RATKing: hoʻolaha hou me nā Trojans mamao

I ka pau ʻana o Mei, ua ʻike mākou i kahi hoʻolaha e puʻunaue i ka Remote Access Trojan (RAT) malware—nā papahana e hiki ai i nā mea hoʻouka ke hoʻomalu mamao i kahi ʻōnaehana maʻi.

Ua ʻokoʻa ka hui a mākou i nānā ai ma ka ʻoiaʻiʻo ʻaʻole ia i koho i kahi ʻohana RAT kikoʻī no ka maʻi. Ua ʻike ʻia kekahi mau Trojans i ka hoʻouka ʻana ma ke ʻano he ʻāpana o ka hoʻolaha (ua loaʻa nui nā mea āpau). Me kēia hiʻohiʻona, ua hoʻomanaʻo mai ka hui iā mākou i ke aliʻi ʻiole - he holoholona moʻolelo i loaʻa i nā rodents me nā huelo hui ʻia.

Lawe ʻia ke kumu mai ka monograph e K. N. Rossikov "ʻO nā ʻiole a me nā ʻiole e like me ka ʻiole, ka mea nui loa i ka waiwai" (1908)

No ka hanohano o kēia mea, ua kapa mākou i ka hui a mākou e noʻonoʻo nei i ka RATKing. Ma kēia pou, e hele mākou i nā kikoʻī e pili ana i ka hoʻokō ʻana o ka poʻe hoʻouka i ka hoʻouka ʻana, he aha nā mea hana a lākou i hoʻohana ai, a kaʻana like pū i ko mākou mau manaʻo e pili ana i ka hoʻoili ʻana no kēia hoʻolaha.

Ka holomua o ka hoouka

ʻO nā hoʻouka ʻana a pau i kēia hoʻolaha i hana ʻia e like me kēia algorithm:

1. Ua loaʻa i ka mea hoʻohana ka leka uila phishing me kahi loulou i Google Drive.
2. I ka hoʻohana ʻana i ka loulou, ua hoʻoiho ka mea i hoʻopaʻa ʻia i kahi palapala VBS maikaʻi ʻole i kuhikuhi i kahi waihona DLL e hoʻouka i ka uku hope loa i loko o ka papa inoa Windows a hoʻokuʻu iā PowerShell e hoʻokō.
3. Ua hoʻokomo ka waihona DLL i ka uku hope loa - ʻoiaʻiʻo, kekahi o nā RAT i hoʻohana ʻia e nā mea hoʻouka - i loko o ke kaʻina ʻōnaehana a hoʻopaʻa inoa i kahi palapala VBS ma autorun i mea e loaʻa ai kahi paʻa i ka mīkini maʻi.
4. Ua hoʻokō ʻia ka uku hope loa ma kahi kaʻina hana a hāʻawi i ka mea hoʻouka i ka mana e hoʻokele i ka kamepiula i hoʻopilikia ʻia.

Schematically hiki ke hōʻike ʻia e like me kēia:

Ma hope aʻe, e nānā mākou i nā pae mua ʻekolu, no ka mea makemake mākou i ka mīkini hoʻopuka malware. ʻAʻole mākou e wehewehe kikoʻī i ke ʻano o ka hana o ka malware ponoʻī. Loaʻa ʻia lākou - kūʻai ʻia paha ma nā ʻaha kūkā kūikawā, a i ʻole i puʻunaue ʻia ma ke ʻano he papahana open source - a no laila ʻaʻole kūʻokoʻa i ka hui RATKing.

Ka nānā 'ana i nā pae ho'ouka

Ka Papa 1. Ka leka uila phishing

Ua hoʻomaka ka hoʻouka ʻana me ka loaʻa ʻana o kahi leka maikaʻi ʻole (ua hoʻohana ka poʻe hoʻouka i nā mamana like ʻole me nā kikokikona; hōʻike ka kiʻi kiʻi ma lalo i hoʻokahi hiʻohiʻona). Aia ka memo i kahi loulou i kahi waihona pono drive.google.com, i manaʻo ʻia ua alakaʻi i kahi palapala hoʻoiho palapala PDF.

Laʻana leka uila phishing

Eia naʻe, ʻoiaʻiʻo, ʻaʻole ia he palapala PDF i hoʻouka ʻia, akā he palapala VBS.

Ke kaomi nei ʻoe i ka loulou mai ka leka uila ma ka kiʻi ma luna, kahi faila i kapa ʻia Cargo Flight Details.vbs. I kēia hihia, ʻaʻole i hoʻāʻo nā mea hoʻouka e hoʻokaʻawale i ka faila ma ke ʻano he palapala kūpono.

Ma ka manawa like, ma ke ʻano o kēia hoʻolaha, ua ʻike mākou i kahi palapala i kapa ʻia Cargo Trip Detail.pdf.vbs. Hiki iā ia ke hele i kahi PDF kūpono no ka mea huna ʻo Windows i nā hoʻonui faila ma ke ʻano maʻamau. ʻOiaʻiʻo, i kēia hihia, hiki ke hoʻāla ʻia ka kānalua e kāna ikona, i pili i ka palapala VBS.

I kēia manawa, hiki i ka mea i hōʻeha ke hoʻomaopopo i ka hoʻopunipuni: e nānā pono i nā faila i hoʻoiho ʻia no kekona. Eia nō naʻe, i loko o ia mau hoʻolaha phishing, hilinaʻi pinepine ka poʻe hoʻouka i kahi mea hoʻohana ʻike ʻole a wikiwiki paha.

Ka Papa 2. Hana palapala VBS

ʻO ka palapala VBS, hiki i ka mea hoʻohana ke wehe me ka ʻike ʻole, ua hoʻopaʻa inoa i kahi waihona DLL ma ka papa inoa Windows. Ua uhi ʻia ka palapala: ua kākau ʻia nā laina ma ke ʻano he byte i hoʻokaʻawale ʻia e kahi ʻano ʻano ʻole.

Ka laʻana o ka palapala hōʻino

He mea maʻalahi ka algorithm deobfuscation: ua hoʻokaʻawale ʻia kēlā me kēia kolu o nā ʻano mai ke kaula obfuscated, a ma hope iho ua unuhi ʻia ka hopena mai base16 i ke kaula kumu. No ka laʻana, mai ka waiwai 57Q53s63t72s69J70r74e2El53v68m65j6CH6Ct (i hōʻike ʻia ma ke kiʻi kiʻi ma luna) ʻo ka laina hopena WScript.Shell.

No ka deobfuscate i nā kaula, ua hoʻohana mākou i ka hana Python:

def decode_str(data_enc):   
    return binascii.unhexlify(''.join([data_enc[i:i+2] for i in range(0, len(data_enc), 3)]))

Ma lalo, ma nā laina 9-10, hōʻike mākou i ka waiwai i loaʻa i ka deobfuscation kahi faila DLL. ʻO ia ka mea i hoʻokuʻu ʻia i ka pae aʻe me ka hoʻohana ʻana iā PowerShell.

ʻO ke kaula me ka DLL i hoʻopaʻa ʻia

Ua hoʻokō ʻia kēlā me kēia hana ma ka palapala VBS i ka wā i hoʻopau ʻia nā kaula.

Ma hope o ka holo ʻana i ka palapala, ua kāhea ʻia ka hana wscript.sleep - ua hoʻohana ʻia e hana i ka hoʻokō hoʻopanee.

A laila, ua hana ka palapala me ka Windows registry. Ua hoʻohana ʻo ia i ka ʻenehana WMI no kēia. Me kāna kōkua, ua hana ʻia kahi kī kū hoʻokahi, a ua kākau ʻia ke kino o ka faila i hiki ke hoʻokō ʻia i kāna ʻāpana. Ua loaʻa ka papa inoa ma o WMI me ka hoʻohana ʻana i kēia kauoha:

GetObject(winmgmts {impersonationLevel=impersonate}!\.rootdefault:StdRegProv)

ʻO kahi hoʻokomo i hana ʻia ma ka papa inoa e kahi palapala VBS

Ka Papa 3. Ka hana o ka waihona DLL

I ke kolu o ka pae, ua hoʻouka ka DLL hewa i ka uku hope, hoʻokomo iā ia i loko o ke kaʻina hana, a hōʻoia i ka hoʻomaka ʻana o ka palapala VBS i ka wā i komo ai ka mea hoʻohana.

Holo ma o PowerShell

Ua hoʻokō ʻia ka DLL me ka hoʻohana ʻana i kēia kauoha ma PowerShell:

[System.Threading.Thread]::GetDomain().Load((ItemProperty HKCU:///Software///<rnd_sub_key_name> ).<rnd_value_name>);
[GUyyvmzVhebFCw]::EhwwK('WScript.ScriptFullName', 'rWZlgEtiZr', 'WScript.ScriptName'),0

Ua hana kēia kauoha penei:

• loaʻa ka ʻikepili waiwai hoʻopaʻa inoa me ka inoa rnd_value_name - he faila DLL kēia ʻikepili i kākau ʻia ma ka paepae .Net;
• hoʻouka i ka .Net module i loaʻa i ka hoʻomanaʻo kaʻina powershell.exe ka hoʻohana ʻana i ka hana [System.Threading.Thread]::GetDomain().Load() (ka wehewehe kikoʻī o ka hana Load (). loaʻa ma ka pūnaewele Microsoft);
• hana i ka hana GUyyvmzVhebFCw]::EhwwK() - ua hoʻomaka ka hoʻokō ʻana o ka waihona DLL me ia - me nā ʻāpana vbsScriptPath, xorKey, vbsScriptName... Parameter xorKey mālama i ke kī no ka wehe ʻana i ka uku hope, a me nā ʻāpana vbsScriptPath и vbsScriptName ua hoʻololi ʻia i mea e hoʻopaʻa inoa ai i kahi palapala VBS ma autorun.

ʻO ka wehewehe ʻana i ka waihona DLL

Ma ke ʻano decompiled, ua like ka bootloader penei:

Loader ma ke ʻano decompiled (ʻo ka hana i hoʻomaka ai ka hoʻokō ʻana o ka waihona DLL i kahakaha ʻia i ka ʻulaʻula)

Mālama ʻia ka bootloader e ka .Net Reactor protector. He hana maikaʻi loa ka pono de4dot no ka wehe ʻana i kēia mea pale.

ʻO kēia mea hoʻoili:

• hoʻokomo i ka uku i loko o ke kaʻina hana (ma kēia hiʻohiʻona svchost.exe);
• Ua hoʻohui au i kahi palapala VBS i autorun.

Uku uku

E nānā kākou i ka hana i kapa ʻia e ka palapala PowerShell.

Hana ʻia e ka palapala PowerShell

Ua hana kēia hana i kēia mau hana:

• decrypted ʻelua pūʻulu ʻikepili (array и array2 ma ke kiʻi paʻi kiʻi). Ua hoʻopili mua ʻia lākou me ka hoʻohana ʻana i ka gzip a hoʻopili ʻia me ka algorithm XOR me ke kī xorKey;
• kope ʻikepili i nā wahi hoʻomanaʻo i hoʻokaʻawale ʻia. ʻIkepili mai array - i ka wahi hoʻomanaʻo i kuhikuhi ʻia intPtr (payload pointer i ka screenshot); ʻikepili mai array2 - i ka wahi hoʻomanaʻo i kuhikuhi ʻia intPtr2 (shellcode pointer i ka screenshot);
• kapaia ka hana CallWindowProcA (ka wehewehe Loaʻa kēia hana ma ka pūnaewele Microsoft) me nā ʻāpana aʻe (ʻo nā inoa o nā ʻāpana i helu ʻia ma lalo nei, ma ka kiʻi kiʻi i loko o ke ʻano like, akā me nā waiwai hana):
  • lpPrevWndFunc - kuhikuhi i ka ʻikepili mai array2;
  • hWnd - kuhikuhi i kahi kaula i loaʻa ke ala i ka faila hiki ke hoʻokō svchost.exe;
  • Msg - kuhikuhi i ka ʻikepili mai array;
  • wParam, lParam - nā ʻāpana memo (i kēia hihia, ʻaʻole i hoʻohana ʻia kēia mau ʻāpana a loaʻa nā waiwai o 0);
• hana i kahi faila %AppData%MicrosoftWindowsStart MenuProgramsStartup<name>.urlkahi <name> - ʻo ia nā huaʻōlelo 4 mua o ka ʻāpana vbsScriptName (i ka screenshot, hoʻomaka ka ʻāpana code me kēia hana me ke kauoha File.Copy). Ma kēia ala, ua hoʻohui ka malware i kahi faila URL i ka papa inoa o nā faila autorun i ka wā i komo ai ka mea hoʻohana a pili i ka kamepiula i hoʻopili ʻia. Aia i loko o ka waihona URL kekahi loulou i ka palapala:

[InternetShortcut]
URL = file : ///<vbsScriptPath>

No ka hoʻomaopopo ʻana i ke ʻano o ka hoʻokō ʻia ʻana o ka injection, ua hoʻokaʻawale mākou i nā ʻikepili data array и array2. No ka hana ʻana i kēia, ua hoʻohana mākou i ka hana Python penei:

def decrypt(data, key):
    return gzip.decompress(
        bytearray([data[i] ^ key[i % len(key)] for i in range(len(data))])[4:])
    

ʻO ka hopena, ua ʻike mākou:

• array he faila PE - ʻo ia ka uku hope loa;
• array2 ʻo ia ka shellcode i koi ʻia no ka hoʻokō ʻana i ka injection.

Shellcode mai kahi laha array2 i hala ma ke ʻano he waiwai hana lpPrevWndFunc i loko o kahi hana CallWindowProcA. lpPrevWndFunc - ka hana callback, ua like kona prototype penei:

LRESULT WndFunc(
  HWND    hWnd,
  UINT    Msg,
  WPARAM  wParam,
  LPARAM  lParam
);

No laila ke holo ʻoe i ka hana CallWindowProcA me nā palena hWnd, Msg, wParam, lParam hoʻokō ʻia ka shellcode mai ka array array2 me na hoopaapaa hWnd и Msg. hWnd He kuhikuhi i kahi kaula i loaʻa ke ala i ka faila hiki ke hoʻokō svchost.exea me ka Msg - kuhikuhi i ka uku hope loa.

Ua loaʻa i ka shellcode nā helu hana mai kernel32.dll и ntdll32.dll e pili ana i nā waiwai hash mai ko lākou mau inoa a hoʻokomo i ka uku hope loa i loko o ke kaʻina hana svchost.exeme ka hoʻohana ʻana i ka ʻenehana Hollowing Process (hiki iā ʻoe ke heluhelu hou aku e pili ana i kēia 'ōlelo). Ke hoʻokomo i ka shellcode:

• hana i kaʻina hana svchost.exe ma kahi kūlana hoʻomaha me ka hoʻohana ʻana i ka hana CreateProcessW;
• a laila hūnā i ka hōʻike ʻana o ka ʻāpana ma ka wahi helu wahi o ke kaʻina hana svchost.exe hoʻohana i ka hana NtUnmapViewOfSection. No laila, ua hoʻokuʻu ka papahana i ka hoʻomanaʻo o ka hana kumu svchost.exea laila e hoʻokaʻawale i ka hoʻomanaʻo no ka uku uku ma kēia helu wahi;
• i hoʻokaʻawale ʻia ka hoʻomanaʻo no ka uku uku ma ke kaʻina wahi helu wahi svchost.exe hoʻohana i ka hana VirtualAllocEx;

Hoʻomaka i ke kaʻina hana injection

• kākau i nā mea o ka uku uku i loko o ke kaʻina wahi helu wahi svchost.exe hoʻohana i ka hana WriteProcessMemory (e like me ka screenshot ma lalo);
• hoʻomaka hou i ka hana svchost.exe hoʻohana i ka hana ResumeThread.

Hoʻopau i ke kaʻina hana injection

Hiki ke hoʻoiho ʻia ka polokalamu kiloʻino

Ma muli o nā hana i wehewehe ʻia, ua hoʻokomo ʻia kekahi o nā polokalamu polokalamu RAT-class ma ka ʻōnaehana maʻi. ʻO ka papa ma lalo nei ka papa inoa o ka malware i hoʻohana ʻia i ka hoʻouka ʻana, hiki iā mākou ke hilinaʻi me ka hilinaʻi i hoʻokahi pūʻulu o nā mea hoʻouka, ʻoiai ua komo nā laʻana i ke kauoha a me ka server mana.

Ka inoa o ka malware

ʻIke mua ʻia

SHA-256

ʻO C&C

ʻO ke kaʻina hana e hoʻokō ʻia ai ka injection

Darktrack

16-04-2020

ea64fe672c953adc19553ea3b9118ce4ee88a14d92fc7e75aa04972848472702

kimjoy007.dyndns[.]org:2017

aloha

Parallax

24-04-2020

b4ecd8dbbceaadd482f1b23b712bcddc5464bccaac11fe78ea5fd0ba932a4043

kimjoy007.dyndns[.]org:2019

aloha

WAHI KAUA

18-05-2020

3786324ce3f8c1ea3784e5389f84234f81828658b22b8a502b7d48866f5aa3d3

kimjoy007.dyndns[.]org:9933

aloha

Uenauila

20-05-2020

6dac218f741b022f5cad3b5ee01dbda80693f7045b42a0c70335d8a729002f2d

kimjoy007.dyndns[.]org:2000

aloha

ʻO nā laʻana o nā polokalamu kiloʻino i puʻunaue ʻia me ke kikowaena mana hoʻokahi

ʻElua mau mea e ʻike ʻia ma ʻaneʻi.

ʻO ka mea mua, ʻo ka ʻoiaʻiʻo ua hoʻohana nā mea hoʻouka i kekahi mau ʻohana RAT i ka manawa hoʻokahi. ʻAʻole maʻamau kēia ʻano no nā hui cyber kaulana, e hoʻohana pinepine ana i nā pūʻulu like o nā mea hana i kamaʻāina iā lākou.

ʻO ka lua, ua hoʻohana ʻo RATKing i ka malware i kūʻai ʻia ma nā ʻaha kūkā kūikawā no ke kumu kūʻai haʻahaʻa, a i ʻole he papahana open source.

Hāʻawi ʻia kahi papa inoa piha o nā polokalamu malware i hoʻohana ʻia i ka hoʻolaha—me hoʻokahi hoʻopaʻa koʻikoʻi—ma ka hope o ka ʻatikala.

E pili ana i ka hui

ʻAʻole hiki iā mākou ke hāʻawi i ka hoʻolaha ʻino i wehewehe ʻia i nā mea hoʻouka kaua i ʻike ʻia. I kēia manawa, ke manaʻoʻiʻo nei mākou ua hana ʻia kēia mau hoʻouka ʻana e kahi hui hou. E like me kā mākou i kākau ai i ka hoʻomaka, ua kapa mākou iā RATKing.

No ka hana ʻana i ka palapala VBS, ua hoʻohana paha ka hui i kahi mea hana e like me ka pono VBS-Crypter mai ka mea hoʻomohala NYAN-x-CAT. Hōʻike ʻia kēia e ka like o ka palapala i hana ʻia e kēia papahana me ka palapala a nā mea hoʻouka. ʻO ke kikoʻī, ʻo lāua ʻelua:

• hana i ka hoʻokō lohi me ka hoʻohana ʻana i ka hana Sleep;
• hoʻohana i ka WMI;
• hoʻopaʻa inoa i ke kino o ka faile hiki ke hoʻokō ʻia ma ke ʻano he kī hoʻopaʻa inoa;
• e hoʻokō i kēia faila me ka hoʻohana ʻana iā PowerShell ma kāna wahi kikoʻī.

No ka akaka, e hoʻohālikelike i ke kauoha PowerShell e holo i kahi faila mai ke kākau inoa, i hoʻohana ʻia e kahi palapala i hana ʻia me ka VBS-Crypter:

((Get-ItemPropertyHKCU:SoftwareNYANxCAT).NYANxCAT);$text=-join$text[-1..-$text.Length];[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String($text)).EntryPoint.Invoke($Null,$Null);

me kahi kauoha like i hoʻohana ʻia e nā mea hoʻouka kaua:

[System.Threading.Thread]::GetDomain().Load((ItemProperty HKCU:///Software///<rnd_sub_key_name> ).<rnd_value_name>);
[GUyyvmzVhebFCw]::EhwwK('WScript.ScriptFullName', 'rWZlgEtiZr', 'WScript.ScriptName'),0

E hoʻomaopopo i ka hoʻohana ʻana o nā mea hoʻouka i kahi pono ʻē aʻe mai NYAN-x-CAT ma ke ʻano he uku uku - LimeRAT.

Hōʻike nā helu wahi o nā kikowaena C&C i kahi hiʻohiʻona ʻē aʻe o RATKing: makemake ka hui i nā lawelawe DNS ikaika (e ʻike i ka papa inoa o nā C&C ma ka papa IoC).

IoC

Hāʻawi ka papa ma lalo i kahi papa inoa piha o nā palapala VBS i hiki ke hoʻopili ʻia i ka hoʻolaha i wehewehe ʻia. Ua like kēia mau palapala a pau e like me ka hana like. Hoʻokomo lākou a pau i ka malware papa RAT i kahi kaʻina Windows hilinaʻi. Loaʻa iā lākou nā helu C&C a pau me ka hoʻohana ʻana i nā lawelawe Dynamic DNS.

Eia naʻe, ʻaʻole hiki iā mākou ke ʻōlelo ua puʻunaue ʻia kēia mau palapala a pau e nā mea hoʻouka like, koe naʻe nā laʻana me nā helu C&C like (e laʻa, kimjoy007.dyndns.org).

Ka inoa o ka malware

SHA-256

ʻO C&C

ʻO ke kaʻina hana e hoʻokō ʻia ai ka injection

Parallax

b4ecd8dbbceaadd482f1b23b712bcddc5464bccaac11fe78ea5fd0ba932a4043

kimjoy007.dyndns.org

aloha

00edb8200dfeee3bdd0086c5e8e07c6056d322df913679a9f22a2b00b836fd72

hope.doomdns.org

aloha

504cbae901c4b3987aa9ba458a230944cb8bd96bbf778ceb54c773b781346146

kimjoy007.dyndns.org

aloha

1487017e087b75ad930baa8b017e8388d1e99c75d26b5d1deec8b80e9333f189

kimjoy007.dyndns.org

aloha

c4160ec3c8ad01539f1c16fb35ed9c8c5a53a8fda8877f0d5e044241ea805891

franco20.dvrdns.org

aloha

515249d6813bb2dde1723d35ee8eb6eeb8775014ca629ede017c3d83a77634ce

kimjoy007.dyndns.org

aloha

1b70f6fee760bcfe0c457f0a85ca451ed66e61f0e340d830f382c5d2f7ab803f

franco20.dvrdns.org

aloha

b2bdffa5853f29c881d7d9bff91b640bc1c90e996f85406be3b36b2500f61aa1

hope.doomdns.org

aloha

c9745a8f33b3841fe7bfafd21ad4678d46fe6ea6125a8fedfcd2d5aee13f1601

kimjoy007.dyndns.org

aloha

1dfc66968527fbd4c0df2ea34c577a7ce7a2ba9b54ba00be62120cc88035fa65

franco20.dvrdns.org

aloha

c6c05f21e16e488eed3001d0d9dd9c49366779559ad77fcd233de15b1773c981

kimjoy007.dyndns.org

Kime

3b785cdcd69a96902ee62499c25138a70e81f14b6b989a2f81d82239a19a3aed

hope.doomdns.org

aloha

4d71ceb9d6c53ac356c0f5bdfd1a5b28981061be87e38e077ee3a419e4c476f9

2004para.ddns.net

aloha

00185cc085f284ece264e3263c7771073a65783c250c5fd9afc7a85ed94acc77

hope.doomdns.org

aloha

0342107c0d2a069100e87ef5415e90fd86b1b1b1c975d0eb04ab1489e198fc78

franco20.dvrdns.org

aloha

de33b7a7b059599dc62337f92ceba644ac7b09f60d06324ecf6177fff06b8d10

kimjoy007.dyndns.org

aloha

80a8114d63606e225e620c64ad8e28c9996caaa9a9e87dd602c8f920c2197007

kimjoy007.dyndns.org

aloha

acb157ba5a48631e1f9f269e6282f042666098614b66129224d213e27c1149bb

hope.doomdns.org

Kime

bf608318018dc10016b438f851aab719ea0abe6afc166c8aea6b04f2320896d3

franco20.dvrdns.org

aloha

4d0c9b8ad097d35b447d715a815c67ff3d78638b305776cde4d90bfdcb368e38

hope.doomdns.org

aloha

e7c676f5be41d49296454cd6e4280d89e37f506d84d57b22f0be0d87625568ba

kimjoy007.dyndns.org

aloha

9375d54fcda9c7d65f861dfda698e25710fda75b5ebfc7a238599f4b0d34205f

franco20.dvrdns.org

aloha

128367797fdf3c952831c2472f7a308f345ca04aa67b3f82b945cfea2ae11ce5

kimjoy007.dyndns.org

aloha

09bd720880461cb6e996046c7d6a1c937aa1c99bd19582a562053782600da79d

hope.doomdns.org

aloha

0a176164d2e1d5e2288881cc2e2d88800801001d03caedd524db365513e11276

paradickhead.homeip.net

aloha

0af5194950187fd7cbd75b1b39aab6e1e78dae7c216d08512755849c6a0d1cbe

hope.doomdns.org

aloha

kahua kaua

3786324ce3f8c1ea3784e5389f84234f81828658b22b8a502b7d48866f5aa3d3

kimjoy007.dyndns.org

aloha

db0d5a67a0ced6b2de3ee7d7fc845a34b9d6ca608e5fead7f16c9a640fa659eb

kimjoy007.dyndns.org

aloha

Uenauila

6dac218f741b022f5cad3b5ee01dbda80693f7045b42a0c70335d8a729002f2d

kimjoy007.dyndns.org

aloha

Darktrack

ea64fe672c953adc19553ea3b9118ce4ee88a14d92fc7e75aa04972848472702

kimjoy007.dyndns.org

aloha

WSH IOLE

d410ced15c848825dcf75d30808cde7784e5b208f9a57b0896e828f890faea0e

anekesolution.linkpc.net

RegAsm

Lime

896604d27d88c75a475b28e88e54104e66f480bcab89cc75b6cdc6b29f8e438b

softmy.duckdns.org

RegAsm

QuasarRAT

bd1e29e9d17edbab41c3634649da5c5d20375f055ccf968c022811cd9624be57

darkhate-23030.portmap.io

RegAsm

12044aa527742282ad5154a4de24e55c9e1fae42ef844ed6f2f890296122153b

darkhate-23030.portmap.io

RegAsm

be93cc77d864dafd7d8c21317722879b65cfbb3297416bde6ca6edbfd8166572

darkhate-23030.portmap.io

RegAsm

933a136f8969707a84a61f711018cd21ee891d5793216e063ac961b5d165f6c0

darkhate-23030.portmap.io

RegAsm

71dea554d93728cce8074dbdb4f63ceb072d4bb644f0718420f780398dafd943

chrom1.myq-see.com

RegAsm

0d344e8d72d752c06dc6a7f3abf2ff7678925fde872756bf78713027e1e332d5

darkhate-23030.portmap.io

RegAsm

0ed7f282fd242c3f2de949650c9253373265e9152c034c7df3f5f91769c6a4eb

darkhate-23030.portmap.io

RegAsm

aabb6759ce408ebfa2cc57702b14adaec933d8e4821abceaef0c1af3263b1bfa

darkhate-23030.portmap.io

RegAsm

1699a37ddcf4769111daf33b7d313cf376f47e92f6b92b2119bd0c860539f745

darkhate-23030.portmap.io

RegAsm

3472597945f3bbf84e735a778fd75c57855bb86aca9b0a4d0e4049817b508c8c

darkhate-23030.portmap.io

RegAsm

809010d8823da84cdbb2c8e6b70be725a6023c381041ebda8b125d1a6a71e9b1

darkhate-23030.portmap.io

RegAsm

4217a2da69f663f1ab42ebac61978014ec4f562501efb2e040db7ebb223a7dff

darkhate-23030.portmap.io

RegAsm

08f34b3088af792a95c49bcb9aa016d4660609409663bf1b51f4c331b87bae00

darkhate-23030.portmap.io

RegAsm

79b4efcce84e9e7a2e85df7b0327406bee0b359ad1445b4f08e390309ea0c90d

darkhate-23030.portmap.io

RegAsm

12ea7ce04e0177a71a551e6d61e4a7916b1709729b2d3e9daf7b1bdd0785f63a

darkhate-23030.portmap.io

RegAsm

d7b8eb42ae35e9cc46744f1285557423f24666db1bde92bf7679f0ce7b389af9

darkhate-23030.portmap.io

RegAsm

def09b0fed3360c457257266cb851fffd8c844bc04a623c210a2efafdf000d5c

darkhate-23030.portmap.io

RegAsm

50119497c5f919a7e816a37178d28906fb3171b07fc869961ef92601ceca4c1c

darkhate-23030.portmap.io

RegAsm

ade5a2f25f603bf4502efa800d3cf5d19d1f0d69499b0f2e9ec7c85c6dd49621

darkhate-23030.portmap.io

RegAsm

189d5813c931889190881ee34749d390e3baa80b2c67b426b10b3666c3cc64b7

darkhate-23030.portmap.io

RegAsm

c3193dd67650723753289a4aebf97d4c72a1afe73c7135bee91c77bdf1517f21

darkhate-23030.portmap.io

RegAsm

a6f814f14698141753fc6fb7850ead9af2ebcb0e32ab99236a733ddb03b9eec2

darkhate-23030.portmap.io

RegAsm

a55116253624641544175a30c956dbd0638b714ff97b9de0e24145720dcfdf74

darkhate-23030.portmap.io

RegAsm

d6e0f0fb460d9108397850169112bd90a372f66d87b028e522184682a825d213

darkhate-23030.portmap.io

RegAsm

522ba6a242c35e2bf8303e99f03a85d867496bbb0572226e226af48cc1461a86

darkhate-23030.portmap.io

RegAsm

fabfdc209b02fe522f81356680db89f8861583da89984c20273904e0cf9f4a02

darkhate-23030.portmap.io

RegAsm

08ec13b7da6e0d645e4508b19ba616e4cf4e0421aa8e26ac7f69e13dc8796691

darkhate-23030.portmap.io

RegAsm

8433c75730578f963556ec99fbc8d97fa63a522cef71933f260f385c76a8ee8d

darkhate-23030.portmap.io

RegAsm

99f6bfd9edb9bf108b11c149dd59346484c7418fc4c455401c15c8ac74b70c74

darkhate-23030.portmap.io

RegAsm

d13520e48f0ff745e31a1dfd6f15ab56c9faecb51f3d5d3d87f6f2e1abe6b5cf

darkhate-23030.portmap.io

RegAsm

9e6978b16bd52fcd9c331839545c943adc87e0fbd7b3f947bab22ffdd309f747

darkhate-23030.portmap.io

RegAsm

Source: www.habr.com