Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save kirk-sayre-work/8a48d1da87585535040f5c50280c3602 to your computer and use it in GitHub Desktop.
Save kirk-sayre-work/8a48d1da87585535040f5c50280c3602 to your computer and use it in GitHub Desktop.
FlawedAmmy Maldoc IOCs 5/17/2019
2nd Stage Download URLs:
http://185.128.213.12/rol1
http://185.231.155.59/rol2
http://91.200.41.236/vsupdate
http://kupitorta.net/lsadat1
http://kupitorta.net/lsadat2
http://kupitorta.net/lsadat3
http://zonaykan.com/lsadat1
http://zonaykan.com/lsadat2
http://zonaykan.com/lsadat3
Some Maldoc Hashes:
67e0c1e7d74c932cea5b95aedd3715357759801b308aeb69c0f44eab16c7dd58
d661998d460e15ede940dc98ac45669bbf4a2b26d906a777d488bbd001f6632d
7989f218fcf482896676e3589434c033a5ca2cc1ebfd54cdd0641cb4a0976d26
080b0d2c4d0c2f8cba5e09cb4b9ec115caa5de6d41a0efbbed54bc88c2295d3d
f1b41c7590cc978b613d9904a36badd5aa9a3356e35bdcc454b6172748776e9e
9cb18476d3b6e8c63d9f45c57cbfc23621092a0c316c6f141cbc72d6b77578b8
b562e3a95c9f9f93d4e5b5043ce031c6f0aebc6fd11c4fd1d380f988eba17e12
6a9bfac16be9ca33c2edbdca786e18f63dd61485b9bdc51fa627f88a3fd9c39e
8f8af66495bf452fa60ca36a3803e78036d21000ff17f6f8a50675cb19949611
1a59e4e6bcc5781d1265d978b43406c405274547975c56d4c79ef9676f9348d9
49cc2ee8b7e2ce8e3f1b964f42da2e205e8c6541f606ce80a7494313a52e13e2
b9e6d14cfdc44425f72c818129b328bc8968e5519d067f40b90b8dd00b96798f
8228afcef8a7aaaba1ce95b9a2cac20c53276154fdddb42bf7f638103401254c
28c3658260ae14178ca83c5249d9c4a76e11b410f3be17f915d4b5112d1e332d
8ba2d4b8adde0d74c9a9c729fa4d606426a80fb0abac8c669d4f86b3dffc54e9
d4b31f1a542d777da1ba74702043396f709c8956796ca208a50998337e71d2ae
970182ff149f80946c20e85549104667cb085593b44ac0c5a47dd3f2a1d50c55
7d78d62e5e7199a69ab39cb054f48f6056a9d3af2095d496ad438e6a7a3a0ea7
e190fcfa4c299c69d2181c2c78eae42921c090c0b6c16d525a097112102a1f2d
2aee68da6664e12e0ce7c9f87fafb0b9023cf0af3f4c139d56ed806a3d0eb99a
35eced732a8a2fc1662ad2da32247905f76cdd297dee80a2b6956f91ec5b4a0f
ad0e0905b42607d04da80a4961a31b346131ccfe2685108504ad9e27b201fde2
f0aa8e6215d48163638c78a8c51339ffdc83a69b110b53646ff59e3aee08d196
e7b06b8894b715a0d938df8947ef9f25595b6c2354031409dc06e91b3a738553
7f6e501fe5e4a09ece8e6c8da75f0451e404c239d4bda23f387ab42901d38e0b
481a3a9e70ef903a318ed23f9c5ac127f9854317c9faea609092f4d11fb3835f
541ffd4b6e81ee2ef78c332ab30567bdbb90cb6c7cdf5e0f9b415862041b8cd4
65dec9b2371f499ef7f4e8bb0c27c0d4c031801f72bb186c0ca650aba62f65a8
e1e05012e1570aefc869c42e41c553af3623a06a0f5bc85b6433bcdb9b6da09f
e023484127089d609bad7be875d5cdf1111a7c4c92acbff8b1d0e5dfad803d08
fe651eb69e6449b057f611fdfa24ba85f0535c0b95fa67eefaea88bd5718a866
63752c1c1d51b057162fcdcae73c93ba17bbc01ded36883e7e91e2d80cbdaec6
ad78b1666f134027abcb47e919531e76f4ed7d1e99076fcc4f44249c40f9e3bc
f2e08c1067b51ac3d7a1772af7dda0e7614d17733629d10c7d0d1e4ff2240934
2836fce61c797141296c274b1c94b72a5770b06fb155fe96cee08d3263c21913
e74800ba66e6e744bba5425c205b16e3e8a224fa2b88e6696ca4f991f2dce850
a56a1d2f7c5ade6d058c069c4bcde67f652c0193d9654dc440cc9247735577c6
5fea84068cb70b5ef6d7fdfc0c9e6424ce88aa1b14103aa89ef506e956551d4f
99a4c2752ba30ac97003e3315db7a42f119b80c6665fd10ab172975b7571152f
01ea898f7017042577c86d966e91fef6da57f6e9ca884435e13492da8f0a06fb
da654d8d05444d14177bb670197c3df029effa3a90b148d22196092fbc8ad115
4f3b77b2a4031513c0cfc9c824ae5e03f17e03a3e94a230b70d4b62059fce9c6
60f9805721d58bd315d9fac4c31f2dfa0eb219947a61614dbbeb8d116f415dee
cc13522d550cdaf13c94e18a234520c527b5c9d94947fed22695b7122cf5e9f6
53e3b4b3e919ec047a1536a6170ff9f74fcaeee965dafe8455c54c0f7d9373a2
81e6e8d4ce31317c07e7b238a5cbb3398da723367ec04909d5adbe9dc1227262
2866fde09e5b4ad5408d5d1f894c86dd63139454cd4bafa2350a34d5448ad7fd
c2543641a3181c9a5cd94fa5363f70e57c01bf375593b492a352573e8e0994ee
fec4b206f58436cec3e7cc3d05dff4590189acb2c80d964fdc555a94c76073e9
b4fbd9cdfd0723cf57ce267d12d7bdc27efa0510c523c94431048a0f39416e07
231c0777151524817eacd1567c9ef747893cf56542cd3fe4636567f853c01828
f811bdc282a8ec4f7728834422dc7406cf616336daa69faef12931aa73145bc6
d985476d95dccedff69288c7dfae3a50eecd99c621db0e4ab1f66e9bdfc08d39
4d48c6863f7398fc2cce152d88201e897cbca41722ce4b5aaa76cd4788af81ce
21b068093361b910acdc517fbc2330ec6d3d027b9f1aeb533e10b47e24d130a6
72d0191c3b1de492de944ba2b89eeb20b595169255f009ab09c6307c7a8f3607
55b7642b852989a8f297b249ac7decfcd5570e86ca3eb06449abdbf70ca20208
1c640c5756aafa1fba3e8ff6f0d3dd561660fb76a2847d36ac5a368ce9979231
9bc126f031c0f5198f5dfff8d84ae894d273d302d1a269d2710ac43da5849339
a6ab85ffdbf108910bb917a3d48feac70707561bb62d104143f851f493bb77b1
655d46bff10b6b089ba33fd7832ca306f63a56ba383077917f306f1a4ead59cf
55a3071a76ddfc04a03eed76b2d47db69230c4744cf70632cc4b91846a52f9b6
6fdf90ba311e5ab9d1d546b304b3891c5146c7ccd5d36fcda1abf0b9a21c600f
0a373a000e8c219b85441da71826b96dc2119d5bcd9e60d88c2fda031da09833
7fd76efb0cf98c5b3f9fe09c05b00c87d90d8ce540af19bed572e5f6c5fcba91
7f6a5e3f431ac3c5ab7ca14f721f612c92d06c4bbaaa1d493c78dde51b2e00cf
81d861361d85818b403c011bacd523ed59bcca2d85771a5aa40083db1ae34adc
2a4ffd36a823196cce5173de941df200f38b7acedad1891e8979dfed1328885e
1cc3eabdb1630fb585429d5a956ce99bd41474a57a0daa0bc2e5f23ff4aa06fe
94efa0b56d0649a8a239756e0af96466cb00cb2f79e25a4118bb9a8ab9ce528d
eebdc75696b9bc1e32067b49c20403a374dd127d8e3f968a6d837a0ab9867dc6
f5973739ab422144a461749c81cfd5be28a40f9b9ba073ee3190ccc9dcb1b0ff
904819213d74bbf7f0d1e20b390964d55e89f3d7d14b66aef7b0f490182d3d44
7f4d3fabf6d01dfb4bcb2dd89f3e80cee21285fa2a7fc192e8d39c7a047dae44
8b228d6a728e81e54be8260c3753cca4c3ed01341fe5058907295a82cd4eb5f3
61c5e13907e5ed7b692b482fdfb7a5e048cd2818474bb516400af8380764604a
82d2ebf52d89e4472684bfe49158da94c906c9f4b490dc71c6f1d2882442c5e2
5493926b2175729ab3022143c87ff0bb52200c264797408b9d9218fbb8e0bc5b
c031d1617c30250cf06d554631263ce3d87aa5ec674289c6e66ebb7fd7c9f2e3
503d947667d9baba839f74f03fb55865e2c1f09604b0407b6f029c0affc872d3
c15b8a654c27eb74a1bec2632394904e01fb749ebe70da9fc56bf9e99ca1708b
5972d394e6792a647ad6b21574b6edfdb277cbb2da8d5287b31f6bd295fa3b34
a81d78ab1c8acce0755b5c0fb4c5629b21f03e8d843c1f06e53c7e0251bcea62
20a53b6894675e3ee41a9bc499ee6b6908d1765bd009e02de65348e2d255b0d3
57d381e698e26883990a8b434caca7764daa17271214b602a8a8755530796e4e
1a801c511f037b0d35cfc39fc2e14adf3496fdefafa44480039b9dda58d18f9a
054b4199a1a2f64be11413ad93b6f8832da6628b1a9c6b0cd177b629bbec156f
34e32adbe0a231f3b31000aed41a3b34926cdf45ced7e600d48b9e70082a3743
5ce51e905219b381b9129f356b088adfa5795aab248052a15bef8a74bd0feb09
e915e08a9ef0eb8448e688b023579b7ad1d7161c58d043303bb0ea51276387e7
0148e628b374fe5fe7cc54e4b5734097246a83223450ded08f28b1f41abab736
6124053efcfd9dae2d49d7d8c8be2dd27fc81bff56313c6eb5514875dca32c03
025bd115d622964c824dd725f2a1e68d7c99acee704206e074b0c0f7c545e17e
bccb6bcacafda7dbf56e9466f57cd1129b92f52bd172a15ce262da51432b6202
606a76cc644fffa35c7694f8369dc43fe4723820772663e26ce75bcac85ac66d
df9937f68d48a7e5ced8230ced4c92b618c7d068b3c09afaec1f19762fda0e97
e759d5a193e389aae2754ffcb201712222f3aed0ed7e2c894043495c8d699b47
672ef7ab327a48e2abc0ae5e97aac58a43ef9c6517e6cee6a99c26a4e640f1c3
688e2dcee39240178c76c53c449bbabc25c5e9274d726ca6c0e96f7709a23e72
a1c33fc022333c0086101ca80c3abddb07732742f2a3b7ccdafd10a65be3896f
a44f64db22f996d82f21233f792f31edc5df1588d5e5215882de1b2e73418e32
572263dd6f6a3f05b0f7164eec0d9267514de2279a1864e63b963ab0c874a9ec
f6b0a9045ee3d0094a1ca47af7263063c596da4435e4176de9158c2c9af873a7
adb21f37ff8e8cf8630130ccea65436bfdb257c7734f2e6a3e3a5ddd2cf07003
0cfe8c6797d7b85004a8d25024b87d435b65315cd35d78432c53d3acc6ba2834
c3cc70dc7b762e67bc6ca4918b921c4deeb90dea72aeb844ebcb09603db8bd17
7bba6ed1f4587ee791852622ea7f71e5d3e24e3f72e5298e76942c1c8b54e119
1ce6b9ddeb90198cb1eebdb2e800fa8cedd594ef3988079cd2ab2bfc6c65c0d1
2b013d74f3c24ab6913adc72304927cfaccbe18504ac5c81d7b547d110a716f3
428aa162f41e0385891f18195778ea458bca897119000eb659a3609dc7eb953f
8addd86846c2cadba3285ea9916b264e17a6b14a85bb14e7af74c26d7c55092e
861fee168a467b9606c089920d6e0e846d6a17db840344c96e05b51125c6cfcf
9704c17c8c73efabe3cf2a3fd83bea90d4efe9db84e73e724847e6f98ddd1aa8
3822dc8f8ac50a3b0850cb10e4a2f0ab0df374fcec60edad2439ec8ed7752ce4
c55f61419d3ba342b891571f1ce2bc93c3e1c704246e066a8d83674f46048d52
e956d35afd43405770cfd86070d8def23243b2f484a5e4e51de6e6bad2c51152
031ad3bd485bbeb6922134c355ff5a6688e7c533078b352886c93655d48bbc83
b93c5dc860f8438c024776686fef6dc7ad254cf5e3a60da0acc6118c9d14ebfa
e5c9ddff0e23a77b046aa6675447534d3184c88d506aa5d2ddbd2e83d4b9dade
958c0297190fbb4712ecd8781ee996aed46b6fdbb35cfd276cd5396b7d6498e1
96e76bc147342a0ac061cabbb8bcbe0fb20c96ce6058817c295d82330631f907
bfd31bbe4cdef7dcd9b183808816be1284c829241a51e9a01a4ad5420f1f9525
c9c24cfdd1e08d93f3c1a5b23e5cf9d687c94133bb99879b5f4e79ed8db55767
0d08ccf123faa8a173de119ec98e49a686ca034f65ba2725edb4c92a612dcf08
1479e38e01e46b33354fd17d133e7793fcaa722eb5526cc13f502593def04e1e
94a95525fe4535297abdf8025da1439ec31f21d6384f3f9ec3a76c0c7f0dd450
e7f52ca0cd3f5382140a1418009b84167d4da274f89793b3d7b82cc997289258
1a1bce57419913c8d94c575964b0ddc179f532116cb9fc4d7298a83c700696ef
b520f734e88946966b31ed55216d49d46da3137c01842cb7ccbfc8a618a6611b
0c705566768b2e483d28bb26070d7c49abc4e40565209a4cab7725998882087d
c4e5789ee16741333ee300af9a780d08d1faf0caeb9263dc1df150c8280b8556
555d60eb950ab0ae5f1ef8bb58dffcfcdc97e4c7bd86a66077bb52ee99512c32
2811cedb909571d46b9951b9c4f694a80cb0217d5a459e87e192832a1f9ff233
a87d57ec7420f28de3f91a210dfe78dcf771385ebd4aef74101c33f77c4f3c5c
4f06b4cbe5dbd9fba145fa08d835350cdad9b657760d2590a419fa15fcf5e966
7c14954f6778a89681d6cfd3cdd64626382e339e5263edde14cd2e731593234f
3b45c2fd76f809a6ad68b6df9635ff97cb609542cb74436ecf4a5c474ed7dffb
2de633689e36eaff048640ac7d0e287d1020aa52df77d4aced4b583a5b9b28c8
7d8f25dee51fc116e6bdfe039d8fcb063424f482ac1653877bc4f2f6681732d1
abbad30ff37bdb85cfbb90907c117cb35840ff2583e51e6a27f6dd4d9a1df1f9
0dfc7c72ae9bbb08c5ef3dc3ee0d33fa5874642c8bcb28f55c83e0d3d7e3dbdf
e66f3c2edf166709fe351b2a6fc7bf6eb034bc4ed4f801f2f81cf8fa16e3f0e3
87b5feef9c69faf12c21866115b0eae00e4f55980abe2701bd77dc8cbb4c59bd
73992fc6d3d7a84a73fcf4fd4d1b1411ed581acc22304a672800e4a1befac185
03451a923ccf78041534f71f44d7e9b829fa59b25b3dfd1062d41bf10a2ac6d0
f3b888037f0d7014b24e38b8eecec027060945424352f98738c1e531f91b4058
6f76de4dc69895e5c6aa25694cb3731d1e52fd7bb266be16ec2d6a3f0ba8709a
95517741056b7806611b7fdecdeb6ebaaa25a0d267bf34bfdddc4cda06d4dbd1
a56efcd89af7d93655160ea8720082e635f4b2c073cb4c1517e2f21733035938
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment