOCs/blob/main/2022-08-05_Grandoreiro http://20.10.3.196 http://20.197.31.100 http://20.226.27.45 http://209.127.179.58 http://54.39.194.67 amixtubinemasterx.com beacocosmasterx.top dextelmacwordsx.top domanekiewex.top empresarialkutsni.com empresarialkutsnicorp.com empresarialwebcustom.top mixtubinemasterx.com mixtubinemasterxnet.com # Reference: https://twitter.com/reecdeep/status/1291717803385520128 142.11.213.42:8081 # Reference: https://www.zscaler.com/blogs/security-research/grandoreiro-banking-trojan-new-ttps-targeting-various-industry-verticals http://15.188.63.127 http://18.231.180.92 http://35.180.117.32 http://35.181.59.254 http://52.67.27.173 http://54.232.38.61 15.188.63.127:36992 assesorattlas.me atlasassessorcontabilidade.com barusgorlerat.me damacenapirescontab.com mantersaols.com perfomacepnneu.me vamosparaonde.com premiercombate.eastus.cloudapp.azure.com chjjhjmomaoheoojjbynnyjiidfcncc.cable-modem.org ifnnfnmcmacfdccnnjynnyjiidfcncc.collegefan.org jmllmedvhgmhldjgmhvmmlljhvgdzvzz.dynns.com odbbdbmgmagdfggbbnynnyjiidfcncc.blogsyte.com pcbbcrjcgbcghjpbcgkccbjorkhhjcjj.fantasyleague.cc /$FISCALIGENERAL3489213839012 # Reference: https://twitter.com/1ZRR4H/status/1570233170997694466 20.206.121.215:4144 procedimentos09092022.blob.core.windows.net # Reference: https://app.any.run/tasks/74ed9bfb-68d7-492a-8c2a-4236fe2589c6/ java-update.online mymodulop2pcar.servehttp.com /Bv3wF1uHKG/counter.php /Bv3wF1uHKG/ # Reference: https://www.virustotal.com/gui/file/fd00307c2ea5313be921b31b2c9ddad5a5cd0df4bcf81814d07243fdf24fbc49/detection http://108.62.118.17 # Reference: https://hybrid-analysis.com/sample/f8991e3f7b524edc26a64543b57dd3f7cd69a2f8b04ce934d9334bf8ade8b396 sgd.servehttp.com # Reference: https://twitter.com/StopMalvertisin/status/1575427033504501760 # Reference: https://www.virustotal.com/gui/file/0a9d7369a1c4cb32172404abd4e1a6c5aa35a674b4bfdcca81dc909b0f047b65/detection filestorel.eastus.cloudapp.azure.com # Reference: https://twitter.com/noexceptcpp/status/1578403486181560322 # Reference: https://app.any.run/tasks/218fcddb-49f5-4eaa-9ea3-8d22535c2a1d/ http://20.70.3.186 104.129.205.92.host.secureserver.net nmp20887a02021498.s3.amazonaws.com /contgmx/clientes.php /.Nfe1456345340/ # Reference: https://twitter.com/1ZRR4H/status/1592906505363542016 http://185.191.228.227 18.231.179.202:65535 192.95.55.50:28322 192.95.55.50:45774 # Reference: https://twitter.com/Merlax_/status/1594862075897339904 http://192.95.6.196 # Reference: https://twitter.com/Merlax_/status/1594862079734857728 http://138.99.74.213 http://170.82.181.99 http://185.153.176.148 http://186.249.213.178 http://191.96.4.160 http://191.96.5.221 # Reference: https://twitter.com/Merlax_/status/1598875723602989056 http://138.99.74.21 http://186.249.213.225 # Reference: https://twitter.com/Merlax_/status/1603854200605184035 http://138.99.74.212 http://15.235.193.43 http://186.249.213.221 http://201.14.45.23 # Reference: https://twitter.com/Merlax_/status/1619666797879255041 http://149.56.91.172 http://177.73.101.138 http://186.249.213.39 http://188.121.116.157 http://52.67.94.240 http://54.221.142.212 http://89.223.88.138 54.221.142.212:28551 /eliteseguros/autorizar.php # Generic /Adkflgog30.iso /dyngcdnefn_03.iso /nivyjlzhdj_04.iso /nnkokysdggit.iso /obmkumjoxq_05.iso /ugqvhozczb_04.iso /yqcnfempzc.iso /ronivon.txt /BR01?NF-eBR102822MY91822BT1 /BR02?NF-eBR102822MY91822BT1 /BR01/?NF-eBR102822MY91822BT1 /BR02/?NF-eBR102822MY91822BT1 /?NF-eBR102822MY91822BT1