(Untitled)
<!--kg-card-begin: markdown--><h1 id="dns">天津DNS数据安全分析报告</h1>
<br/>
<blockquote>
<h6 id="tjsec01">版本：tj-sec.01</h6>
<h6 id="20190617">时间：2019-06-17</h6>
<h6 id="360360cert">作者：360网络安全研究院 &amp; 360CERT</h6>
</blockquote>
<br/>
<h2 id="">摘要</h2>
<ul>
<li>采集了 2019-06-09 日 10 点数据，共计 33650792 条DNS日志</li>
<li>排除掉DNS解析服务器日志，共计 19190292 条客户端请求DNS日志</li>
<li>其中黑域名请求共计 99095 条，占总请求的 0.516%</li>
<li>去重后域名共计 725093 个，其中黑域名共计 4424 个，占比 0.61%</li>
<li>恶意类型覆盖 6 个APT组织的活动，以及40个僵尸网络/远控/后门/木马等恶意软件家族</li>
</ul>
<hr>
<h2 id="">整体分布</h2>
<p>字段说明：</p>
<ul>
<li>TAG 是我们为恶意域名归类的标记，比如“APT.turla”表明是APT组织turla，“Malware.driverlife”表明是恶意软件家族“驱动人生”等等</li>
<li>DNS_Records_Count 是对应类别恶意域名在所有DNS请求中的请求数</li>
<li>Unique_Clients 是对应类别恶意域名的去重客户端个数</li>
<li>Unique_Domains 是对应恶意类别中在数据中出现过的去重恶意域名数</li>
<li>Infos 针对某些类别的额外解释说明</li>
</ul>
<br/>
<font size="0.6">
<table>
<thead>
<tr>
<th>TAG</th>
<th>DNS_Records_Count</th>
<th>Unique_Clients</th>
<th>Unique_Domains</th>
<th>Infos</th>
</tr>
</thead>
<tbody>
<tr>
<td>DNSMon.gray</td>
<td>22331</td>
<td>2629</td>
<td>926</td>
<td>DNSMon自动发现的高度可疑恶意域名</td>
</tr>
<tr>
<td>Malware.miner</td>
<td>11898</td>
<td>193</td>
<td>62</td>
<td>所有的挖矿恶意软件都归为该类，不再细分</td>
</tr>
<tr>
<td>Malware.driverlife</td>
<td>10397</td>
<td>86</td>
<td>22</td>
<td></td>
</tr>
<tr>
<td>BlackHit.vt</td>
<td>9779</td>
<td>257</td>
<td>84</td>
<td></td>
</tr>
<tr>
<td>Malware.unknown</td>
<td>9587</td>
<td>410</td>
<td>58</td>
<td>正在持续跟踪的一批暂未归类恶意软件</td>
</tr>
<tr>
<td>Malware.mykings</td>
<td>5613</td>
<td>45</td>
<td>13</td>
<td></td>
</tr>
<tr>
<td>DNSMon.black</td>
<td>3734</td>
<td>178</td>
<td>48</td>
<td>DNSMon自动发现的确定恶意域名</td>
</tr>
<tr>
<td>APT.turla</td>
<td>3620</td>
<td>2</td>
<td>15</td>
<td></td>
</tr>
<tr>
<td>Malware.Morto</td>
<td>3397</td>
<td>14</td>
<td>6</td>
<td></td>
</tr>
<tr>
<td>DGA.conficker</td>
<td>2760</td>
<td>41</td>
<td>224</td>
<td></td>
</tr>
<tr>
<td>Malware.xorddos</td>
<td>2415</td>
<td>9</td>
<td>14</td>
<td></td>
</tr>
<tr>
<td>Malware.nitol</td>
<td>2248</td>
<td>20</td>
<td>11</td>
<td></td>
</tr>
<tr>
<td>Malware.2gun</td>
<td>2049</td>
<td>349</td>
<td>26</td>
<td></td>
</tr>
<tr>
<td>Malware.ramnit</td>
<td>1985</td>
<td>246</td>
<td>7</td>
<td></td>
</tr>
<tr>
<td>Malware.nadrac</td>
<td>1416</td>
<td>16</td>
<td>5</td>
<td></td>
</tr>
<tr>
<td>Malware.mirai</td>
<td>1404</td>
<td>4</td>
<td>4</td>
<td></td>
</tr>
<tr>
<td>Malware.elknot</td>
<td>1325</td>
<td>5</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>Malware.storm</td>
<td>1301</td>
<td>23</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>Malware.gh0st</td>
<td>1066</td>
<td>17</td>
<td>11</td>
<td></td>
</tr>
<tr>
<td>Malware.zombieboy</td>
<td>472</td>
<td>3</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>Malware.artemis</td>
<td>445</td>
<td>37</td>
<td>9</td>
<td></td>
</tr>
<tr>
<td>WebSafe.coinhive</td>
<td>299</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.zusy</td>
<td>298</td>
<td>1</td>
<td>286</td>
<td></td>
</tr>
<tr>
<td>Malware.darkshell</td>
<td>297</td>
<td>3</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.sality</td>
<td>246</td>
<td>30</td>
<td>33</td>
<td></td>
</tr>
<tr>
<td>Malware.wannycry</td>
<td>221</td>
<td>5</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>Malware.NuggetPhantom</td>
<td>174</td>
<td>26</td>
<td>6</td>
<td></td>
</tr>
<tr>
<td>Malware.remcos</td>
<td>150</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.wannacry</td>
<td>122</td>
<td>8</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>Malware.DUNIHi</td>
<td>107</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>APT.irontiger</td>
<td>98</td>
<td>1</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>BlackHit.nd</td>
<td>79</td>
<td>19</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>APT.unclassified</td>
<td>76</td>
<td>38</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>DGA.hardcoded_fake_dga</td>
<td>72</td>
<td>31</td>
<td>30</td>
<td></td>
</tr>
<tr>
<td>Malware.dbnt</td>
<td>44</td>
<td>18</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>Malware.dsl</td>
<td>32</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.Mylobot</td>
<td>20</td>
<td>5</td>
<td>13</td>
<td></td>
</tr>
<tr>
<td>WebSafe.ad_flush</td>
<td>16</td>
<td>14</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>Malware.bondat</td>
<td>12</td>
<td>3</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.posioncake</td>
<td>11</td>
<td>4</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>Malware.Dorkbot</td>
<td>9</td>
<td>1</td>
<td>4</td>
<td></td>
</tr>
<tr>
<td>APT.bitter</td>
<td>8</td>
<td>1</td>
<td>4</td>
<td></td>
</tr>
<tr>
<td>DGA.popad</td>
<td>8</td>
<td>6</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>APT.oceanlotus</td>
<td>7</td>
<td>1</td>
<td>4</td>
<td></td>
</tr>
<tr>
<td>Malware.barhera</td>
<td>6</td>
<td>2</td>
<td>3</td>
<td></td>
</tr>
<tr>
<td>Malware.irc3</td>
<td>4</td>
<td>1</td>
<td>2</td>
<td></td>
</tr>
<tr>
<td>APT.menupass</td>
<td>4</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.dy2004</td>
<td>2</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.loki</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.rcshark</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.humpler</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.flyboy</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.woring</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
<tr>
<td>Malware.dofloo</td>
<td>1</td>
<td>1</td>
<td>1</td>
<td></td>
</tr>
</tbody>
</table>
</font>
<hr>
<h2 id="">分类描述</h2>
<p>由于恶意类型比较多且繁杂，分类描述中只汇总了 APT 类 和 Malware 类危害较大的类别。</p>
<p>&quot;IOCs&quot; 列出在数据中出现过的对应类别的恶意域名，“Clients”是数据中出现过的访问了恶意域名的客户端IP，按照访问次数从大到小排列，访问次数越多，可以认为是该IP后面对应的恶意软件越活跃。客户端IP有可能是机构/宽带出口IP，会标记类别 NAT，有可能是机房IP，会标记类别IDC。</p>
<p>有些访问可能是安全研究人员的测试性访问，这需要具体IP的归属来判断，通过当前数据不能区分，如果后续追溯，需要注意。</p>
<h3 id="apt">APT 类</h3>
<p>当前一小时采样数据中，共发现6个公开的APT组织的活动迹象，共涉及失陷客户端XXX个，其中可能是政府单位的YYY个，需要高度关注。</p>
<h4 id="aptbitter">APT.bitter</h4>
<p>蔓灵花（T-APT-17、BITTER）APT组织是一个长期针对中国、巴基斯坦等国家进行攻击活动的APT组织，该APT组织为目前活跃的针对境内目标进行攻击的境外APT组织之一。该组织主要针对政府、军工业、电力、核等单位进行攻击，窃取敏感资料，具有强烈的政治背景。该组织最早在2016由美国安全公司Forcepoint进行了披露，并且命名为“BITTER”。</p>
<p>该组织主要采用鱼叉钓鱼的方式，对相关目标单位的个人直接发送嵌入了攻击诱饵的钓鱼邮件。此外，为了提高成功率，也会先对目标发送安全提示相关的钓鱼邮件，诱使被钓鱼用户修改邮件账户密码，从而获取用户的邮箱密码，而后再用被控制的邮箱继续对企业内的其他人进行嵌入攻击诱饵的钓鱼邮件。</p>
<p>详细报告参见 <a href="https://www.freebuf.com/articles/database/192726.html">https://www.freebuf.com/articles/database/192726.html </a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>hewle.kielsoservice.net
spring.tulipnetworks.net
aroundtheworld123.net
thepandaservices.nsiagenthoster.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
8	    60.29.208.115	
</code></pre>
</br>
<h4 id="aptirontiger">APT.irontiger</h4>
<p>铁虎（Iron Tiger）APT行动背后的“熊猫使者”APT组织，被怀疑（必须）是天朝的一个黑客组织，他们专门以政府和相关领域的技术部门作为其主要的攻击目标，并尝试从这些组织和机构中监视和窃取高价值的数据。</p>
<p>该恶意软件的主要攻击目标是亚洲和美国的政府组织、科技公司、教育和通信企业等。最早的攻击是从附有恶意VBS文件的垃圾邮件开始的，VBS文件的作用是从分布式服务器下载恶意payload的下载器。</p>
<p>详细报告参见<a href="https://zhuanlan.zhihu.com/p/33636123">https://zhuanlan.zhihu.com/p/33636123</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>dll.pzchao.com
zll855.gicp.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
98	    60.28.230.130	NAT
</code></pre>
</br>
<h4 id="aptunclassified">APT.unclassified</h4>
<p>详细报告参见 <a href="https://www.anquanke.com/post/id/167077">https://www.anquanke.com/post/id/167077</a>，<br>
<a href="http://www.mottoin.com/detail/3398.html">http://www.mottoin.com/detail/3398.html</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>ftp.byethost10.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
10	    117.13.67.150	NAT
3	    218.69.72.38	NAT
2	    218.68.156.153	NAT
2	    218.68.62.28	NAT
2	    218.67.252.149	NAT
2	    218.69.6.74	    NAT
2	    117.13.3.103	NAT
1   	221.196.149.170	NAT
1   	60.24.88.214	NAT
1   	60.30.254.92	NAT
1   	125.37.184.21	NAT
1   	125.36.33.16	NAT
1   	111.165.222.113	NAT
1   	60.27.152.188	NAT
1   	221.197.154.8	NAT
1   	60.24.142.12	NAT
1   	60.26.72.241	NAT
1   	111.163.144.208	NAT
1   	111.33.50.98	NAT
1   	111.160.43.14	NAT
1   	117.15.191.151	NAT
1   	111.162.212.244	NAT
1   	117.11.117.145	NAT
1   	117.10.138.132	NAT
1   	60.27.193.224	NAT
1   	117.13.192.197	NAT
1   	117.14.147.119	NAT
1   	218.68.148.99	NAT
1   	125.36.107.131	NAT
1   	111.164.215.206	NAT
1   	211.94.237.146	NAT
1   	111.167.9.209	NAT
1   	117.15.190.49	NAT
1   	218.68.108.222	NAT
</code></pre>
</br>
<h4 id="aptmenupass">APT.menupass</h4>
<p>详细报告参见 <a href="https://zhuanlan.zhihu.com/p/52960249">https://zhuanlan.zhihu.com/p/52960249</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>cia.toh.info
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
4	    117.14.156.22	NAT
</code></pre>
</br>
<h4 id="aptturla">APT.turla</h4>
<p>90年代著名网络间谍组织“月光迷宫”（Moonlight Maze）已经演变成了今天的Turla APT，它们都具有或多或少相同的技术手段，且共同背景就是：与俄罗斯政府黑客相关。<br>
以中国和美国等地的政府、军事、大使馆、研究和制药组职为入侵目标，之前也制作过Linux 木马。据说他们是受到俄罗斯政府支持。虽然他们会有行动，但执法机关一直没法知道他们所在何方，因为他们善于隐藏自己。</p>
<p>在网络入侵活动中，黑客一般会利用中转或跳板机作为攻击代理，防止溯源调查，而“月光迷宫”入侵者也是最早采用该技术的攻击者。他们利用很多国家的一系列大学、图书馆等存在系统漏洞的机构电脑作为中转跳板，存储攻击工具，发起网络攻击，以此迷惑调查行为。</p>
<p>详细报告参见 <a href="https://blog.csdn.net/DJY1992/article/details/88994695">https://blog.csdn.net/DJY1992/article/details/88994695</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>music-world.servemp3.com
forum.sytes.net
tiger.got-game.org
x-files.zapto.org
health-everyday.faqserv.com
fifa-rules.25u.com
weather-online.hopto.org
hockey-news.servehttp.com
olympik-blog.4dq.com
top-facts.sytes.net
supernews.sytes.net
cars-online.zapto.org
nhl-blog.servegame.com
marketplace.servehttp.com
newutils.3utilities.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
3495	218.69.186.173	NAT
125	    218.69.133.129	NAT
</code></pre>
</br>
<h4 id="aptoceanlotus">APT.oceanlotus</h4>
<p>海莲花（OceanLotus）也叫APT32或APT-C-00，是一个长期针对中国及其他东亚国家（地区）政府、科研机构、海运企业等领域进行攻击的APT组织。</p>
<p>海莲花的攻击途径为使用木马病毒攻陷、控制政府人员、外包商及行业专家等目标人群的计算机，从中窃取受害者计算机中的机密数据，截获受害计算机与外界传递的情报，甚至操纵该计算机自动发送相关情报。而这一攻击方式有“ 鱼叉攻击 ”和“ 水坑攻击 ”两种。</p>
<p>详细报告参见 <a href="https://zh.wikipedia.org/zh/%E6%B5%B7%E8%8E%B2%E8%8A%B1">https://zh.wikipedia.org/zh/%E6%B5%B7%E8%8E%B2%E8%8A%B1</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>dominikmagoffin.com
check.homeip.net
cortana.homelinux.com
hk.cnnewspapers.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
7	    60.29.208.115	
</code></pre>
</br>
<hr>
<h3 id="malware">Malware 类</h3>
<h4 id="malwaremykings">Malware.mykings</h4>
<p>MyKings 是一个由多个子僵尸网络构成的多重僵尸网络，2017 年 4 月底以来，该僵尸网络一直积极地扫描互联网上 1433 及其他多个端口，并在渗透进入受害者主机后传播包括 DDoS、Proxy、RAT、Miner 在内的多种不同用途的恶意代码。</p>
<p>详细报告参见：<a href="__GHOST_URL__/mykings-the-botnet-behind-multiple-active-spreading-botnets/">https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/</a></p>
<h5 id="iocs">IOCs</h5>
<pre><code>wmi.mykings.top
loop2.haqo.net
loop.haqo.net
p.abbny.com
lpp.beahh.com
o.beahh.com
lplp.beahh.com
js.f4321y.com
oo.beahh.com
pp.abbny.com
loop.abbny.com
down.f4321y.com
down.b591.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1670	60.28.104.130	NAT
1193	218.68.105.24	NAT
951		60.28.47.90	NAT
726		60.30.186.26	NAT
434		218.69.112.141	NAT
300		221.239.96.146	NAT
100		61.181.103.46	NAT
48		111.160.80.250	NAT
22		221.238.238.234	NAT
16		61.181.70.210	NAT
12		123.151.34.82	NAT
8		117.12.96.213	NAT
8		180.213.6.237	NAT
8		60.28.101.104	NAT
7		111.160.40.106	NAT
6		60.25.251.11	NAT
6		60.29.153.61	NAT
6		60.26.80.98	NAT
6		218.68.5.141	NAT
6		60.30.149.102	NAT
6		111.163.120.92	NAT
4		111.160.230.18	NAT
4		61.181.49.105	NAT
4		60.28.101.103	NAT
4		111.30.26.21	NAT
4		218.69.11.110	NAT
4		60.29.90.230	NAT
4		111.160.166.58	NAT
3		111.163.145.128	NAT
2		61.181.49.102	NAT
2		111.30.31.137	
2		111.165.4.199	NAT
2		61.181.60.34	NAT
2		61.181.49.104	NAT
2		218.68.6.50	NAT
2		60.28.101.106	NAT
1		117.11.14.62	NAT
1		60.24.90.130	NAT
1		111.163.45.102	NAT
1		111.160.56.130	NAT
</code></pre>
</br>
<h4 id="malwaredriverlife">Malware.driverlife</h4>
<p>“驱动人生”旗下多款软件携带后门病毒DTStealer，仅半天时间感染了数万台电脑。该病毒进入电脑后，继续通过“永恒之蓝”高危漏洞进行全网传播（特别是政企单位局域网），并回传被感染电脑的IP地址、CPU型号等信息。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>lplp.haqo.net
v.beahh.com
p.awcna.com
p.zer2.com
lpp.ackng.com
p.amxny.com
oo.beahh.com
lpp.zer2.com
down.ackng.com
v.bddp.net
t.awcna.com
lplp.beahh.com
t.zer2.com
pp.abbny.com
lplp.abbny.com
lpp.awcna.com
oom.beahh.com
down.bddp.net
lpp.haqo.net
t.amxny.com
ppm.abbny.com
v.y6h.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1564		221.239.96.146	NAT
1486		218.69.112.141	NAT
1458		60.30.186.26	NAT
1324		60.28.104.130	NAT
956		218.68.105.24	NAT
786		60.28.47.90	NAT
408		61.181.65.154	NAT
326		61.181.103.46	NAT
188		111.160.80.250	NAT
168		111.164.183.26	NAT
156		111.164.175.157	NAT
156		221.238.238.234	NAT
134		111.160.167.194	NAT
78		60.28.101.104	NAT
74		111.160.231.178	NAT
72		111.164.183.91	NAT
61		218.68.5.141	NAT
55		61.181.70.210	NAT
52		60.28.101.103	NAT
50		60.25.251.11	NAT
49		60.28.101.105	NAT
46		218.68.102.37	NAT
42		221.197.55.168	NAT
36		111.160.97.18	NAT
36		60.28.108.201	NAT
24		60.26.80.98	NAT
24		123.150.44.3	NAT
24		125.36.59.125	NAT
20		60.28.41.18	NAT
18		61.181.60.34	NAT
16		111.160.166.58	NAT
16		60.29.153.61	NAT
14		221.196.67.188	NAT
14		60.29.153.45	NAT
12		123.151.34.82	NAT
12		60.28.108.21	NAT
12		123.150.44.11	NAT
10		60.28.101.74	NAT
10		218.68.0.210	NAT
10		111.160.70.46	NAT
8		123.150.44.5	NAT
8		117.12.96.213	NAT
8		180.213.6.237	NAT
8		60.28.101.106	NAT
8		111.165.4.199	NAT
8		61.181.252.146	NAT
8		221.197.66.60	NAT
8		60.29.145.254	NAT
6		61.181.49.105	NAT
6		111.30.78.46	NAT
6		111.160.172.18	NAT
6		111.30.101.238	NAT
6		218.69.11.174	NAT
6		117.9.199.42	NAT
6		111.163.120.92	NAT
4		111.160.212.19	NAT
4		218.69.11.110	NAT
4		111.160.230.18	NAT
4		60.29.90.230	NAT
4		60.29.241.4	NAT;IDC
4		125.35.214.114	NAT
4		111.30.35.142	NAT
4		111.160.40.106	NAT
4		60.30.149.102	NAT
2		111.30.31.137	
2		123.150.44.9	NAT
2		218.69.129.94	NAT
2		60.29.241.1	NAT;IDC
2		60.28.101.102	NAT
2		117.9.18.201	NAT
2		61.181.49.102	NAT
2		61.181.49.104	NAT
2		60.27.119.49	
2		218.68.6.50	NAT
2		60.29.158.138	NAT
2		123.151.196.187	NAT
2		117.9.121.135	NAT
</code></pre>
</br>
<h4 id="malwaredbnt">Malware.dbnt</h4>
<p>一款用于网吧客户机系统维护的软件，同时也是一个win恶意软件下载器，可以下载各种恶意软件，用于流量劫持等恶意行为。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>wj.center.oldlist.info
ecount.2019cn.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
6		61.181.61.82	NAT
6		60.28.130.170	NAT
6		60.30.67.234	NAT
4		60.28.38.18	NAT
3		60.30.111.99	NAT
3		111.160.91.94	NAT
2		125.37.20.209	NAT
2		117.8.246.134	NAT
2		117.13.157.191	NAT
2		111.164.179.188	NAT
1		60.25.31.73	NAT
1		111.164.20.60	NAT
1		60.26.240.155	NAT
1		111.162.55.162	NAT
1		111.164.175.4	NAT
1		125.37.20.206	NAT
1		61.181.111.18	NAT
1		221.197.54.42	NAT
</code></pre>
</br>
<h4 id="malwareirc">Malware.irc</h4>
<p>基于IRC协议的家族统称，包括Windows和Linux两种平台。基于IRC的典型家族有dstd和tsunami，但并非使用了IRC就一定是恶意的。 irc允许私有扩展，所以上线包会有不同的字段和换行格式，我们这里初步的细分为irc1/2/3.</p>
<h5 id="iocs">IOCs</h5>
<pre><code>n.ezjhyxxbf.ru
n.vbemnggcj.ru
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
4		111.161.200.159	NAT
</code></pre>
</br>
<h4 id="malwareremcos">Malware.remcos</h4>
<p>通过钓鱼邮件传播的远控，可在被感染的系统执行键盘记录，远程截屏，文件管理，命令执行等多个功能。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>maxeuro.ddns.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
150		111.163.141.154	NAT
</code></pre>
</br>
<h4 id="malwarexorddos">Malware.xorddos</h4>
<p>该家族针对Linux设备，用于DDoS攻击。因为样本内的配置信息和C2通信均使用了一个自定义的XOR加密算法，故得名XOR.DDOS。该家族支持syn/dns/tcp等flood攻击。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>aaa.xxxatat456.com
p6.2018fly.com
p11.2018fly.com
a381422.f3322.net
www1.gggatat456.com
aaa.gggatat456.com
ppp.xxxatat456.com
aaaaaaaaaa.re67das.com
gh.dsaj2a1.org
k1.2018fly.com
b12.xxxatat456.com
ppp.gggatat456.com
p12.2018fly.com
b12.gggatat456.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
577		60.29.208.112	
461		125.39.151.184	
452		125.39.71.19	
211		124.68.10.20	
145		111.160.201.202	
144		60.28.54.30	NAT
116		61.181.59.88	
2		60.29.141.95	
</code></pre>
</br>
<h4 id="malwarenuggetphantom">Malware.NuggetPhantom</h4>
<p>模块化恶意工具集“NuggetPhantom（掘金幽灵）”最早出现于2016年底，其曾在2016年底的“天翼校园客户端蓝屏事件”以及2017年底的“天翼校园客户端挖矿程序事件”中有所行动。攻击者获知用户计算机存在EternalBlue漏洞后，利用该漏洞向用户计算机发送Eternal_Blue_Payload载荷，该载荷及其所释放的各模块皆通过访问下载服务器来获取加密后的各用途模块文件，并在内存中动态解密这些模块代码，执行模块对应的恶意功能。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>new.szyfpga.com
deg.szyfpg.com
buy.szyfpg.com
cpu.szyfpg.com
new.szyfpg.com
deg.szyfpga.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
57		60.29.64.22	NAT
18		60.24.251.190	NAT
15		117.11.121.200	NAT
15		111.162.220.212	NAT
12		111.162.217.67	NAT
8		117.11.144.69	NAT
8		111.162.216.179	NAT
7		60.29.148.146	NAT
5		218.67.167.157	NAT
5		218.68.24.157	NAT
4		117.15.28.197	NAT
3		211.94.237.161	NAT
3		60.24.248.46	NAT
2		117.12.37.38	NAT
1		60.24.34.84	NAT
1		60.27.137.164	NAT
1		111.162.219.177	NAT
1		111.160.119.194	NAT
1		60.27.152.186	NAT
1		218.67.199.206	NAT
1		60.26.234.195	NAT
1		218.67.233.167	NAT
1		218.67.186.15	NAT
1		218.69.42.199	NAT
1		60.27.191.194	NAT
1		218.69.156.136	NAT
</code></pre>
</br>
<h4 id="malware2gun">Malware.2gun</h4>
<p>涉及业务种类繁杂，除了传播双枪木马的恶意驱动程序，还传播游戏私服驱动，还会盗窃 Steam 账号、劫持 QQ 进行恶意推广</p>
<h5 id="iocs">IOCs</h5>
<pre><code>ua.minding99.com
ba.minding99.com
ia.minding99.com
www.0311bj.cn
a.dearqy.cn
white.shougouji.top
cn4.ppzos.com
www.360gege.com
ic.dztworld.com
cn2.ppzos.com
bc.dztworld.com
sogous.sayblurb.com
pc.ppzos.com
cn5.ppzos.com
ba.dztworld.com
sogousss.srcbooks.com
ub.minding99.com
rat2.100geili.com
ib.dztworld.com
white.fjxmxslaw.com
cn1.ppzos.com
ub.dztworld.com
cn3.ppzos.com
bb.dztworld.com
rat3.100geili.com
sogouss.srcbooks.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
44		111.160.156.10	NAT
27		125.36.117.113	NAT
27		218.69.42.199	NAT
24		117.9.55.29	NAT
22		221.197.187.187	NAT
22		61.181.206.154	NAT
20		218.69.64.130	NAT
20		218.68.145.150	NAT
20		221.198.203.162	NAT
20		221.197.55.4	NAT
20		117.11.128.45	NAT
19		60.26.187.29	NAT
18		117.13.15.45	NAT
18		61.181.131.46	NAT
18		117.11.155.93	NAT
18		60.27.30.20	NAT
18		218.69.74.187	NAT
17		218.68.236.120	NAT
17		61.181.92.130	NAT
16		117.15.222.228	NAT
16		218.68.220.53	NAT
16		218.67.233.167	NAT
16		111.162.24.203	NAT
15		125.38.137.213	NAT
15		60.24.144.117	NAT
15		111.163.146.62	NAT
14		60.25.16.227	NAT
14		60.24.189.241	NAT
14		117.13.140.142	NAT
14		218.69.242.43	NAT
14		60.27.207.61	NAT
14		125.38.176.2	NAT
13		218.68.201.81	NAT
13		60.25.27.238	NAT
13		117.14.249.51	NAT
13		111.167.149.205	NAT
13		111.161.191.151	NAT
12		221.198.110.24	NAT
12		125.38.168.10	NAT
12		60.27.205.7	NAT
12		117.13.140.6	NAT
12		221.197.69.44	NAT
12		117.14.103.18	NAT
12		117.13.168.100	NAT
11		111.163.211.201	
11		117.15.6.163	NAT
11		111.165.7.69	NAT
11		125.37.218.227	NAT
11		111.165.117.68	NAT
11		125.37.188.224	NAT
11		218.68.24.30	NAT
11		111.161.188.225	NAT
11		60.28.35.130	NAT
11		111.167.39.103	NAT
11		221.198.75.232	NAT
10		117.12.144.200	NAT
10		111.162.215.214	NAT
10		218.67.137.157	NAT
10		111.160.66.38	NAT
10		221.197.207.233	NAT
10		218.69.66.23	NAT
10		117.9.138.237	NAT
10		117.14.225.113	NAT
10		221.198.55.86	NAT
10		60.28.137.114	NAT
10		111.166.240.107	NAT
10		60.30.215.214	NAT
10		60.26.60.73	NAT
9		125.36.168.151	NAT
9		111.166.78.107	NAT
9		211.94.226.80	NAT
9		117.15.204.67	NAT
9		117.9.137.247	NAT
9		125.36.159.143	NAT
9		117.9.92.253	NAT
9		218.67.255.130	NAT
9		60.30.177.62	NAT
9		60.27.30.93	NAT
8		111.161.175.142	NAT
8		221.198.205.55	NAT
8		61.181.237.149	NAT
8		111.162.203.133	NAT
8		117.13.15.171	NAT
8		111.160.132.158	NAT
8		221.196.253.224	NAT
8		111.167.55.23	NAT
8		111.163.194.85	NAT
8		125.37.64.100	NAT
8		60.26.75.38	NAT
8		117.15.213.63	NAT
8		111.167.141.36	NAT
8		111.163.213.221	NAT
8		60.29.148.130	NAT
8		218.68.105.107	NAT
7		111.165.249.178	NAT
7		111.163.87.125	NAT
7		125.36.36.45	NAT
7		221.197.12.168	NAT
7		60.27.136.30	NAT
7		218.68.201.142	NAT
7		218.69.166.164	NAT
7		117.11.15.253	NAT
7		125.36.33.178	NAT
7		218.67.166.249	NAT
7		125.36.118.3	NAT
7		60.27.136.126	NAT
7		60.30.10.178	NAT
7		218.69.242.148	NAT
7		221.197.132.12	NAT
6		60.24.89.15	NAT
6		117.11.233.183	NAT
6		60.27.188.32	NAT
6		60.27.193.191	NAT
6		111.162.223.220	NAT
6		60.29.153.58	NAT
6		60.29.153.52	NAT
6		111.163.151.192	NAT
6		60.29.94.82	NAT
6		218.69.133.140	NAT
6		117.14.58.46	NAT
6		218.69.66.151	NAT
6		221.197.29.129	NAT
6		117.11.108.75	NAT
6		117.12.133.137	NAT
6		60.25.50.209	NAT
6		218.69.78.11	NAT
6		117.11.147.199	NAT
6		218.67.199.206	NAT
6		60.29.128.211	NAT
6		60.27.189.251	NAT
5		218.68.114.85	NAT
5		111.160.253.30	NAT
5		60.26.42.206	NAT
5		61.181.63.46	NAT
5		111.163.154.184	NAT
5		60.27.103.152	NAT
5		221.198.228.243	NAT
5		111.164.10.211	NAT
5		117.13.51.90	NAT
5		117.10.10.40	NAT
5		111.162.216.132	NAT
5		111.164.122.84	NAT
5		60.26.41.154	NAT
5		117.8.100.67	NAT
5		111.163.142.158	NAT
5		218.68.158.47	NAT
5		111.163.146.242	NAT
5		111.163.147.202	NAT
5		60.30.98.210	NAT
5		202.99.106.45	NAT
5		60.29.37.38	NAT
5		60.24.88.26	NAT
5		60.27.88.181	NAT
5		60.27.42.203	NAT
4		218.68.114.88	NAT
4		117.14.201.101	NAT
4		60.25.121.64	NAT
4		117.14.132.138	NAT
4		60.27.43.13	NAT
4		221.197.69.167	NAT
4		218.69.186.4	NAT
4		111.163.73.91	NAT
4		218.69.156.112	NAT
4		221.198.239.23	NAT
4		221.196.51.133	NAT
4		60.25.57.45	NAT
4		60.24.71.118	NAT
4		218.67.255.20	NAT
4		60.27.95.94	NAT
4		117.11.242.161	NAT
4		61.181.5.171	NAT
4		221.198.228.100	NAT
4		111.166.68.224	NAT
4		221.198.27.32	NAT
4		218.68.245.188	NAT
4		221.198.235.137	NAT
4		60.27.189.130	NAT
4		111.161.190.189	NAT
4		221.197.133.108	NAT
4		218.68.233.233	NAT
4		221.197.139.0	NAT
4		60.24.249.103	NAT
4		218.69.74.97	NAT
4		125.37.183.60	NAT
4		125.38.176.178	NAT
4		60.27.188.239	NAT
4		218.68.236.207	NAT
4		111.163.220.92	NAT
4		125.38.62.105	NAT
4		61.181.208.87	NAT
4		218.67.255.132	NAT
4		211.94.242.63	NAT
4		125.37.189.121	NAT
4		117.11.144.138	NAT
4		60.27.136.92	NAT
4		125.38.177.227	NAT
3		218.68.233.60	NAT
3		117.10.62.116	NAT
3		218.69.133.156	NAT
3		60.30.37.92	NAT
3		218.69.74.76	NAT
3		125.38.179.187	NAT
3		218.68.233.4	NAT
3		218.67.164.94	NAT
3		117.13.67.54	NAT
3		60.30.158.118	NAT
3		111.167.10.59	NAT
3		117.11.117.136	NAT
3		221.198.98.75	NAT
3		111.164.38.243	NAT
3		221.196.194.139	NAT
3		117.9.120.72	NAT
3		218.69.164.111	NAT
3		221.198.167.50	NAT
3		221.198.218.193	NAT
3		111.163.156.144	NAT
3		221.197.177.239	NAT
3		221.196.56.129	NAT
3		60.26.94.128	NAT
3		221.198.104.101	
3		125.36.52.31	NAT
3		117.9.239.187	NAT
3		117.11.239.145	NAT
3		60.24.91.72	NAT
3		221.198.174.199	NAT
3		218.69.242.4	NAT
3		125.37.183.147	NAT
3		60.27.60.238	NAT
3		218.67.234.37	NAT
3		117.11.121.171	NAT
3		218.68.204.2	NAT
3		117.12.80.93	NAT
3		111.167.205.126	NAT
3		221.198.61.203	
3		221.197.222.238	NAT
3		218.68.102.6	NAT
3		60.24.226.134	NAT
3		117.14.249.216	NAT
3		125.37.189.53	NAT
3		60.25.2.192	NAT
3		60.27.174.218	NAT
3		60.27.173.241	NAT
3		117.12.20.146	NAT
3		60.28.48.194	NAT
3		111.163.150.91	NAT
3		117.13.3.30	NAT
2		60.24.91.55	NAT
2		218.68.219.19	NAT
2		125.37.121.172	NAT
2		60.26.79.134	NAT
2		60.30.203.70	NAT
2		117.14.207.142	NAT
2		111.165.120.223	NAT
2		117.10.65.170	NAT
2		111.162.200.171	NAT
2		111.163.77.247	NAT
2		60.27.138.181	NAT
2		117.14.249.26	NAT
2		117.15.222.52	NAT
2		60.27.136.84	NAT
2		60.29.215.153	NAT
2		117.15.190.58	NAT
2		111.163.198.248	NAT
2		60.26.122.202	NAT
2		111.161.221.189	NAT
2		111.162.216.62	NAT
2		111.166.213.251	NAT
2		111.165.116.208	
2		111.160.120.54	NAT
2		111.165.30.69	NAT
2		221.196.203.65	NAT
2		218.67.146.57	
2		111.166.66.253	
2		111.167.79.178	
2		111.162.8.186	NAT
2		125.37.183.50	NAT
2		111.161.190.225	NAT
2		117.10.249.226	NAT
2		117.13.104.78	NAT
2		221.197.162.210	NAT
2		60.25.115.96	NAT
2		111.165.214.234	NAT
2		221.196.172.170	NAT
2		117.10.68.185	
2		125.37.191.87	NAT
2		60.24.127.98	NAT
2		117.12.16.123	NAT
2		117.14.126.217	NAT
2		111.162.200.108	NAT
2		60.26.95.79	NAT
2		221.198.59.196	
2		125.37.167.208	NAT
2		60.27.104.1	NAT
2		218.69.234.247	NAT
2		111.166.117.229	NAT
2		117.10.138.212	NAT
2		60.25.17.106	NAT
2		117.8.71.114	NAT
2		60.25.154.32	NAT
2		117.10.105.154	
1		218.68.114.232	NAT
1		218.68.201.255	NAT
1		125.37.29.177	NAT
1		218.67.254.103	NAT
1		61.181.40.58	NAT
1		111.161.235.57	NAT
1		60.24.88.219	NAT
1		218.68.146.254	NAT
1		218.68.102.48	NAT
1		117.9.88.178	NAT
1		60.24.12.95	NAT
1		111.163.208.48	NAT
1		117.14.227.37	
1		125.37.189.90	NAT
1		218.67.204.218	NAT
1		125.37.182.15	NAT
1		60.24.12.200	NAT
1		218.69.72.24	NAT
1		117.12.233.224	NAT
1		111.163.16.168	NAT
1		111.163.122.25	NAT
1		221.198.131.25	NAT
1		60.25.39.56	NAT
1		117.13.95.251	NAT
1		221.196.194.116	NAT
1		60.26.158.69	NAT
1		117.14.249.73	NAT
1		111.163.142.187	NAT
1		125.37.190.50	NAT
1		218.68.147.89	NAT
1		221.197.69.49	NAT
1		117.14.107.42	NAT
1		117.15.192.109	NAT
1		117.10.64.131	NAT
1		111.163.151.214	NAT
1		111.165.106.1	
1		221.196.51.5	NAT
1		125.36.118.252	NAT
1		117.10.64.187	NAT
1		221.197.54.203	NAT
1		218.68.156.175	NAT
1		60.24.88.200	NAT
1		111.163.146.23	NAT
1		221.197.12.150	NAT
1		125.38.18.28	NAT
1		117.8.85.121	NAT
1		60.25.13.211	NAT
1		111.162.220.193	NAT
</code></pre>
</br>
<h4 id="malwaredarkshell">Malware.darkshell</h4>
<p>darkshell 是面向Window平台的DDoS malware，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>equant.wang
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
257		125.37.163.193	NAT
35		60.30.158.118	NAT
5		117.131.173.13	NAT
</code></pre>
</br>
<h4 id="malwarenadrac">Malware.nadrac</h4>
<p>一款简单的远控程序，又被称为Farfli, YongLouts。一般主要是充当下载器，包含键盘记录，代理，音视频监听等多个插件。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>dllhost.website
baijinddos.xyz
mdzz2018.msns.cn
sky.hobuff.info
indonesias.website
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
526		60.30.199.26	NAT
509		111.160.156.10	NAT
203		111.163.143.228	NAT
84		60.28.140.93	NAT
54		60.29.124.250	NAT
8		60.28.114.2	NAT
7		60.29.133.19	NAT
4		111.160.110.26	NAT
4		218.69.27.222	NAT
4		125.37.162.202	NAT
3		111.165.217.222	NAT
3		60.28.101.14	NAT
2		125.39.151.188	
2		60.29.64.86	NAT
1		60.28.114.30	NAT
</code></pre>
</br>
<h4 id="malwareelknot">Malware.elknot</h4>
<p>一款比较知名的木马，它允许远程攻击者利用受感染计算机发动DDoS攻击。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>fk.appledoesnt.com
ll.8suf.com
baijinddos.xyz
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
452		61.181.59.88	
258		60.30.26.124	
257		60.29.144.220	
203		111.163.143.228	NAT
155		218.68.0.210	NAT
</code></pre>
</br>
<h4 id="malwareloki">Malware.loki</h4>
<p>loki是一款针对windows平台的恶意软件，其主要目的在于窃取受害者的敏感信息，browser,email,ftp,以及诸多付费工具的licence等。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>silverlinehospital.in
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		125.37.160.100	NAT
</code></pre>
</br>
<h4 id="malwarebarhera">Malware.barhera</h4>
<p>一款木马后门，用于下载其他的恶意软件。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>p.raidmedia.com.cn
update.bainv.net
l.raidmedia.com.cn
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
3		221.197.133.137	NAT
3		61.181.5.31	NAT
</code></pre>
</br>
<h4 id="malwarezombieboy">Malware.zombieboy</h4>
<p>zombieboy是一款针对windows平台的加密货币挖矿蠕虫。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>cuijiahuq.f3322.net
dns.fq520000.org
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
13		218.69.133.37	NAT
1		125.35.213.157	NAT
</code></pre>
</br>
<h4 id="malwarercshark">Malware.rcshark</h4>
<p>rcshark是一款针对windows平台的后门病毒，其主要功能是窃取用户的敏感信息。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>xiangban1988.3322.org
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		60.27.188.109	NAT
</code></pre>
</br>
<h4 id="malwaredorkbot">Malware.Dorkbot</h4>
<p>属于蠕虫病毒，被感染的所有主机都会沦为黑客的肉鸡，不定期对外网主机进行DDoS攻击，同时其还具有极强的隐蔽性，运行之后会把恶意代码注入到合法进程，然后删除自身。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>a.amous1epadsafa42.com
a.ajjjqws1fkxx42.com
a.adoyou1understandme42.com
a.aiphon1egalaxyblack42.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
9		60.30.214.50	NAT
</code></pre>
</br>
<h4 id="malwareramnit">Malware.ramnit</h4>
<p>ramnit是一款针对windows平台的病毒，最初表现为一款感染U盘，FTP服务器文件的蠕虫，传播大量广告软件，随后发展成银行木马，用于窃取用户金融以及其它敏感信息。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>stromoliks.com
jdskfjkfw3232234.com
fkjdeljfeew32233.com
rterybrstutnrsbberve.com
fget-career.com
fdwelklwe3093443.com
supnewdmn.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
256		61.181.30.138	NAT
112		60.28.141.50	NAT
79		125.36.152.117	NAT
34		61.181.108.2	NAT
32		60.28.156.216	
30		117.131.173.16	NAT
30		221.197.12.90	NAT
27		60.29.37.38	NAT
25		117.15.99.67	NAT
25		111.160.91.94	NAT
20		111.30.30.18	NAT
19		111.160.100.230	NAT
19		111.165.24.101	NAT
16		61.181.252.146	NAT
16		111.164.20.30	NAT
15		60.30.4.11	
14		221.239.93.251	
13		60.29.22.98	    NAT
12		60.25.11.13 	NAT
12		218.69.90.46	NAT
11		111.160.156.10	NAT
11		111.160.132.158	NAT
10		60.30.199.26	NAT
10		60.29.89.34 	NAT
10		218.68.224.88	NAT
9		218.68.158.40	NAT
9		60.30.164.26	NAT
8		60.26.101.13	NAT
8		218.68.233.132	NAT
8		221.197.139.99	NAT
8		221.197.122.193	NAT
7		221.196.108.115	NAT
7		61.181.143.34	NAT
7		117.9.93.13 	NAT
7		60.25.148.35	NAT
7		180.213.5.10	NAT
7		117.11.218.223	NAT
6		60.27.31.62	    NAT
6		218.69.129.222	NAT
6		111.162.212.244	NAT
6		218.68.234.159	NAT
6		218.68.234.64	NAT
6		111.160.233.182	NAT
6		125.38.176.178	NAT
6		117.11.153.212	NAT
6		221.196.180.62	NAT
6		221.198.66.44	NAT
6		60.26.225.158	NAT
5		221.198.170.164	NAT
5		111.163.158.181	NAT
5		125.36.153.16	NAT
5		117.10.62.226	NAT
5		117.12.202.189	NAT
5		218.69.226.106	NAT
5		117.13.115.123	NAT
5		61.181.74.42	NAT
5		60.29.133.19	NAT
5		218.69.55.166	NAT
5		218.69.54.167	NAT
5		211.94.243.185	NAT
5		60.30.208.226	NAT
5		117.9.18.2  	NAT
5		106.47.29.70	NAT
5		125.37.29.120	NAT
5		111.162.149.78	NAT
5		218.68.0.6	    NAT
4		111.161.158.131	NAT
4		211.94.254.85	NAT
4		218.69.6.74	    NAT
4		221.198.86.145	NAT
4		111.160.120.54	NAT
4		60.24.90.226	NAT
4		60.29.93.221	NAT
4		111.163.143.228	NAT
4		111.163.123.7	NAT
4		221.198.238.209	NAT
4		60.24.184.70	NAT
4		60.27.31.0  	NAT
4		117.15.125.181	NAT
4		61.181.140.42	NAT
4		117.12.37.223	NAT
4		218.67.234.60	NAT
4		125.38.176.229	NAT
4		125.37.29.23	NAT
4		61.181.103.138	NAT
4		117.11.10.12	NAT
4		60.24.233.164	NAT
4		60.28.104.130	NAT
4		218.68.105.7	NAT
4		111.166.237.230	NAT
4		221.196.46.61	NAT
4		117.14.119.35	NAT
4		60.26.203.160	NAT
4		117.9.237.225	NAT
4		218.68.200.243	NAT
4		218.68.229.81	NAT
4		218.68.219.29	NAT
3		221.198.67.88	NAT
3		117.10.236.245	NAT
3		117.15.192.231	NAT
3		60.24.45.218	NAT
3		117.12.146.72	NAT
3		60.29.43.46	    NAT
3		117.9.191.22	NAT
3		111.163.144.224	NAT
3		125.37.182.99	NAT
3		117.10.138.46	NAT
3		211.94.243.121	NAT
3		111.161.150.34	NAT
3		61.181.219.120	NAT
3		60.27.60.159	NAT
3		111.162.163.231	NAT
3		111.166.238.248	NAT
3		117.12.1.165	NAT
3		117.13.168.162	NAT
3		202.99.106.47	NAT
3		221.197.179.98	NAT
3		211.94.226.74	NAT
3		60.28.101.104	NAT
3		111.165.188.122	NAT
3		60.29.154.226	NAT
3		60.29.15.2	    NAT
3		111.165.105.247	NAT
3		60.26.239.60	NAT
3		43.249.136.20	NAT
3		61.181.202.5	
3		60.26.142.193	NAT
3		117.13.106.191	NAT
3		60.29.63.18	    NAT
3		60.29.16.94	    NAT
3		218.69.52.252	NAT
3		117.14.66.156	NAT
3		221.196.97.11	NAT
3		218.67.181.124	NAT
3		111.160.80.3	NAT
3		117.13.140.5	NAT
3		111.165.11.60	NAT
3		60.25.251.11	NAT
2		111.160.97.18	NAT
2		218.68.102.58	NAT
2		125.37.217.118	NAT
2		125.37.191.155	NAT
2		221.196.97.36	NAT
2		221.196.194.253	NAT
2		218.68.224.39	NAT
2		218.68.102.247	NAT
2		111.160.198.83	NAT
2		60.27.189.44	NAT
2		117.12.133.191	NAT
2		60.30.156.190	NAT
2		211.94.248.28	NAT
2		221.198.60.201	NAT
2		60.26.132.173	NAT
2		117.15.22.130	NAT
2		218.69.55.247	NAT
2		117.9.70.23 	NAT
2		111.162.216.127	NAT
2		61.181.63.138	NAT
2		60.24.127.98	NAT
2		125.36.101.224	NAT
2		117.12.125.160	NAT
2		111.165.56.53	NAT
2		111.165.128.30	NAT
2		125.37.212.67	NAT
2		218.68.107.108	NAT
2		111.167.149.238	NAT
2		221.197.154.147	NAT
2		117.13.244.21	NAT
2		125.35.249.1	NAT
2		218.69.11.58	NAT
2		117.10.28.225	NAT
2		221.197.133.137	NAT
2		111.167.46.70	NAT
2		60.29.179.114	NAT
2		221.196.180.242	NAT
2		60.30.105.33	NAT
2		60.27.138.17	NAT
1		218.67.254.17	NAT
1		117.11.225.137	NAT
1		111.163.143.193	NAT
1		60.24.89.15	    NAT
1		218.69.55.60	NAT
1		60.30.215.242	NAT
1		111.163.140.152	NAT
1		111.160.108.34	NAT
1		221.198.218.112	NAT
1		125.38.177.138	NAT
1		60.29.95.82	    NAT
1		221.196.194.2	NAT
1		221.197.162.54	NAT
1		117.15.191.57	NAT
1		60.27.42.62	NAT
1		117.9.229.148	NAT
1		218.69.234.252	NAT
1		60.27.79.17	    NAT
1		117.8.101.63	NAT
1		60.30.105.41	NAT
1		125.37.125.3	NAT
1		221.198.118.158	NAT
1		60.28.101.103	NAT
1		60.28.101.106	NAT
1		60.27.205.187	NAT
1		211.94.242.118	NAT
1		117.12.144.7	NAT
1		117.8.100.70	NAT
1		60.29.30.190	NAT
1		60.26.180.205	NAT
1		111.162.221.168	NAT
1		221.198.110.209	NAT
1		117.14.70.156	NAT
1		60.29.116.18	NAT
1		111.165.72.25	NAT
1		218.69.147.133	NAT
1		60.29.153.61	NAT
1		221.196.119.133	NAT
1		111.163.22.227	NAT
1		60.30.204.82	NAT
1		111.167.144.199	NAT
1		60.30.240.226	NAT
1		111.166.156.237	NAT
1		60.28.38.18	    NAT
1		125.37.182.185	NAT
1		218.68.235.133	NAT
1		125.38.191.184	NAT
1		111.160.97.42	NAT
1		111.163.78.80	NAT
1		111.161.189.215	NAT
1		117.11.239.56	NAT
1		218.69.243.164	NAT
1		60.29.179.42	NAT
1		117.12.158.82	NAT
1		60.25.63.52	    NAT
1		60.25.10.147	NAT
1		60.27.79.149	NAT
1		111.162.163.241	NAT
1		221.239.72.170	NAT
</code></pre>
</br>
<h4 id="malwaregh0st">Malware.gh0st</h4>
<p>GH0ST是一款经典的RAT，针对Windows系统，支持截屏、录像、录音等多种spy功能。GH0ST由中国人编写，已经开放源码，因而存在较多的变种。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>www.sousouweb.com
ime.mys2005.xyz
linux145.f3322.net
3s.dkys.org
yk.520yxsf.com
baijinddos.xyz
xiangban1988.3322.org
fwq2020.f3322.net
zerococoll.f3322.net
sky.hobuff.info
www.wulei168.pw
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
509		111.160.156.10	NAT
203		111.163.143.228	NAT
103		125.39.138.171	
94		60.28.34.59	
54		60.29.124.250	NAT
34		60.30.199.26	NAT
20		60.28.99.74 	NAT
18		61.181.81.82	NAT
12		218.69.11.58	NAT
4		103.233.4.30	NAT
3		111.165.217.222	NAT
3		221.239.104.13	
3		60.28.101.14	NAT
2		125.39.151.188	
1		60.27.188.109	NAT
1		60.28.101.104	NAT
</code></pre>
</br>
<h4 id="malwareposioncake">Malware.posioncake</h4>
<p>一款内置于手机ROM的恶意代码模块，注入Phone进程，拦截短信和发送短信，自动扣费，窃取信息等等。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>hcbh.heycould.com
hacdl.junwonsil.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
6		60.27.42.111	NAT
2		125.37.189.42	NAT
2		60.27.43.103	NAT
1		111.162.129.93	NAT
</code></pre>
</br>
<h4 id="malwarenitol">Malware.nitol</h4>
<p>又名dsl，是国内著名的面向Window平台的DDoS类型的 botnet家族，支持icmp/udp/tcp/http等多种攻击手段，具有较多的变种。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>dllhost.website
mssql.noip.cn
mdzz2018.msns.cn
yk.520yxsf.com
akmfs.com
40kam.cn
sky.hobuff.info
a.aklianfa.com
indonesias.website
3s.dkys.org
ak-74.top
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
709		60.30.199.26	NAT
509		111.160.156.10	NAT
84		60.28.140.93	NAT
54		60.29.124.250	NAT
11		111.163.143.228	NAT
8		60.28.114.2	    NAT
7		60.29.133.19	NAT
4		125.37.162.202	NAT
4		111.160.110.26	NAT
4		218.69.27.222	NAT
3		111.165.217.222	NAT
3		60.28.101.14	NAT
2		125.39.151.188	
2		60.29.64.86	    NAT
1		60.27.119.49	
1		60.28.114.30	NAT
1		60.28.101.104	NAT
</code></pre>
</br>
<h4 id="malwaremirai">Malware.mirai</h4>
<p>通过大规模弱口令扫描来实现传播的蠕虫病毒，将Linux平台的Iot设备控制，用于DDoS攻击。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>scan.santaiot.net
seven.nadns.info
netflux.r00ts.online
cnc.stresser.pw
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
585		60.29.215.141	NAT
527		111.160.57.142	NAT
290		61.181.115.50	NAT
2		111.167.211.108	NAT
</code></pre>
</br>
<h4 id="malwarehumpler">Malware.humpler</h4>
<p>该病毒伪装成多款小工具（如：老板键、屏幕亮度调节等），正通过2345软件大全等多个知名下载站进行传播。病毒入侵电脑后，会劫持QQ、360、搜狗等（市面上所有主流）浏览器首页。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>www.baidu-home.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		60.27.136.24	NAT
</code></pre>
</br>
<h4 id="malwarewannycry">Malware.wannycry</h4>
<p>一种“蠕虫式”的勒索病毒软件，利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播，感染计算机后会向计算机中植入敲诈者病毒，导致电脑大量文件被加密。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
215		60.30.147.86	
3		125.35.211.131	NAT
1		61.181.70.210	NAT
1		60.29.64.22	    NAT
</code></pre>
</br>
<h4 id="malwaredunihi">Malware.DUNIHi</h4>
<p>DUNIHI (VBS_DUNIHI.ELDSAVJ)是一个有后门和蠕虫功能的很著名的VB脚本，在某些单独的事件中，该脚本在垃圾邮件活动中与Adwind一起释放。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>pm2bitcoin.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
107		60.29.15.54	NAT
</code></pre>
</br>
<h4 id="malwareflyboy">Malware.flyboy</h4>
<p>一款常见的DDoS木马。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>3s.dkys.org
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		60.28.101.104	NAT
</code></pre>
</br>
<h4 id="malwarezusy">Malware.zusy</h4>
<p>隐藏在PowerShell中，当用户打开，代码将被执行并连接到CC，接下来就会下载文件并执行，最终部署恶意程序downloader。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>buy1.amzjhhl.ru
buy1.gsnrrtf.net
buy1.csfnlpg.com
buy1.cdpgphm.ru
buy1.dhccyjw.net
buy1.tnnxkzu.ru
buy1.emafzud.net
buy1.rcdibnh.net
buy1.uxesjmg.ru
buy1.swexydc.ru
buy1.jgbfjlp.net
buy1.zwnbddh.com
buy1.xrcugmy.net
buy1.bgnlbfi.ru
buy1.nonyans.net
buy1.xfwwcmk.net
buy1.iqcpfzo.ru
buy1.anzxoii.net
buy1.ntlucrd.com
buy1.tiksrzr.com
buy1.otkmgkl.ru
buy1.icwastp.ru
buy1.rmpokmg.ru
buy1.gyhhgrc.ru
buy1.aenqzfk.net
buy1.hbjxtas.com
buy1.tpibfhe.ru
buy1.nuawren.com
buy1.nzuibjx.net
buy1.swemrgx.ru
buy1.qzojbhw.net
buy1.qwlhrkg.net
buy1.cbbfywr.ru
buy1.iryjeqo.com
buy1.eftctph.com
buy1.rdggegr.ru
buy1.fmrolhu.ru
buy1.rksgxwu.com
buy1.ddplnfp.net
buy1.yhbayam.net
buy1.uqccxlp.com
buy1.mnplqfs.net
buy1.dhzozeh.com
buy1.tlwrshg.net
buy1.aldloqz.ru
buy1.lrtapbs.ru
buy1.blwszto.ru
buy1.ejuzlle.net
buy1.gxhrnou.net
buy1.iwjsndf.com
buy1.pkhruee.net
buy1.zrsglol.com
buy1.kfysswc.com
buy1.jlaxfgb.ru
buy1.lyksyom.ru
buy1.mbtndqh.ru
buy1.pmhncfh.com
buy1.pfccfpb.ru
buy1.ihtmojm.ru
buy1.jzwhkrf.ru
buy1.mbiaean.ru
buy1.oddcucl.net
buy1.wzxtbjj.com
buy1.fpkrylz.com
buy1.jrwgrbg.ru
buy1.qnmbbdf.com
buy1.ddxkizq.net
buy1.yyalymk.net
buy1.acthwqo.com
buy1.snpntqd.com
buy1.azcduku.net
buy1.ncfnqjq.ru
buy1.ipqwqms.com
buy1.ofcllwd.net
buy1.xbxkmpp.com
buy1.alxluqi.ru
buy1.dyimlqp.net
buy1.fiocywx.com
buy1.abqlnrj.net
buy1.rrsywps.net
buy1.dyqzunc.ru
buy1.arhaqps.net
buy1.zpoxqcm.com
buy1.loakwst.net
buy1.nmwfrco.net
buy1.bhwfnll.net
buy1.osqmhxk.com
buy1.tzsduod.ru
buy1.lzssazr.net
buy1.icuieia.com
buy1.subbsty.net
buy1.fyalcld.net
buy1.odadidc.net
buy1.oabnnmt.net
buy1.aypoxyp.ru
buy1.nzliqic.net
buy1.xcypwuk.com
buy1.kfxzzsn.com
buy1.iywiqzr.com
buy1.rkacqse.ru
buy1.ymqfcbd.net
buy1.pypylia.com
buy1.gcyzgmf.com
buy1.xkxkdrn.com
buy1.cuoohzc.net
buy1.umjumsm.ru
buy1.pyyynza.com
buy1.udcjmjp.com
buy1.jpczuxg.com
buy1.bhnlbnh.net
buy1.gkhdxpf.net
buy1.hcgrnpn.ru
buy1.mslethd.ru
buy1.rfigznh.com
buy1.fkixudk.com
buy1.dqjkgce.net
buy1.rpxiwkc.com
buy1.niobmdi.com
buy1.dgwxumj.net
buy1.xalccbx.net
buy1.rzlqryz.net
buy1.dmbszul.com
buy1.uxxbwrr.ru
buy1.lgllgjs.net
buy1.tklwfah.ru
buy1.bbjzotm.ru
buy1.muxizct.ru
buy1.iexcrzz.net
buy1.gqoshyz.com
buy1.kyjbpwo.com
buy1.qxicnnb.com
buy1.yhpgwbd.net
buy1.txhkpgx.ru
buy1.iyfekft.ru
buy1.rfjllrs.net
buy1.xfqhajt.ru
buy1.zdfytrg.net
buy1.dfllbal.com
buy1.ctxjyex.com
buy1.yeyagrf.net
buy1.ulijgtz.com
buy1.rpskkwa.ru
buy1.yltzlez.ru
buy1.uwzghwb.net
buy1.jsitazi.ru
buy1.fehllnd.ru
buy1.ewkuzls.com
buy1.gciwhdc.net
buy1.khjizyn.com
buy1.ajjchrq.com
buy1.hizfyzc.ru
buy1.acejruk.com
buy1.jcerqdu.com
buy1.litporj.net
buy1.xygtuqr.net
buy1.zhzecai.ru
buy1.lrqfxhc.net
buy1.plbjxaw.net
buy1.xisphiu.ru
buy1.nmdmzxk.com
buy1.whowczd.net
buy1.gfygooj.net
buy1.bkfhpoo.net
buy1.xfojdma.com
buy1.zzcsctw.com
buy1.shkjsxn.com
buy1.sczeedr.com
buy1.jlqawun.net
buy1.zbrxzcd.net
buy1.eawlrfo.net
buy1.lkwwnuy.com
buy1.eojrzia.com
buy1.mkehkqw.ru
buy1.bunndlc.net
buy1.caejtfs.com
buy1.qdlycsz.ru
buy1.aamdljg.net
buy1.uarszmk.net
buy1.eghszki.ru
buy1.kyzweka.ru
buy1.ucykaub.net
buy1.unxoyqg.net
buy1.ujgrmdw.net
buy1.oftxynb.com
buy1.byimnch.com
buy1.agipcrc.com
buy1.eqsjnjm.com
buy1.wqrtqpc.com
buy1.wosqlhp.com
buy1.txrytdk.ru
buy1.ncmxoby.net
buy1.fkztbqc.ru
buy1.yyeytoh.ru
buy1.xxegozl.net
buy1.umlddds.com
buy1.ihsfmzs.ru
buy1.bzloyhl.com
buy1.fpucsex.net
buy1.dhenkce.ru
buy1.wqpquur.com
buy1.jeuggdx.net
buy1.bqsmdwo.net
buy1.mswcoje.ru
buy1.snabueo.com
buy1.zsczqfy.ru
buy1.fwtoowy.ru
buy1.ofinzks.net
buy1.ctemxrb.com
buy1.bwfakki.com
buy1.losoipz.net
buy1.wyxhwju.net
buy1.zkznpjx.net
buy1.wtiksxd.com
buy1.swhjoah.com
buy1.nasuofo.net
buy1.yuwtdkb.net
buy1.gtdiebz.net
buy1.whihyrr.net
buy1.jslmhdt.ru
buy1.jsbutdx.net
buy1.ztkwpnt.net
buy1.nrtqgnk.ru
buy1.kmmeycg.net
buy1.jhlzgnx.com
buy1.holmewx.com
buy1.kqktsmm.net
buy1.sbbcsds.ru
buy1.ldqfpjt.ru
buy1.nnhaioe.ru
buy1.ibhyldi.com
buy1.konsxcs.net
buy1.cbhsshp.com
buy1.gopdypa.net
buy1.trozbgi.com
buy1.kaohkbo.ru
buy1.zjfyxty.com
buy1.llhwqrb.ru
buy1.dmyldke.ru
buy1.efyncmf.net
buy1.emjrsao.com
buy1.xwyntku.com
buy1.hltlxfs.net
buy1.thbjtrm.net
buy1.qwgsncg.com
buy1.fbbefbz.com
buy1.twgpprb.net
buy1.nhexpdk.ru
buy1.gehbfee.ru
buy1.mgqwpyq.net
buy1.gykmlbd.com
buy1.xtxflqf.net
buy1.nweqxdp.com
buy1.alggopl.com
buy1.hpczbok.com
buy1.rgqkjoz.net
buy1.hyldyiu.com
buy1.mnbqzcx.com
buy1.ppolbqq.com
buy1.zhytqnk.com
buy1.lntgdkt.net
buy1.egrsdno.ru
buy1.sningaz.net
buy1.wbtjqns.com
buy1.twqqspy.ru
buy1.uaegzfg.net
buy1.lybnmaq.net
buy1.tqebcid.com
buy1.gyqxhuk.com
buy1.lgppbam.net
buy1.oyzkzhk.ru
buy1.tbsnaoq.ru
buy1.jfmnyjj.net
buy1.lrzgxti.ru
buy1.byosnwr.ru
buy1.deutskr.net
buy1.rhaaxsx.net
buy1.ptprctl.ru
buy1.jaisoap.net
buy1.ifjzgwm.com
buy1.rynffwj.net
buy1.gbcdmyk.com
buy1.uzinsse.ru
buy1.ioicphz.com
buy1.ukciate.ru
buy1.lezsbdq.com
buy1.dertjgm.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
298		111.160.240.107	NAT
</code></pre>
</br>
<h4 id="malwareworing">Malware.woring</h4>
<p>woring是一款针对Linux平台的 DDoS类型的botnet，因为函数命名存在一个typo: working-&gt;woring 故得名。woring主要感染x86 CPU架构的系统，支持常见的DDoS攻击手段。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>ak-74.top
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		60.27.119.49	
</code></pre>
</br>
<h4 id="malwareminer">Malware.miner</h4>
<p>各种挖矿软件家族，包括LSDminer、MSRAminer等等。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>mine.ppxxmr.com
p.awcna.com
p.zer2.com
pool.minexmr.com
tgoodluck.info
fr.ppxxmr.org
x.csrss.website
pool.usa-138.com
lpp.zer2.com
rapid7cpfqnwxodo.tor2web.fyi
testnet-seed.bitcoin.jonasschnelli.ch
xmr.crypto-pool.fr
task.estonine.com
urlxxx.at.ua
pluck.moisture.tk
xmr.f2pool.com
donate.v2.googel-dns.com
xmr-eu2.nanopool.org
log.miniast.com
lsd.systemten.org
seed.tbtc.petertodd.org
loop.haqo.net
a.csrss.website
reader.pamphler.com
t.awcna.com
luoxkexp.com
poole.laofubtc.com
indonesias.me
tar.kziu0tpofwf.club
p1.qsd2xjpzfky.site
p3.qsd2xjpzfky.site
systemten.org
xmr-eu1.nanopool.org
lpp.awcna.com
swt.njaavfxcgk3.club
null.exhauest.com
www.zeculiar.tk
dns.posthash.org
guojun.website
p.amxny.com
loop.sawmilliner.com
z.drawal.tk
morphed.ru
xmr.pool.minergate.com
rapid7cpfqnwxodo.onion.in.net
dnsseed.bluematt.me
s.csrss.website
rer.njaavfxcgk3.club
pool.supportxmr.com
europe.cryptonight-hub.miningpoolhub.com
emergency.kiss58.org
emergency.googel-dns.com
seed.testnet.bitcoin.sprovoost.nl
fox.weilders.com
acs.njaavfxcgk3.club
monerohash.com
w.3ei.xyz
jump.taucepan.com
fee.googel-dns.com
ccc.njaavfxcgk3.club
xmr.usa-138.com
seed.bitcoinstats.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
900		60.30.199.26	NAT
892		221.239.96.146	NAT
891		111.160.156.10	NAT
803		111.164.175.157	NAT
574		111.160.82.66	NAT
521		111.160.204.62	
494		60.30.197.110	NAT
467		60.28.104.130	NAT
415		60.28.252.2 	NAT;IDC
352		221.196.92.246	NAT
269		60.29.103.44	NAT
241		60.29.17.222	NAT
239		218.68.45.209	NAT
164		117.9.18.201	NAT
142		218.68.105.24	NAT
130		202.99.114.74	NAT
130		111.160.167.194	NAT
110		60.28.47.90	    NAT
78		60.28.253.182	NAT
69		218.69.133.62	NAT
68		61.181.131.66	NAT
43		61.240.24.130	NAT
37		60.24.90.72	    NAT
36		111.160.119.178	NAT
35		60.30.240.226	NAT
35		60.30.134.99	NAT
34		221.197.42.171	
28		125.35.210.209	NAT
27		60.28.102.2	    NAT
26		221.197.55.168	NAT
26		61.181.207.7	NAT
25		125.35.210.222	NAT
24		125.35.210.204	NAT
24		125.35.210.229	NAT
19		125.39.71.19	
19		61.181.76.146	NAT
18		60.25.251.11	NAT
18		111.33.30.44	NAT
17		117.14.201.183	NAT
17		60.30.69.36	    NAT
16		221.197.139.246	NAT
16		60.28.101.104	NAT
16		60.28.108.201	NAT
15		218.69.96.14	NAT
15		60.30.193.162	NAT
15		222.36.63.83	
15		60.30.208.226	NAT
15		111.160.40.106	NAT
14		61.136.11.38	NAT
14		60.28.156.216	
14		60.28.101.74	NAT
14		60.29.158.82	NAT
14		111.160.122.98	NAT
14		218.69.11.174	NAT
13		60.28.101.105	NAT
13		117.9.164.4	    NAT
12		117.15.169.6	
12		61.181.70.210	NAT
11		180.213.5.10	NAT
10		111.164.49.39	NAT
10		218.68.5.141	NAT
10		60.29.15.54	    NAT
10		218.68.0.210	NAT
10		111.164.183.26	NAT
10		60.30.186.26	NAT
10		125.39.151.188	
9		221.239.124.90	NAT
9		117.131.173.16	NAT
8		123.150.44.5	NAT
8		111.160.97.18	NAT
8		221.238.238.234	NAT
8		117.9.8.157	    NAT
8		61.181.123.67	
8		125.35.211.131	NAT
8		123.150.44.3	NAT
7		60.29.133.19	NAT
6		111.160.80.250	NAT
6		111.160.7.62	NAT
6		125.36.59.125	NAT
6		123.150.44.11	NAT
6		218.68.204.18	NAT
6		218.69.11.58	NAT
5		60.29.64.138	NAT
5		123.151.25.136	NAT
5		125.37.77.156	NAT
5		111.164.183.91	NAT
5		111.162.128.53	NAT
5		117.11.10.12	NAT
5		117.13.140.93	NAT
5		60.30.149.98	NAT
4		221.196.67.188	NAT
4		60.25.179.9	    NAT
4		60.30.120.132	NAT
4		218.68.102.37	NAT
4		218.69.61.140	NAT
4		218.68.147.61	NAT
4		60.28.84.197	NAT
4		111.160.240.109	NAT
4		60.29.64.139	NAT
4		218.68.1.195	NAT
3		60.28.101.14	NAT
3		111.160.166.189	NAT
3		61.181.97.162	NAT
3		61.181.112.102	NAT
3		60.28.101.103	NAT
3		117.9.18.204	NAT
3		117.10.138.188	NAT
3		218.68.235.209	NAT
3		218.69.156.59	NAT
3		117.131.135.209	NAT
2		60.29.195.26	NAT
2		221.197.97.97	
2		60.26.78.4	
2		218.67.246.54	NAT
2		111.160.166.58	NAT
2		61.181.103.46	NAT
2		60.27.79.17	    NAT
2		60.30.172.82	NAT
2		60.29.153.61	NAT
2		60.28.63.85	    NAT
2		60.29.158.138	NAT
2		60.30.42.78	    NAT
2		111.163.122.136	NAT
2		111.30.78.46	NAT
2		60.30.33.70	
2		221.197.220.35	NAT
2		60.28.41.18	    NAT
2		111.30.101.238	NAT
2		60.29.153.45	NAT
2		60.29.179.118	NAT
2		117.9.199.42	NAT
2		123.150.44.9	NAT
2		60.28.104.118	NAT
2		111.160.70.46	NAT
2		61.181.107.107	NAT
1		111.162.215.164	NAT
1		111.162.68.202	NAT
1		103.233.4.30	NAT
1		218.69.25.110	NAT
1		60.29.153.43	NAT
1		221.196.108.202	NAT
1		60.30.149.10	NAT
1		117.131.245.101	NAT
1		111.33.17.70	NAT
1		61.181.5.114	NAT
1		117.13.72.198	NAT
1		60.30.177.62	NAT
1		211.94.248.30	NAT
1		125.38.179.109	NAT
1		221.196.108.163	NAT
1		218.68.159.45	NAT
1		60.29.4.206	    NAT
1		111.160.49.188	NAT
1		111.160.49.186	
1		117.11.117.118	NAT
1		111.162.201.182	NAT
1		218.68.105.125	NAT
1		111.162.219.115	NAT
1		218.68.204.86	NAT
1		60.30.155.10	NAT
1		221.239.89.186	NAT
1		111.164.40.153	NAT
1		60.29.154.210	NAT
1		61.181.15.212	NAT
1		111.163.141.224	NAT
1		60.28.114.2	    NAT
1		60.29.77.202	NAT
1		221.239.26.30	NAT
1		111.160.242.66	NAT
1		60.30.162.14	
1		103.233.4.29	NAT
1		111.166.50.41	NAT
1		111.166.87.206	NAT
</code></pre>
</br>
<h4 id="malwarewannacry">Malware.wannacry</h4>
<p>一种“蠕虫式”的勒索病毒软件，由不法分子利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播。被该勒索软件入侵后，用户主机系统内的照片、图片、文档、音频、视频等几乎所有类型的文件都将被加密，加密文件的后缀名被统一修改为 WNCRY。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
104		60.30.147.86	
8		125.35.211.131	NAT
3		111.164.183.91	NAT
2		221.238.232.218	NAT
2		111.160.40.106	NAT
1		60.29.64.22	    NAT
1		61.181.70.210	NAT
</code></pre>
</br>
<h4 id="malwaresality">Malware.sality</h4>
<p>一款多态感染性病毒，一旦被他们感染，电脑上大部分文件都会被感染成病毒文件。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>vancityprinters.com
724hizmetgrup.com
vinasonthanh.com
affiliate.free.rongrean.com
amsamex.com
zanzoul.aya.com.sy
bbeakemegood24.com
chicostara.com
www.ceylanogullari.com
family-international.de
yavuztuncil.ya.funpic.de
pelcpawel.fm.interia.pl
www.liongrup.com
bazyar-arya.com
aocuoikhanhlinh.vn
ohne-steuer.de
cevatpasa.com
jrsx.jre.net.cn
reliancepublications.co.in
bem.dk
arthur.niria.biz
lpbmx.ru
banboon.com
ankara-cambalkon.net
dewpoint-eg.com
twilight-duo.com
www.bluecubecreatives.com
apple-pie.in
ahmediye.net
abpowqbvcfds677.info
www.unigas.mn
www.vancityprinters.com
kuplu.bel.tr
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
108		111.160.182.10	NAT
20		117.9.152.25	NAT
13		60.27.193.240	NAT
12		125.36.117.141	NAT
8		60.29.43.82	    NAT
7		218.68.102.172	NAT
6		218.69.108.45	NAT
6		60.28.250.46	IDC
6		60.25.253.157	NAT
4		219.150.87.130	NAT
4		111.160.92.74	NAT
4		221.197.156.59	NAT
4		221.239.124.90	NAT
3		117.9.228.28	NAT
3		218.69.11.58	NAT
3		117.12.17.73	NAT
3		123.151.34.82	NAT
2		61.181.63.26	NAT
2		111.167.244.137	NAT
2		117.11.239.126	NAT
2		60.28.101.104	NAT
2		60.30.69.36	    NAT
1		117.12.197.138	NAT
1		218.68.6.194	NAT
1		117.15.191.13	NAT
1		61.181.63.138	NAT
1		111.163.145.187	NAT
1		111.33.56.2	NAT
</code></pre>
</br>
<h4 id="malwaredofloo">Malware.dofloo</h4>
<p>dofloo又名AES.DDOS，针对Linux设备，已经发现的变种主要感染运行x86和ARM CPU的设备。dofloo 支持SYN/TCP/UDP/DNS/HTTP等多种flood攻击。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>www.santananb.info
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1		60.30.172.82	NAT
</code></pre>
</br>
<h4 id="malwareartemis">Malware.artemis</h4>
<p>artemis家族针对windows系统，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>lang12397007.3322.org
scrk.3322.org
rat2.100geili.com
liyongyong88.3322.org
fei9988.3322.org
doss456.3322.org
meihaoddos.3322.org
dingtao333.3322.org
rat3.100geili.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
51		117.9.146.131	NAT
45		117.11.147.243	NAT
44		111.160.156.10	NAT
41		117.9.64.214	NAT
40		111.163.123.186	NAT
35		125.36.119.78	NAT
18		117.10.53.124	NAT
15		125.37.188.225	NAT
15		117.13.192.248	NAT
15		218.67.254.131	NAT
12		218.68.190.107	NAT
11		117.15.6.163	NAT
11		125.36.80.149	NAT
10		218.67.145.251	NAT
9		60.28.101.104	NAT
8		117.9.158.203	NAT
8		111.160.132.158	NAT
7		111.163.22.135	NAT
6		111.161.188.102	NAT
5		221.196.205.193	NAT
4		60.26.102.238	NAT
4		125.37.189.211	NAT
4		218.69.102.106	NAT
4		60.28.101.103	NAT
4		111.167.180.105	NAT
3		218.67.165.2	NAT
3		125.38.137.250	NAT
2		221.198.67.125	NAT
2		60.28.101.105	NAT
2		221.196.61.39	NAT
1		60.29.38.118	NAT
1		221.197.255.115	NAT
1		111.163.90.226	NAT
1		117.9.238.225	NAT
1		218.68.45.180	NAT
1		221.197.8.155	
</code></pre>
</br>
<h4 id="malwareunknown">Malware.unknown</h4>
<p>一部分我们正在跟踪的明确恶意但未归类的汇总</p>
<h5 id="iocs">IOCs</h5>
<pre><code>pccp.youdns17.com
lp.beahh.com
v.beahh.com
ii.ackng.com
healthdevicetracker.com
lp.haqo.net
suoye1.eatuo.com
oxy.imbceon.com
cake.pilutce.com
wqerveybrstyhcerveantbe.com
workforce.ignorelist.com
ghoost-souf.no-ip.org
down.wmwky.tw
www.santananb.info
doc.to0ls.com
jltx131.cc
booomaahuuoooapl.ru
hewle.kielsoservice.net
wys810302.f3322.net
www3.cedesunjerinkas.com
2.dfdf332.com
mdzz2019.noip.cn
spring.tulipnetworks.net
aj1732.online
ii.haqo.net
suoye1.f3322.net
nevernews.club
www2.cedesunjerinkas.com
lp.abbny.com
booomaahuuoooapl.in
yzzweb.f3322.net
almasoodgroup.com
maeobnaoefhgoajo.com
fiaoiaegiieogjjed.ru
5123.2288.org
api.dfdf332.com
3600hk.no-ip.org
i.haqo.net
eu.dspmulti.com
fget-career.com
www4.cedesunjerinkas.com
johnhop77.ddns.net
aroundtheworld123.net
twangzhan.website
srgsiuhedufiusfo.ru
iim.ackng.com
uaeihefiuaefhuhe.ru
9.zxzx776.com
xsdf3f.com
w.beahh.com
download.pofenglun.cn
mage.ignorelist.com
pall.ndypkh.com
down.qwpkk.tw
aeiziaezieidiebg.biz
zergbase.mooo.com
cnc.stresser.pw
aaaaaaaaaa.re67das.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
1137	60.28.104.130	NAT
1020	60.30.186.26	NAT
988		117.12.96.213	NAT
718		218.68.105.24	NAT
596		60.28.47.90	    NAT
352		61.240.6.210	NAT
310		121.193.161.217	NAT
261		111.160.132.158	NAT
238		61.181.252.146	NAT
221		221.197.56.106	NAT
176		60.30.199.26	NAT
145		111.160.201.202	
133		60.29.153.61	NAT
86		60.30.149.10	NAT
79		125.36.152.117	NAT
77		117.12.134.159	NAT
55		218.69.234.252	NAT
39		221.197.29.110	NAT
38		218.67.233.191	NAT
37		117.11.225.137	NAT
36		111.165.96.157	NAT
34		61.181.108.2	NAT
33		111.162.219.197	NAT
32		60.28.156.216	
32		117.12.1.165	NAT
31		117.8.100.206	NAT
31		111.164.235.52	NAT
31		218.67.255.90	NAT
31		117.9.17.157	NAT
30		125.38.176.114	NAT
30		218.68.200.50	NAT
30		60.29.18.14	    NAT
30		117.131.173.16	NAT
30		221.197.12.90	NAT
29		218.68.190.43	NAT
29		180.213.5.10	NAT
27		60.29.37.38	    NAT
25		221.196.119.133	NAT
25		111.160.91.94	NAT
25		117.9.91.224	NAT
24		60.28.38.14	    NAT
24		111.164.235.232	NAT
23		60.30.130.126	NAT
20		111.30.30.18	NAT
20		221.197.94.180	NAT
19		60.29.64.22 	NAT
19		111.165.24.101	NAT
18		117.13.128.209	
18		125.37.182.24	NAT
17		117.11.147.153	NAT
16		60.28.101.104	NAT
16		111.164.20.30	NAT
15		60.30.4.11	
15		218.69.11.58	NAT
14		60.28.101.103	NAT
14		117.9.16.229	NAT
14		218.69.133.37	NAT
14		221.239.93.251	
13		60.29.133.19	NAT
13		60.29.208.115	
13		60.28.250.40	IDC
13		60.29.22.98	    NAT
12		60.28.108.21	NAT
12		117.9.18.246	NAT
12		218.69.90.46	NAT
12		60.25.11.13	    NAT
11		111.160.156.10	NAT
11		221.196.149.170	NAT
10		60.29.89.34	    NAT
10		60.29.70.132	
10		218.68.224.88	NAT
10		117.13.157.191	NAT
10		60.29.31.98	    NAT
10		60.24.140.80	NAT
10		221.238.238.234	NAT
10		60.29.90.230	NAT
9		60.30.164.26	NAT
9		60.25.251.11	NAT
9		218.68.158.40	NAT
9		60.26.101.13	NAT
8		111.160.87.122	NAT
8		218.68.107.240	NAT
8		218.68.233.132	NAT
8		111.164.183.91	NAT
8		221.197.139.99	NAT
8		221.197.122.193	NAT
7		60.30.105.50	NAT
7		117.9.93.13	    NAT
7		117.11.218.223	NAT
7		61.181.143.34	NAT
7		60.28.41.18	    NAT
7		60.24.189.172	NAT
7		218.68.5.141	NAT
7		221.196.108.115	NAT
7		61.181.70.210	NAT
7		111.30.35.142	NAT
6		60.28.101.105	NAT
6		221.198.66.44	NAT
6		111.162.212.244	NAT
6		111.160.233.182	NAT
6		60.24.143.117	NAT
6		117.9.90.145	NAT
6		103.233.5.254	NAT
6		218.69.129.222	NAT
6		221.196.180.62	NAT
6		125.38.176.178	NAT
6		60.26.225.158	NAT
6		60.27.31.62	    NAT
6		218.68.234.159	NAT
6		117.11.153.212	NAT
5		60.30.208.226	NAT
5		125.36.153.16	NAT
5		111.162.149.78	NAT
5		111.163.158.181	NAT
5		218.69.226.106	NAT
5		60.27.79.149	NAT
5		221.198.170.164	NAT
5		211.94.243.185	NAT
5		117.9.18.2	    NAT
5		106.47.29.70	NAT
5		125.37.29.120	NAT
5		60.29.145.254	NAT
5		218.68.0.6	    NAT
5		117.10.62.226	NAT
5		117.12.202.189	NAT
5		111.160.246.140	NAT
5		61.181.74.42	NAT
5		218.69.55.166	NAT
5		218.69.54.167	NAT
5		218.68.6.50	    NAT
5		117.13.115.123	NAT
4		211.94.254.85	NAT
4		60.24.90.226	NAT
4		60.26.4.19	    NAT
4		60.28.101.106	NAT
4		221.198.238.209	NAT
4		111.166.237.230	NAT
4		125.36.255.122	NAT
4		218.68.105.7	NAT
4		117.9.237.225	NAT
4		61.181.103.138	NAT
4		218.68.229.81	NAT
4		61.181.140.42	NAT
4		218.69.6.74	    NAT
4		111.160.120.54	NAT
4		60.29.93.221	NAT
4		218.69.91.84	
4		125.37.29.23	NAT
4		60.24.184.70	NAT
4		221.196.46.61	NAT
4		117.14.119.35	NAT
4		60.26.203.160	NAT
4		111.163.123.7	NAT
4		111.161.158.131	NAT
4		111.33.17.70	NAT
4		111.160.230.18	NAT
4		60.27.31.0	    NAT
4		117.12.37.223	NAT
4		117.15.93.189	NAT
4		117.10.124.4	NAT
4		60.24.233.164	NAT
4		60.28.84.197	NAT
4		218.68.200.243	NAT
4		218.68.219.29	NAT
4		221.198.86.145	NAT
4		218.69.18.147	NAT
4		111.164.233.130	NAT
4		111.163.143.228	NAT
4		60.25.148.35	NAT
4		117.15.125.181	NAT
4		218.67.234.60	NAT
4		125.38.176.229	NAT
4		60.30.92.74	    NAT
4		117.11.10.12	NAT
4		111.160.91.250	NAT
3		60.24.45.218	NAT
3		60.29.154.226	NAT
3		111.163.144.224	NAT
3		111.161.150.34	NAT
3		111.160.166.58	NAT
3		111.162.163.231	NAT
3		125.37.182.99	NAT
3		60.29.16.94	    NAT
3		111.163.120.92	NAT
3		221.198.67.88	NAT
3		117.15.192.231	NAT
3		117.10.138.46	NAT
3		218.69.95.90	NAT
3		60.27.60.159	NAT
3		117.13.168.162	NAT
3		117.13.106.191	NAT
3		60.29.15.2	    NAT
3		111.165.11.60	NAT
3		60.30.193.162	NAT
3		60.29.43.46	    NAT
3		117.12.146.72	NAT
3		43.249.136.20	NAT
3		111.165.188.122	NAT
3		221.196.152.151	NAT
3		111.163.144.67	NAT
3		60.26.142.193	NAT
3		60.29.63.18	    NAT
3		111.160.80.3	NAT
3		117.13.140.5	NAT
3		117.10.236.245	NAT
3		211.94.243.121	NAT
3		111.165.105.247	NAT
3		61.181.219.120	NAT
3		123.151.34.82	NAT
3		111.166.238.248	NAT
3		202.99.106.47	NAT
3		221.197.179.98	NAT
3		211.94.226.74	NAT
3		60.26.239.60	NAT
3		117.9.191.22	NAT
3		117.14.66.156	NAT
3		61.181.202.5	
3		218.69.78.253	NAT
3		218.69.52.252	NAT
3		221.196.97.11	NAT
3		218.67.181.124	NAT
2		221.196.194.253	NAT
2		218.68.102.247	NAT
2		111.165.128.30	NAT
2		60.26.132.173	NAT
2		125.35.249.1	NAT
2		221.197.139.235	NAT
2		117.15.22.130	NAT
2		60.29.179.114	NAT
2		221.198.80.189	
2		111.162.216.127	NAT
2		221.197.54.42	NAT
2		221.197.97.39	NAT
2		117.13.244.21	NAT
2		111.160.198.83	NAT
2		103.233.6.2	
2		60.27.189.44	NAT
2		111.160.166.189	NAT
2		125.36.59.125	NAT
2		211.94.248.28	NAT
2		218.69.55.247	NAT
2		111.160.166.206	NAT
2		125.36.101.224	NAT
2		111.165.56.53	NAT
2		61.181.65.154	NAT
2		61.181.109.234	NAT
2		117.9.199.42	NAT
2		221.197.133.137	NAT
2		218.68.102.58	NAT
2		125.37.217.118	NAT
2		221.196.97.36	NAT
2		61.181.103.46	NAT
2		60.27.119.49	
2		117.12.133.191	NAT
2		221.198.64.35	NAT
2		125.37.191.155	NAT
2		221.198.60.201	NAT
2		111.162.147.134	NAT
2		60.25.179.50	NAT
2		61.181.63.138	NAT
2		60.24.127.98	NAT
2		61.181.24.234	NAT
2		125.37.212.67	NAT
2		111.167.149.238	NAT
2		221.197.154.147	NAT
2		117.10.28.225	NAT
2		60.30.149.102	NAT
2		60.30.105.33	NAT
2		111.160.97.18	NAT
2		125.37.202.10	NAT
2		117.9.18.201	NAT
2		117.14.151.96	NAT
2		60.30.156.190	NAT
2		111.167.17.208	NAT
2		117.15.90.239	NAT
2		111.162.151.214	NAT
2		111.162.154.253	NAT
2		61.181.49.105	NAT
2		218.68.224.39	NAT
2		60.27.138.17	NAT
2		117.9.70.23	    NAT
2		221.196.180.242	NAT
2		117.12.125.160	NAT
2		111.162.157.177	
2		218.68.107.108	NAT
2		218.69.129.94	NAT
2		111.167.46.70	NAT
2		117.15.90.205	NAT
2		103.233.4.26	NAT
1		60.24.89.15	    NAT
1		218.69.55.60	NAT
1		117.11.239.56	NAT
1		111.163.140.152	NAT
1		111.160.108.34	NAT
1		60.29.140.66	NAT
1		202.99.69.243	
1		221.196.194.2	NAT
1		60.27.42.62	    NAT
1		60.24.188.12	NAT
1		117.8.101.63	NAT
1		218.69.147.133	NAT
1		111.163.22.227	NAT
1		111.160.118.230	NAT
1		111.167.144.199	NAT
1		60.29.154.210	NAT
1		221.196.227.20	NAT
1		60.28.38.18	    NAT
1		60.29.77.203	NAT
1		60.29.153.45	NAT
1		125.38.191.184	NAT
1		221.198.236.232	NAT
1		60.25.10.147	NAT
1		111.164.209.21	NAT
1		218.67.254.17	NAT
1		60.30.180.150	NAT
1		111.160.70.203	NAT
1		111.160.70.201	NAT
1		60.29.116.18	NAT
1		60.30.215.242	NAT
1		111.162.152.192	NAT
1		60.29.95.82	    NAT
1		111.160.166.186	NAT
1		117.9.229.148	NAT
1		61.181.60.34	NAT
1		221.198.118.158	NAT
1		60.28.135.3	    NAT
1		60.25.63.52	    NAT
1		111.160.97.42	NAT
1		117.12.144.7	NAT
1		111.162.221.168	NAT
1		221.198.110.209	NAT
1		61.181.83.10	NAT
1		221.197.84.199	NAT
1		60.29.179.42	NAT
1		60.29.77.194	NAT
1		60.27.174.82	NAT
1		111.166.156.237	NAT
1		60.29.30.190	NAT
1		117.12.133.124	NAT
1		117.13.140.144	NAT
1		218.69.243.164	NAT
1		218.69.11.110	NAT
1		111.165.133.156	NAT
1		111.162.163.241	NAT
1		221.197.252.248	NAT
1		60.28.250.46	IDC
1		60.27.133.165	NAT
1		111.167.211.108	NAT
1		111.160.70.204	NAT
1		60.30.240.226	NAT
1		221.197.29.195	NAT
1		125.36.145.207	NAT
1		60.27.79.17	    NAT
1		125.37.125.3	NAT
1		60.30.172.82	NAT
1		117.131.145.156	NAT
1		111.30.85.18	NAT
1		221.198.218.112	NAT
1		117.14.13.25	NAT
1		117.14.70.156	NAT
1		111.163.143.193	NAT
1		111.160.216.87	NAT
1		60.28.101.126	NAT
1		60.29.185.242	NAT
1		111.163.78.80	NAT
1		125.37.182.185	NAT
1		117.15.191.57	NAT
1		111.160.104.66	NAT
1		221.197.162.54	NAT
1		211.94.242.118	NAT
1		125.37.162.103	NAT
1		117.8.100.70	NAT
1		117.15.214.65	NAT
1		125.38.177.138	NAT
1		60.30.204.26	NAT
1		60.27.205.187	NAT
1		117.12.158.82	NAT
1		60.26.180.205	NAT
1		111.165.72.25	NAT
1		61.181.125.37	NAT
1		60.29.0.101	    NAT
1		60.25.16.184	NAT
1		111.30.78.46	NAT
1		111.160.40.106	NAT
1		117.15.138.221	NAT
1		111.161.189.215	NAT
1		111.160.80.250	NAT
1		103.233.4.29	NAT
1		221.239.72.170	NAT
</code></pre>
</br>
<h4 id="malwarebondat">Malware.bondat</h4>
<p>利用受害机器资源 进行门罗币挖矿，并组建一个攻击WordPress站点的僵尸网络。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>urchintelemetry.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
8		117.9.92.217	NAT
2		60.30.105.33	NAT
2		61.181.88.218	NAT
</code></pre>
</br>
<h4 id="malwarestorm">Malware.storm</h4>
<p>针对Windows平台的DDoS类型的botnet家族。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>www.mojimojimojimoji.com
www.ody.cc
imddos.my03.com
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
432		125.36.152.117	NAT
425		111.160.156.10	NAT
315		61.181.252.146	NAT
34		111.160.182.10	NAT
19		111.160.132.158	NAT
11		218.68.105.191	NAT
10		117.15.53.253	NAT
8		218.68.228.63	NAT
8		60.27.104.153	NAT
7		117.13.140.144	NAT
5		61.181.125.37	NAT
5		60.28.101.104	NAT
4		221.198.64.35	NAT
3		111.163.12.68	NAT
2		117.11.239.138	NAT
2		111.164.47.25	
2		125.37.162.103	NAT
2		117.9.90.137	NAT
1		111.162.102.7	NAT
1		60.24.244.41	NAT
1		61.240.5.226	NAT
1		111.162.12.44	NAT
</code></pre>
</br>
<h4 id="malwaremorto">Malware.Morto</h4>
<p>一款蠕虫病毒，通过爆破内网、外网主机的RDP密码，登陆到受害主机，进行自我复制并运行，来实现病毒的传播。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>ms.jifr.net
ms.jifr.co.cc
ms.jifr.co.be
dos1.jifr.net
ms.jifr.info
flt1.jifr.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
506		218.69.16.26	NAT
241		60.29.174.70	NAT
219		60.29.173.226	NAT
194		60.24.189.11	NAT
162		60.30.57.29	    NAT
106		111.164.41.211	NAT
75		117.131.175.138	NAT
69		111.160.186.146	NAT
45		218.68.156.51	NAT
27		125.36.228.182	NAT
20		125.36.228.187	NAT
16		125.36.228.184	NAT
</code></pre>
</br>
<h4 id="malwaremylobot">Malware.Mylobot</h4>
<p>mylobot是针对Windows的malware，属于downloader类型，用于在感染机器上下载和安装其它的malware。</p>
<h5 id="iocs">IOCs</h5>
<pre><code>m16.pseyumd.ru
m11.pseyumd.ru
m25.oxduwil.com
m20.oxduwil.com
m0.fnjxpwy.com
m32.oqemwbj.in
v2.otwzgnl.ru
m0.zqfqjwd.biz
m34.oxduwil.com
m34.oqemwbj.in
m28.oqemwbj.in
m16.oqemwbj.in
v2.baidupic.net
</code></pre>
<h5 id="clients">Clients</h5>
<pre><code>Count   Client          TAGS
12		60.28.101.104	NAT
4		60.28.101.103	NAT
2		60.25.16.92	    NAT
1		117.11.239.72	NAT
1		60.28.101.105	NAT
</code></pre>
</br>
<h3 id="">未知恶意</h3>
<p>基于360安全大脑的云端数据，我们DNSMon系统会实时监测各种未知的恶意和高度可疑的域名，包括各种未知APT和Botnet等等，这些被归为 DNSMon.gray 以及 DNSMon.black 类别。</p>
<p>由于客户端数据太大，且具体的恶意行为需要其他维度数据关联分析，在此暂时不展开。</p>
<!--kg-card-end: markdown-->
天津DNS数据安全分析报告







版本：tj-sec.01


时间：2019-06-17


作者：360网络安全研究院 & 360CERT






摘要


 * 采集了 2019-06-09 日 10 点数据，共计 33650792 条DNS日志
 * 排除掉DNS解析服务器日志，共计 19190292 条客户端请求DNS日志
 * 其中黑域名请求共计 99095 条，占总请求的 0.516%
 * 去重后域名共计 725093 个，其中黑域名共计 4424 个，占比 0.61%
 * 恶意类型覆盖 6 个APT组织的活动，以及40个僵尸网络/远控/后门/木马等恶意软件家族




整体分布


字段说明：


 * TAG 是我们为恶意域名归类的标记，比如“APT.turla”表明是APT组织turla，“Malware.driverlife”表明是恶意软件家族“驱动人生”等等
 * DNS_Records_Count 是对应类别恶意域名在所有DNS请求中的请求数
 * Unique_Clients 是对应类别恶意域名的去重客户端个数
 * Unique_Domains 是对应恶意类别中在数据中出现过的去重恶意域名数
 * Infos 针对某些类别的额外解释说明








TAG
DNS_Records_Count
Unique_Clients
Unique_Domains
Infos




DNSMon.gray
22331
2629
926
DNSMon自动发现的高度可疑恶意域名


Malware.miner
11898
193
62
所有的挖矿恶意软件都归为该类，不再细分


Malware.driverlife
10397
86
22



BlackHit.vt
9779
257
84



Malware.unknown
9587
410
58
正在持续跟踪的一批暂未归类恶意软件


Malware.mykings
5613
45
13



DNSMon.black
3734
178
48
DNSMon自动发现的确定恶意域名


APT.turla
3620
2
15



Malware.Morto
3397
14
6



DGA.conficker
2760
41
224



Malware.xorddos
2415
9
14



Malware.nitol
2248
20
11



Malware.2gun
2049
349
26



Malware.ramnit
1985
246
7



Malware.nadrac
1416
16
5



Malware.mirai
1404
4
4



Malware.elknot
1325
5
3



Malware.storm
1301
23
3



Malware.gh0st
1066
17
11



Malware.zombieboy
472
3
2



Malware.artemis
445
37
9



WebSafe.coinhive
299
1
1



Malware.zusy
298
1
286



Malware.darkshell
297
3
1



Malware.sality
246
30
33



Malware.wannycry
221
5
2



Malware.NuggetPhantom
174
26
6



Malware.remcos
150
1
1



Malware.wannacry
122
8
2



Malware.DUNIHi
107
1
1



APT.irontiger
98
1
2



BlackHit.nd
79
19
3



APT.unclassified
76
38
1



DGA.hardcoded_fake_dga
72
31
30



Malware.dbnt
44
18
2



Malware.dsl
32
1
1



Malware.Mylobot
20
5
13



WebSafe.ad_flush
16
14
3



Malware.bondat
12
3
1



Malware.posioncake
11
4
2



Malware.Dorkbot
9
1
4



APT.bitter
8
1
4



DGA.popad
8
6
3



APT.oceanlotus
7
1
4



Malware.barhera
6
2
3



Malware.irc3
4
1
2



APT.menupass
4
1
1



Malware.dy2004
2
1
1



Malware.loki
1
1
1



Malware.rcshark
1
1
1



Malware.humpler
1
1
1



Malware.flyboy
1
1
1



Malware.woring
1
1
1



Malware.dofloo
1
1
1









分类描述


由于恶意类型比较多且繁杂，分类描述中只汇总了 APT 类 和 Malware 类危害较大的类别。


"IOCs" 列出在数据中出现过的对应类别的恶意域名，“Clients”是数据中出现过的访问了恶意域名的客户端IP，按照访问次数从大到小排列，访问次数越多，可以认为是该IP后面对应的恶意软件越活跃。客户端IP有可能是机构/宽带出口IP，会标记类别 NAT，有可能是机房IP，会标记类别IDC。


有些访问可能是安全研究人员的测试性访问，这需要具体IP的归属来判断，通过当前数据不能区分，如果后续追溯，需要注意。



APT 类


当前一小时采样数据中，共发现6个公开的APT组织的活动迹象，共涉及失陷客户端XXX个，其中可能是政府单位的YYY个，需要高度关注。


APT.bitter


蔓灵花（T-APT-17、BITTER）APT组织是一个长期针对中国、巴基斯坦等国家进行攻击活动的APT组织，该APT组织为目前活跃的针对境内目标进行攻击的境外APT组织之一。该组织主要针对政府、军工业、电力、核等单位进行攻击，窃取敏感资料，具有强烈的政治背景。该组织最早在2016由美国安全公司Forcepoint进行了披露，并且命名为“BITTER”。


该组织主要采用鱼叉钓鱼的方式，对相关目标单位的个人直接发送嵌入了攻击诱饵的钓鱼邮件。此外，为了提高成功率，也会先对目标发送安全提示相关的钓鱼邮件，诱使被钓鱼用户修改邮件账户密码，从而获取用户的邮箱密码，而后再用被控制的邮箱继续对企业内的其他人进行嵌入攻击诱饵的钓鱼邮件。


详细报告参见 https://www.freebuf.com/articles/database/192726.html


IOCs


hewle.kielsoservice.net
spring.tulipnetworks.net
aroundtheworld123.net
thepandaservices.nsiagenthoster.net



Clients


Count   Client          TAGS
8	    60.29.208.115	





APT.irontiger


铁虎（Iron Tiger）APT行动背后的“熊猫使者”APT组织，被怀疑（必须）是天朝的一个黑客组织，他们专门以政府和相关领域的技术部门作为其主要的攻击目标，并尝试从这些组织和机构中监视和窃取高价值的数据。


该恶意软件的主要攻击目标是亚洲和美国的政府组织、科技公司、教育和通信企业等。最早的攻击是从附有恶意VBS文件的垃圾邮件开始的，VBS文件的作用是从分布式服务器下载恶意payload的下载器。


详细报告参见https://zhuanlan.zhihu.com/p/33636123


IOCs


dll.pzchao.com
zll855.gicp.net



Clients


Count   Client          TAGS
98	    60.28.230.130	NAT





APT.unclassified


详细报告参见 https://www.anquanke.com/post/id/167077，

http://www.mottoin.com/detail/3398.html


IOCs


ftp.byethost10.com



Clients


Count   Client          TAGS
10	    117.13.67.150	NAT
3	    218.69.72.38	NAT
2	    218.68.156.153	NAT
2	    218.68.62.28	NAT
2	    218.67.252.149	NAT
2	    218.69.6.74	    NAT
2	    117.13.3.103	NAT
1   	221.196.149.170	NAT
1   	60.24.88.214	NAT
1   	60.30.254.92	NAT
1   	125.37.184.21	NAT
1   	125.36.33.16	NAT
1   	111.165.222.113	NAT
1   	60.27.152.188	NAT
1   	221.197.154.8	NAT
1   	60.24.142.12	NAT
1   	60.26.72.241	NAT
1   	111.163.144.208	NAT
1   	111.33.50.98	NAT
1   	111.160.43.14	NAT
1   	117.15.191.151	NAT
1   	111.162.212.244	NAT
1   	117.11.117.145	NAT
1   	117.10.138.132	NAT
1   	60.27.193.224	NAT
1   	117.13.192.197	NAT
1   	117.14.147.119	NAT
1   	218.68.148.99	NAT
1   	125.36.107.131	NAT
1   	111.164.215.206	NAT
1   	211.94.237.146	NAT
1   	111.167.9.209	NAT
1   	117.15.190.49	NAT
1   	218.68.108.222	NAT





APT.menupass


详细报告参见 https://zhuanlan.zhihu.com/p/52960249


IOCs


cia.toh.info



Clients


Count   Client          TAGS
4	    117.14.156.22	NAT





APT.turla


90年代著名网络间谍组织“月光迷宫”（Moonlight Maze）已经演变成了今天的Turla APT，它们都具有或多或少相同的技术手段，且共同背景就是：与俄罗斯政府黑客相关。

以中国和美国等地的政府、军事、大使馆、研究和制药组职为入侵目标，之前也制作过Linux 木马。据说他们是受到俄罗斯政府支持。虽然他们会有行动，但执法机关一直没法知道他们所在何方，因为他们善于隐藏自己。


在网络入侵活动中，黑客一般会利用中转或跳板机作为攻击代理，防止溯源调查，而“月光迷宫”入侵者也是最早采用该技术的攻击者。他们利用很多国家的一系列大学、图书馆等存在系统漏洞的机构电脑作为中转跳板，存储攻击工具，发起网络攻击，以此迷惑调查行为。


详细报告参见 https://blog.csdn.net/DJY1992/article/details/88994695


IOCs


music-world.servemp3.com
forum.sytes.net
tiger.got-game.org
x-files.zapto.org
health-everyday.faqserv.com
fifa-rules.25u.com
weather-online.hopto.org
hockey-news.servehttp.com
olympik-blog.4dq.com
top-facts.sytes.net
supernews.sytes.net
cars-online.zapto.org
nhl-blog.servegame.com
marketplace.servehttp.com
newutils.3utilities.com



Clients


Count   Client          TAGS
3495	218.69.186.173	NAT
125	    218.69.133.129	NAT





APT.oceanlotus


海莲花（OceanLotus）也叫APT32或APT-C-00，是一个长期针对中国及其他东亚国家（地区）政府、科研机构、海运企业等领域进行攻击的APT组织。


海莲花的攻击途径为使用木马病毒攻陷、控制政府人员、外包商及行业专家等目标人群的计算机，从中窃取受害者计算机中的机密数据，截获受害计算机与外界传递的情报，甚至操纵该计算机自动发送相关情报。而这一攻击方式有“ 鱼叉攻击 ”和“ 水坑攻击 ”两种。


详细报告参见 https://zh.wikipedia.org/zh/%E6%B5%B7%E8%8E%B2%E8%8A%B1


IOCs


dominikmagoffin.com
check.homeip.net
cortana.homelinux.com
hk.cnnewspapers.com



Clients


Count   Client          TAGS
7	    60.29.208.115	







Malware 类


Malware.mykings


MyKings 是一个由多个子僵尸网络构成的多重僵尸网络，2017 年 4 月底以来，该僵尸网络一直积极地扫描互联网上 1433 及其他多个端口，并在渗透进入受害者主机后传播包括 DDoS、Proxy、RAT、Miner 在内的多种不同用途的恶意代码。


详细报告参见：https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/


IOCs


wmi.mykings.top
loop2.haqo.net
loop.haqo.net
p.abbny.com
lpp.beahh.com
o.beahh.com
lplp.beahh.com
js.f4321y.com
oo.beahh.com
pp.abbny.com
loop.abbny.com
down.f4321y.com
down.b591.com



Clients


Count   Client          TAGS
1670	60.28.104.130	NAT
1193	218.68.105.24	NAT
951		60.28.47.90	NAT
726		60.30.186.26	NAT
434		218.69.112.141	NAT
300		221.239.96.146	NAT
100		61.181.103.46	NAT
48		111.160.80.250	NAT
22		221.238.238.234	NAT
16		61.181.70.210	NAT
12		123.151.34.82	NAT
8		117.12.96.213	NAT
8		180.213.6.237	NAT
8		60.28.101.104	NAT
7		111.160.40.106	NAT
6		60.25.251.11	NAT
6		60.29.153.61	NAT
6		60.26.80.98	NAT
6		218.68.5.141	NAT
6		60.30.149.102	NAT
6		111.163.120.92	NAT
4		111.160.230.18	NAT
4		61.181.49.105	NAT
4		60.28.101.103	NAT
4		111.30.26.21	NAT
4		218.69.11.110	NAT
4		60.29.90.230	NAT
4		111.160.166.58	NAT
3		111.163.145.128	NAT
2		61.181.49.102	NAT
2		111.30.31.137	
2		111.165.4.199	NAT
2		61.181.60.34	NAT
2		61.181.49.104	NAT
2		218.68.6.50	NAT
2		60.28.101.106	NAT
1		117.11.14.62	NAT
1		60.24.90.130	NAT
1		111.163.45.102	NAT
1		111.160.56.130	NAT





Malware.driverlife


“驱动人生”旗下多款软件携带后门病毒DTStealer，仅半天时间感染了数万台电脑。该病毒进入电脑后，继续通过“永恒之蓝”高危漏洞进行全网传播（特别是政企单位局域网），并回传被感染电脑的IP地址、CPU型号等信息。


IOCs


lplp.haqo.net
v.beahh.com
p.awcna.com
p.zer2.com
lpp.ackng.com
p.amxny.com
oo.beahh.com
lpp.zer2.com
down.ackng.com
v.bddp.net
t.awcna.com
lplp.beahh.com
t.zer2.com
pp.abbny.com
lplp.abbny.com
lpp.awcna.com
oom.beahh.com
down.bddp.net
lpp.haqo.net
t.amxny.com
ppm.abbny.com
v.y6h.net



Clients


Count   Client          TAGS
1564		221.239.96.146	NAT
1486		218.69.112.141	NAT
1458		60.30.186.26	NAT
1324		60.28.104.130	NAT
956		218.68.105.24	NAT
786		60.28.47.90	NAT
408		61.181.65.154	NAT
326		61.181.103.46	NAT
188		111.160.80.250	NAT
168		111.164.183.26	NAT
156		111.164.175.157	NAT
156		221.238.238.234	NAT
134		111.160.167.194	NAT
78		60.28.101.104	NAT
74		111.160.231.178	NAT
72		111.164.183.91	NAT
61		218.68.5.141	NAT
55		61.181.70.210	NAT
52		60.28.101.103	NAT
50		60.25.251.11	NAT
49		60.28.101.105	NAT
46		218.68.102.37	NAT
42		221.197.55.168	NAT
36		111.160.97.18	NAT
36		60.28.108.201	NAT
24		60.26.80.98	NAT
24		123.150.44.3	NAT
24		125.36.59.125	NAT
20		60.28.41.18	NAT
18		61.181.60.34	NAT
16		111.160.166.58	NAT
16		60.29.153.61	NAT
14		221.196.67.188	NAT
14		60.29.153.45	NAT
12		123.151.34.82	NAT
12		60.28.108.21	NAT
12		123.150.44.11	NAT
10		60.28.101.74	NAT
10		218.68.0.210	NAT
10		111.160.70.46	NAT
8		123.150.44.5	NAT
8		117.12.96.213	NAT
8		180.213.6.237	NAT
8		60.28.101.106	NAT
8		111.165.4.199	NAT
8		61.181.252.146	NAT
8		221.197.66.60	NAT
8		60.29.145.254	NAT
6		61.181.49.105	NAT
6		111.30.78.46	NAT
6		111.160.172.18	NAT
6		111.30.101.238	NAT
6		218.69.11.174	NAT
6		117.9.199.42	NAT
6		111.163.120.92	NAT
4		111.160.212.19	NAT
4		218.69.11.110	NAT
4		111.160.230.18	NAT
4		60.29.90.230	NAT
4		60.29.241.4	NAT;IDC
4		125.35.214.114	NAT
4		111.30.35.142	NAT
4		111.160.40.106	NAT
4		60.30.149.102	NAT
2		111.30.31.137	
2		123.150.44.9	NAT
2		218.69.129.94	NAT
2		60.29.241.1	NAT;IDC
2		60.28.101.102	NAT
2		117.9.18.201	NAT
2		61.181.49.102	NAT
2		61.181.49.104	NAT
2		60.27.119.49	
2		218.68.6.50	NAT
2		60.29.158.138	NAT
2		123.151.196.187	NAT
2		117.9.121.135	NAT





Malware.dbnt


一款用于网吧客户机系统维护的软件，同时也是一个win恶意软件下载器，可以下载各种恶意软件，用于流量劫持等恶意行为。


IOCs


wj.center.oldlist.info
ecount.2019cn.com



Clients


Count   Client          TAGS
6		61.181.61.82	NAT
6		60.28.130.170	NAT
6		60.30.67.234	NAT
4		60.28.38.18	NAT
3		60.30.111.99	NAT
3		111.160.91.94	NAT
2		125.37.20.209	NAT
2		117.8.246.134	NAT
2		117.13.157.191	NAT
2		111.164.179.188	NAT
1		60.25.31.73	NAT
1		111.164.20.60	NAT
1		60.26.240.155	NAT
1		111.162.55.162	NAT
1		111.164.175.4	NAT
1		125.37.20.206	NAT
1		61.181.111.18	NAT
1		221.197.54.42	NAT





Malware.irc


基于IRC协议的家族统称，包括Windows和Linux两种平台。基于IRC的典型家族有dstd和tsunami，但并非使用了IRC就一定是恶意的。 irc允许私有扩展，所以上线包会有不同的字段和换行格式，我们这里初步的细分为irc1/2/3.


IOCs


n.ezjhyxxbf.ru
n.vbemnggcj.ru



Clients


Count   Client          TAGS
4		111.161.200.159	NAT





Malware.remcos


通过钓鱼邮件传播的远控，可在被感染的系统执行键盘记录，远程截屏，文件管理，命令执行等多个功能。


IOCs


maxeuro.ddns.net



Clients


Count   Client          TAGS
150		111.163.141.154	NAT





Malware.xorddos


该家族针对Linux设备，用于DDoS攻击。因为样本内的配置信息和C2通信均使用了一个自定义的XOR加密算法，故得名XOR.DDOS。该家族支持syn/dns/tcp等flood攻击。


IOCs


aaa.xxxatat456.com
p6.2018fly.com
p11.2018fly.com
a381422.f3322.net
www1.gggatat456.com
aaa.gggatat456.com
ppp.xxxatat456.com
aaaaaaaaaa.re67das.com
gh.dsaj2a1.org
k1.2018fly.com
b12.xxxatat456.com
ppp.gggatat456.com
p12.2018fly.com
b12.gggatat456.com



Clients


Count   Client          TAGS
577		60.29.208.112	
461		125.39.151.184	
452		125.39.71.19	
211		124.68.10.20	
145		111.160.201.202	
144		60.28.54.30	NAT
116		61.181.59.88	
2		60.29.141.95	





Malware.NuggetPhantom


模块化恶意工具集“NuggetPhantom（掘金幽灵）”最早出现于2016年底，其曾在2016年底的“天翼校园客户端蓝屏事件”以及2017年底的“天翼校园客户端挖矿程序事件”中有所行动。攻击者获知用户计算机存在EternalBlue漏洞后，利用该漏洞向用户计算机发送Eternal_Blue_Payload载荷，该载荷及其所释放的各模块皆通过访问下载服务器来获取加密后的各用途模块文件，并在内存中动态解密这些模块代码，执行模块对应的恶意功能。


IOCs


new.szyfpga.com
deg.szyfpg.com
buy.szyfpg.com
cpu.szyfpg.com
new.szyfpg.com
deg.szyfpga.com



Clients


Count   Client          TAGS
57		60.29.64.22	NAT
18		60.24.251.190	NAT
15		117.11.121.200	NAT
15		111.162.220.212	NAT
12		111.162.217.67	NAT
8		117.11.144.69	NAT
8		111.162.216.179	NAT
7		60.29.148.146	NAT
5		218.67.167.157	NAT
5		218.68.24.157	NAT
4		117.15.28.197	NAT
3		211.94.237.161	NAT
3		60.24.248.46	NAT
2		117.12.37.38	NAT
1		60.24.34.84	NAT
1		60.27.137.164	NAT
1		111.162.219.177	NAT
1		111.160.119.194	NAT
1		60.27.152.186	NAT
1		218.67.199.206	NAT
1		60.26.234.195	NAT
1		218.67.233.167	NAT
1		218.67.186.15	NAT
1		218.69.42.199	NAT
1		60.27.191.194	NAT
1		218.69.156.136	NAT





Malware.2gun


涉及业务种类繁杂，除了传播双枪木马的恶意驱动程序，还传播游戏私服驱动，还会盗窃 Steam 账号、劫持 QQ 进行恶意推广


IOCs


ua.minding99.com
ba.minding99.com
ia.minding99.com
www.0311bj.cn
a.dearqy.cn
white.shougouji.top
cn4.ppzos.com
www.360gege.com
ic.dztworld.com
cn2.ppzos.com
bc.dztworld.com
sogous.sayblurb.com
pc.ppzos.com
cn5.ppzos.com
ba.dztworld.com
sogousss.srcbooks.com
ub.minding99.com
rat2.100geili.com
ib.dztworld.com
white.fjxmxslaw.com
cn1.ppzos.com
ub.dztworld.com
cn3.ppzos.com
bb.dztworld.com
rat3.100geili.com
sogouss.srcbooks.com



Clients


Count   Client          TAGS
44		111.160.156.10	NAT
27		125.36.117.113	NAT
27		218.69.42.199	NAT
24		117.9.55.29	NAT
22		221.197.187.187	NAT
22		61.181.206.154	NAT
20		218.69.64.130	NAT
20		218.68.145.150	NAT
20		221.198.203.162	NAT
20		221.197.55.4	NAT
20		117.11.128.45	NAT
19		60.26.187.29	NAT
18		117.13.15.45	NAT
18		61.181.131.46	NAT
18		117.11.155.93	NAT
18		60.27.30.20	NAT
18		218.69.74.187	NAT
17		218.68.236.120	NAT
17		61.181.92.130	NAT
16		117.15.222.228	NAT
16		218.68.220.53	NAT
16		218.67.233.167	NAT
16		111.162.24.203	NAT
15		125.38.137.213	NAT
15		60.24.144.117	NAT
15		111.163.146.62	NAT
14		60.25.16.227	NAT
14		60.24.189.241	NAT
14		117.13.140.142	NAT
14		218.69.242.43	NAT
14		60.27.207.61	NAT
14		125.38.176.2	NAT
13		218.68.201.81	NAT
13		60.25.27.238	NAT
13		117.14.249.51	NAT
13		111.167.149.205	NAT
13		111.161.191.151	NAT
12		221.198.110.24	NAT
12		125.38.168.10	NAT
12		60.27.205.7	NAT
12		117.13.140.6	NAT
12		221.197.69.44	NAT
12		117.14.103.18	NAT
12		117.13.168.100	NAT
11		111.163.211.201	
11		117.15.6.163	NAT
11		111.165.7.69	NAT
11		125.37.218.227	NAT
11		111.165.117.68	NAT
11		125.37.188.224	NAT
11		218.68.24.30	NAT
11		111.161.188.225	NAT
11		60.28.35.130	NAT
11		111.167.39.103	NAT
11		221.198.75.232	NAT
10		117.12.144.200	NAT
10		111.162.215.214	NAT
10		218.67.137.157	NAT
10		111.160.66.38	NAT
10		221.197.207.233	NAT
10		218.69.66.23	NAT
10		117.9.138.237	NAT
10		117.14.225.113	NAT
10		221.198.55.86	NAT
10		60.28.137.114	NAT
10		111.166.240.107	NAT
10		60.30.215.214	NAT
10		60.26.60.73	NAT
9		125.36.168.151	NAT
9		111.166.78.107	NAT
9		211.94.226.80	NAT
9		117.15.204.67	NAT
9		117.9.137.247	NAT
9		125.36.159.143	NAT
9		117.9.92.253	NAT
9		218.67.255.130	NAT
9		60.30.177.62	NAT
9		60.27.30.93	NAT
8		111.161.175.142	NAT
8		221.198.205.55	NAT
8		61.181.237.149	NAT
8		111.162.203.133	NAT
8		117.13.15.171	NAT
8		111.160.132.158	NAT
8		221.196.253.224	NAT
8		111.167.55.23	NAT
8		111.163.194.85	NAT
8		125.37.64.100	NAT
8		60.26.75.38	NAT
8		117.15.213.63	NAT
8		111.167.141.36	NAT
8		111.163.213.221	NAT
8		60.29.148.130	NAT
8		218.68.105.107	NAT
7		111.165.249.178	NAT
7		111.163.87.125	NAT
7		125.36.36.45	NAT
7		221.197.12.168	NAT
7		60.27.136.30	NAT
7		218.68.201.142	NAT
7		218.69.166.164	NAT
7		117.11.15.253	NAT
7		125.36.33.178	NAT
7		218.67.166.249	NAT
7		125.36.118.3	NAT
7		60.27.136.126	NAT
7		60.30.10.178	NAT
7		218.69.242.148	NAT
7		221.197.132.12	NAT
6		60.24.89.15	NAT
6		117.11.233.183	NAT
6		60.27.188.32	NAT
6		60.27.193.191	NAT
6		111.162.223.220	NAT
6		60.29.153.58	NAT
6		60.29.153.52	NAT
6		111.163.151.192	NAT
6		60.29.94.82	NAT
6		218.69.133.140	NAT
6		117.14.58.46	NAT
6		218.69.66.151	NAT
6		221.197.29.129	NAT
6		117.11.108.75	NAT
6		117.12.133.137	NAT
6		60.25.50.209	NAT
6		218.69.78.11	NAT
6		117.11.147.199	NAT
6		218.67.199.206	NAT
6		60.29.128.211	NAT
6		60.27.189.251	NAT
5		218.68.114.85	NAT
5		111.160.253.30	NAT
5		60.26.42.206	NAT
5		61.181.63.46	NAT
5		111.163.154.184	NAT
5		60.27.103.152	NAT
5		221.198.228.243	NAT
5		111.164.10.211	NAT
5		117.13.51.90	NAT
5		117.10.10.40	NAT
5		111.162.216.132	NAT
5		111.164.122.84	NAT
5		60.26.41.154	NAT
5		117.8.100.67	NAT
5		111.163.142.158	NAT
5		218.68.158.47	NAT
5		111.163.146.242	NAT
5		111.163.147.202	NAT
5		60.30.98.210	NAT
5		202.99.106.45	NAT
5		60.29.37.38	NAT
5		60.24.88.26	NAT
5		60.27.88.181	NAT
5		60.27.42.203	NAT
4		218.68.114.88	NAT
4		117.14.201.101	NAT
4		60.25.121.64	NAT
4		117.14.132.138	NAT
4		60.27.43.13	NAT
4		221.197.69.167	NAT
4		218.69.186.4	NAT
4		111.163.73.91	NAT
4		218.69.156.112	NAT
4		221.198.239.23	NAT
4		221.196.51.133	NAT
4		60.25.57.45	NAT
4		60.24.71.118	NAT
4		218.67.255.20	NAT
4		60.27.95.94	NAT
4		117.11.242.161	NAT
4		61.181.5.171	NAT
4		221.198.228.100	NAT
4		111.166.68.224	NAT
4		221.198.27.32	NAT
4		218.68.245.188	NAT
4		221.198.235.137	NAT
4		60.27.189.130	NAT
4		111.161.190.189	NAT
4		221.197.133.108	NAT
4		218.68.233.233	NAT
4		221.197.139.0	NAT
4		60.24.249.103	NAT
4		218.69.74.97	NAT
4		125.37.183.60	NAT
4		125.38.176.178	NAT
4		60.27.188.239	NAT
4		218.68.236.207	NAT
4		111.163.220.92	NAT
4		125.38.62.105	NAT
4		61.181.208.87	NAT
4		218.67.255.132	NAT
4		211.94.242.63	NAT
4		125.37.189.121	NAT
4		117.11.144.138	NAT
4		60.27.136.92	NAT
4		125.38.177.227	NAT
3		218.68.233.60	NAT
3		117.10.62.116	NAT
3		218.69.133.156	NAT
3		60.30.37.92	NAT
3		218.69.74.76	NAT
3		125.38.179.187	NAT
3		218.68.233.4	NAT
3		218.67.164.94	NAT
3		117.13.67.54	NAT
3		60.30.158.118	NAT
3		111.167.10.59	NAT
3		117.11.117.136	NAT
3		221.198.98.75	NAT
3		111.164.38.243	NAT
3		221.196.194.139	NAT
3		117.9.120.72	NAT
3		218.69.164.111	NAT
3		221.198.167.50	NAT
3		221.198.218.193	NAT
3		111.163.156.144	NAT
3		221.197.177.239	NAT
3		221.196.56.129	NAT
3		60.26.94.128	NAT
3		221.198.104.101	
3		125.36.52.31	NAT
3		117.9.239.187	NAT
3		117.11.239.145	NAT
3		60.24.91.72	NAT
3		221.198.174.199	NAT
3		218.69.242.4	NAT
3		125.37.183.147	NAT
3		60.27.60.238	NAT
3		218.67.234.37	NAT
3		117.11.121.171	NAT
3		218.68.204.2	NAT
3		117.12.80.93	NAT
3		111.167.205.126	NAT
3		221.198.61.203	
3		221.197.222.238	NAT
3		218.68.102.6	NAT
3		60.24.226.134	NAT
3		117.14.249.216	NAT
3		125.37.189.53	NAT
3		60.25.2.192	NAT
3		60.27.174.218	NAT
3		60.27.173.241	NAT
3		117.12.20.146	NAT
3		60.28.48.194	NAT
3		111.163.150.91	NAT
3		117.13.3.30	NAT
2		60.24.91.55	NAT
2		218.68.219.19	NAT
2		125.37.121.172	NAT
2		60.26.79.134	NAT
2		60.30.203.70	NAT
2		117.14.207.142	NAT
2		111.165.120.223	NAT
2		117.10.65.170	NAT
2		111.162.200.171	NAT
2		111.163.77.247	NAT
2		60.27.138.181	NAT
2		117.14.249.26	NAT
2		117.15.222.52	NAT
2		60.27.136.84	NAT
2		60.29.215.153	NAT
2		117.15.190.58	NAT
2		111.163.198.248	NAT
2		60.26.122.202	NAT
2		111.161.221.189	NAT
2		111.162.216.62	NAT
2		111.166.213.251	NAT
2		111.165.116.208	
2		111.160.120.54	NAT
2		111.165.30.69	NAT
2		221.196.203.65	NAT
2		218.67.146.57	
2		111.166.66.253	
2		111.167.79.178	
2		111.162.8.186	NAT
2		125.37.183.50	NAT
2		111.161.190.225	NAT
2		117.10.249.226	NAT
2		117.13.104.78	NAT
2		221.197.162.210	NAT
2		60.25.115.96	NAT
2		111.165.214.234	NAT
2		221.196.172.170	NAT
2		117.10.68.185	
2		125.37.191.87	NAT
2		60.24.127.98	NAT
2		117.12.16.123	NAT
2		117.14.126.217	NAT
2		111.162.200.108	NAT
2		60.26.95.79	NAT
2		221.198.59.196	
2		125.37.167.208	NAT
2		60.27.104.1	NAT
2		218.69.234.247	NAT
2		111.166.117.229	NAT
2		117.10.138.212	NAT
2		60.25.17.106	NAT
2		117.8.71.114	NAT
2		60.25.154.32	NAT
2		117.10.105.154	
1		218.68.114.232	NAT
1		218.68.201.255	NAT
1		125.37.29.177	NAT
1		218.67.254.103	NAT
1		61.181.40.58	NAT
1		111.161.235.57	NAT
1		60.24.88.219	NAT
1		218.68.146.254	NAT
1		218.68.102.48	NAT
1		117.9.88.178	NAT
1		60.24.12.95	NAT
1		111.163.208.48	NAT
1		117.14.227.37	
1		125.37.189.90	NAT
1		218.67.204.218	NAT
1		125.37.182.15	NAT
1		60.24.12.200	NAT
1		218.69.72.24	NAT
1		117.12.233.224	NAT
1		111.163.16.168	NAT
1		111.163.122.25	NAT
1		221.198.131.25	NAT
1		60.25.39.56	NAT
1		117.13.95.251	NAT
1		221.196.194.116	NAT
1		60.26.158.69	NAT
1		117.14.249.73	NAT
1		111.163.142.187	NAT
1		125.37.190.50	NAT
1		218.68.147.89	NAT
1		221.197.69.49	NAT
1		117.14.107.42	NAT
1		117.15.192.109	NAT
1		117.10.64.131	NAT
1		111.163.151.214	NAT
1		111.165.106.1	
1		221.196.51.5	NAT
1		125.36.118.252	NAT
1		117.10.64.187	NAT
1		221.197.54.203	NAT
1		218.68.156.175	NAT
1		60.24.88.200	NAT
1		111.163.146.23	NAT
1		221.197.12.150	NAT
1		125.38.18.28	NAT
1		117.8.85.121	NAT
1		60.25.13.211	NAT
1		111.162.220.193	NAT





Malware.darkshell


darkshell 是面向Window平台的DDoS malware，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。


IOCs


equant.wang



Clients


Count   Client          TAGS
257		125.37.163.193	NAT
35		60.30.158.118	NAT
5		117.131.173.13	NAT





Malware.nadrac


一款简单的远控程序，又被称为Farfli, YongLouts。一般主要是充当下载器，包含键盘记录，代理，音视频监听等多个插件。


IOCs


dllhost.website
baijinddos.xyz
mdzz2018.msns.cn
sky.hobuff.info
indonesias.website



Clients


Count   Client          TAGS
526		60.30.199.26	NAT
509		111.160.156.10	NAT
203		111.163.143.228	NAT
84		60.28.140.93	NAT
54		60.29.124.250	NAT
8		60.28.114.2	NAT
7		60.29.133.19	NAT
4		111.160.110.26	NAT
4		218.69.27.222	NAT
4		125.37.162.202	NAT
3		111.165.217.222	NAT
3		60.28.101.14	NAT
2		125.39.151.188	
2		60.29.64.86	NAT
1		60.28.114.30	NAT





Malware.elknot


一款比较知名的木马，它允许远程攻击者利用受感染计算机发动DDoS攻击。


IOCs


fk.appledoesnt.com
ll.8suf.com
baijinddos.xyz



Clients


Count   Client          TAGS
452		61.181.59.88	
258		60.30.26.124	
257		60.29.144.220	
203		111.163.143.228	NAT
155		218.68.0.210	NAT





Malware.loki


loki是一款针对windows平台的恶意软件，其主要目的在于窃取受害者的敏感信息，browser,email,ftp,以及诸多付费工具的licence等。


IOCs


silverlinehospital.in



Clients


Count   Client          TAGS
1		125.37.160.100	NAT





Malware.barhera


一款木马后门，用于下载其他的恶意软件。


IOCs


p.raidmedia.com.cn
update.bainv.net
l.raidmedia.com.cn



Clients


Count   Client          TAGS
3		221.197.133.137	NAT
3		61.181.5.31	NAT





Malware.zombieboy


zombieboy是一款针对windows平台的加密货币挖矿蠕虫。


IOCs


cuijiahuq.f3322.net
dns.fq520000.org



Clients


Count   Client          TAGS
13		218.69.133.37	NAT
1		125.35.213.157	NAT





Malware.rcshark


rcshark是一款针对windows平台的后门病毒，其主要功能是窃取用户的敏感信息。


IOCs


xiangban1988.3322.org



Clients


Count   Client          TAGS
1		60.27.188.109	NAT





Malware.Dorkbot


属于蠕虫病毒，被感染的所有主机都会沦为黑客的肉鸡，不定期对外网主机进行DDoS攻击，同时其还具有极强的隐蔽性，运行之后会把恶意代码注入到合法进程，然后删除自身。


IOCs


a.amous1epadsafa42.com
a.ajjjqws1fkxx42.com
a.adoyou1understandme42.com
a.aiphon1egalaxyblack42.com



Clients


Count   Client          TAGS
9		60.30.214.50	NAT





Malware.ramnit


ramnit是一款针对windows平台的病毒，最初表现为一款感染U盘，FTP服务器文件的蠕虫，传播大量广告软件，随后发展成银行木马，用于窃取用户金融以及其它敏感信息。


IOCs


stromoliks.com
jdskfjkfw3232234.com
fkjdeljfeew32233.com
rterybrstutnrsbberve.com
fget-career.com
fdwelklwe3093443.com
supnewdmn.com



Clients


Count   Client          TAGS
256		61.181.30.138	NAT
112		60.28.141.50	NAT
79		125.36.152.117	NAT
34		61.181.108.2	NAT
32		60.28.156.216	
30		117.131.173.16	NAT
30		221.197.12.90	NAT
27		60.29.37.38	NAT
25		117.15.99.67	NAT
25		111.160.91.94	NAT
20		111.30.30.18	NAT
19		111.160.100.230	NAT
19		111.165.24.101	NAT
16		61.181.252.146	NAT
16		111.164.20.30	NAT
15		60.30.4.11	
14		221.239.93.251	
13		60.29.22.98	    NAT
12		60.25.11.13 	NAT
12		218.69.90.46	NAT
11		111.160.156.10	NAT
11		111.160.132.158	NAT
10		60.30.199.26	NAT
10		60.29.89.34 	NAT
10		218.68.224.88	NAT
9		218.68.158.40	NAT
9		60.30.164.26	NAT
8		60.26.101.13	NAT
8		218.68.233.132	NAT
8		221.197.139.99	NAT
8		221.197.122.193	NAT
7		221.196.108.115	NAT
7		61.181.143.34	NAT
7		117.9.93.13 	NAT
7		60.25.148.35	NAT
7		180.213.5.10	NAT
7		117.11.218.223	NAT
6		60.27.31.62	    NAT
6		218.69.129.222	NAT
6		111.162.212.244	NAT
6		218.68.234.159	NAT
6		218.68.234.64	NAT
6		111.160.233.182	NAT
6		125.38.176.178	NAT
6		117.11.153.212	NAT
6		221.196.180.62	NAT
6		221.198.66.44	NAT
6		60.26.225.158	NAT
5		221.198.170.164	NAT
5		111.163.158.181	NAT
5		125.36.153.16	NAT
5		117.10.62.226	NAT
5		117.12.202.189	NAT
5		218.69.226.106	NAT
5		117.13.115.123	NAT
5		61.181.74.42	NAT
5		60.29.133.19	NAT
5		218.69.55.166	NAT
5		218.69.54.167	NAT
5		211.94.243.185	NAT
5		60.30.208.226	NAT
5		117.9.18.2  	NAT
5		106.47.29.70	NAT
5		125.37.29.120	NAT
5		111.162.149.78	NAT
5		218.68.0.6	    NAT
4		111.161.158.131	NAT
4		211.94.254.85	NAT
4		218.69.6.74	    NAT
4		221.198.86.145	NAT
4		111.160.120.54	NAT
4		60.24.90.226	NAT
4		60.29.93.221	NAT
4		111.163.143.228	NAT
4		111.163.123.7	NAT
4		221.198.238.209	NAT
4		60.24.184.70	NAT
4		60.27.31.0  	NAT
4		117.15.125.181	NAT
4		61.181.140.42	NAT
4		117.12.37.223	NAT
4		218.67.234.60	NAT
4		125.38.176.229	NAT
4		125.37.29.23	NAT
4		61.181.103.138	NAT
4		117.11.10.12	NAT
4		60.24.233.164	NAT
4		60.28.104.130	NAT
4		218.68.105.7	NAT
4		111.166.237.230	NAT
4		221.196.46.61	NAT
4		117.14.119.35	NAT
4		60.26.203.160	NAT
4		117.9.237.225	NAT
4		218.68.200.243	NAT
4		218.68.229.81	NAT
4		218.68.219.29	NAT
3		221.198.67.88	NAT
3		117.10.236.245	NAT
3		117.15.192.231	NAT
3		60.24.45.218	NAT
3		117.12.146.72	NAT
3		60.29.43.46	    NAT
3		117.9.191.22	NAT
3		111.163.144.224	NAT
3		125.37.182.99	NAT
3		117.10.138.46	NAT
3		211.94.243.121	NAT
3		111.161.150.34	NAT
3		61.181.219.120	NAT
3		60.27.60.159	NAT
3		111.162.163.231	NAT
3		111.166.238.248	NAT
3		117.12.1.165	NAT
3		117.13.168.162	NAT
3		202.99.106.47	NAT
3		221.197.179.98	NAT
3		211.94.226.74	NAT
3		60.28.101.104	NAT
3		111.165.188.122	NAT
3		60.29.154.226	NAT
3		60.29.15.2	    NAT
3		111.165.105.247	NAT
3		60.26.239.60	NAT
3		43.249.136.20	NAT
3		61.181.202.5	
3		60.26.142.193	NAT
3		117.13.106.191	NAT
3		60.29.63.18	    NAT
3		60.29.16.94	    NAT
3		218.69.52.252	NAT
3		117.14.66.156	NAT
3		221.196.97.11	NAT
3		218.67.181.124	NAT
3		111.160.80.3	NAT
3		117.13.140.5	NAT
3		111.165.11.60	NAT
3		60.25.251.11	NAT
2		111.160.97.18	NAT
2		218.68.102.58	NAT
2		125.37.217.118	NAT
2		125.37.191.155	NAT
2		221.196.97.36	NAT
2		221.196.194.253	NAT
2		218.68.224.39	NAT
2		218.68.102.247	NAT
2		111.160.198.83	NAT
2		60.27.189.44	NAT
2		117.12.133.191	NAT
2		60.30.156.190	NAT
2		211.94.248.28	NAT
2		221.198.60.201	NAT
2		60.26.132.173	NAT
2		117.15.22.130	NAT
2		218.69.55.247	NAT
2		117.9.70.23 	NAT
2		111.162.216.127	NAT
2		61.181.63.138	NAT
2		60.24.127.98	NAT
2		125.36.101.224	NAT
2		117.12.125.160	NAT
2		111.165.56.53	NAT
2		111.165.128.30	NAT
2		125.37.212.67	NAT
2		218.68.107.108	NAT
2		111.167.149.238	NAT
2		221.197.154.147	NAT
2		117.13.244.21	NAT
2		125.35.249.1	NAT
2		218.69.11.58	NAT
2		117.10.28.225	NAT
2		221.197.133.137	NAT
2		111.167.46.70	NAT
2		60.29.179.114	NAT
2		221.196.180.242	NAT
2		60.30.105.33	NAT
2		60.27.138.17	NAT
1		218.67.254.17	NAT
1		117.11.225.137	NAT
1		111.163.143.193	NAT
1		60.24.89.15	    NAT
1		218.69.55.60	NAT
1		60.30.215.242	NAT
1		111.163.140.152	NAT
1		111.160.108.34	NAT
1		221.198.218.112	NAT
1		125.38.177.138	NAT
1		60.29.95.82	    NAT
1		221.196.194.2	NAT
1		221.197.162.54	NAT
1		117.15.191.57	NAT
1		60.27.42.62	NAT
1		117.9.229.148	NAT
1		218.69.234.252	NAT
1		60.27.79.17	    NAT
1		117.8.101.63	NAT
1		60.30.105.41	NAT
1		125.37.125.3	NAT
1		221.198.118.158	NAT
1		60.28.101.103	NAT
1		60.28.101.106	NAT
1		60.27.205.187	NAT
1		211.94.242.118	NAT
1		117.12.144.7	NAT
1		117.8.100.70	NAT
1		60.29.30.190	NAT
1		60.26.180.205	NAT
1		111.162.221.168	NAT
1		221.198.110.209	NAT
1		117.14.70.156	NAT
1		60.29.116.18	NAT
1		111.165.72.25	NAT
1		218.69.147.133	NAT
1		60.29.153.61	NAT
1		221.196.119.133	NAT
1		111.163.22.227	NAT
1		60.30.204.82	NAT
1		111.167.144.199	NAT
1		60.30.240.226	NAT
1		111.166.156.237	NAT
1		60.28.38.18	    NAT
1		125.37.182.185	NAT
1		218.68.235.133	NAT
1		125.38.191.184	NAT
1		111.160.97.42	NAT
1		111.163.78.80	NAT
1		111.161.189.215	NAT
1		117.11.239.56	NAT
1		218.69.243.164	NAT
1		60.29.179.42	NAT
1		117.12.158.82	NAT
1		60.25.63.52	    NAT
1		60.25.10.147	NAT
1		60.27.79.149	NAT
1		111.162.163.241	NAT
1		221.239.72.170	NAT





Malware.gh0st


GH0ST是一款经典的RAT，针对Windows系统，支持截屏、录像、录音等多种spy功能。GH0ST由中国人编写，已经开放源码，因而存在较多的变种。


IOCs


www.sousouweb.com
ime.mys2005.xyz
linux145.f3322.net
3s.dkys.org
yk.520yxsf.com
baijinddos.xyz
xiangban1988.3322.org
fwq2020.f3322.net
zerococoll.f3322.net
sky.hobuff.info
www.wulei168.pw



Clients


Count   Client          TAGS
509		111.160.156.10	NAT
203		111.163.143.228	NAT
103		125.39.138.171	
94		60.28.34.59	
54		60.29.124.250	NAT
34		60.30.199.26	NAT
20		60.28.99.74 	NAT
18		61.181.81.82	NAT
12		218.69.11.58	NAT
4		103.233.4.30	NAT
3		111.165.217.222	NAT
3		221.239.104.13	
3		60.28.101.14	NAT
2		125.39.151.188	
1		60.27.188.109	NAT
1		60.28.101.104	NAT





Malware.posioncake


一款内置于手机ROM的恶意代码模块，注入Phone进程，拦截短信和发送短信，自动扣费，窃取信息等等。


IOCs


hcbh.heycould.com
hacdl.junwonsil.com



Clients


Count   Client          TAGS
6		60.27.42.111	NAT
2		125.37.189.42	NAT
2		60.27.43.103	NAT
1		111.162.129.93	NAT





Malware.nitol


又名dsl，是国内著名的面向Window平台的DDoS类型的 botnet家族，支持icmp/udp/tcp/http等多种攻击手段，具有较多的变种。


IOCs


dllhost.website
mssql.noip.cn
mdzz2018.msns.cn
yk.520yxsf.com
akmfs.com
40kam.cn
sky.hobuff.info
a.aklianfa.com
indonesias.website
3s.dkys.org
ak-74.top



Clients


Count   Client          TAGS
709		60.30.199.26	NAT
509		111.160.156.10	NAT
84		60.28.140.93	NAT
54		60.29.124.250	NAT
11		111.163.143.228	NAT
8		60.28.114.2	    NAT
7		60.29.133.19	NAT
4		125.37.162.202	NAT
4		111.160.110.26	NAT
4		218.69.27.222	NAT
3		111.165.217.222	NAT
3		60.28.101.14	NAT
2		125.39.151.188	
2		60.29.64.86	    NAT
1		60.27.119.49	
1		60.28.114.30	NAT
1		60.28.101.104	NAT





Malware.mirai


通过大规模弱口令扫描来实现传播的蠕虫病毒，将Linux平台的Iot设备控制，用于DDoS攻击。


IOCs


scan.santaiot.net
seven.nadns.info
netflux.r00ts.online
cnc.stresser.pw



Clients


Count   Client          TAGS
585		60.29.215.141	NAT
527		111.160.57.142	NAT
290		61.181.115.50	NAT
2		111.167.211.108	NAT





Malware.humpler


该病毒伪装成多款小工具（如：老板键、屏幕亮度调节等），正通过2345软件大全等多个知名下载站进行传播。病毒入侵电脑后，会劫持QQ、360、搜狗等（市面上所有主流）浏览器首页。


IOCs


www.baidu-home.com



Clients


Count   Client          TAGS
1		60.27.136.24	NAT





Malware.wannycry


一种“蠕虫式”的勒索病毒软件，利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播，感染计算机后会向计算机中植入敲诈者病毒，导致电脑大量文件被加密。


IOCs


iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com



Clients


Count   Client          TAGS
215		60.30.147.86	
3		125.35.211.131	NAT
1		61.181.70.210	NAT
1		60.29.64.22	    NAT





Malware.DUNIHi


DUNIHI (VBS_DUNIHI.ELDSAVJ)是一个有后门和蠕虫功能的很著名的VB脚本，在某些单独的事件中，该脚本在垃圾邮件活动中与Adwind一起释放。


IOCs


pm2bitcoin.com



Clients


Count   Client          TAGS
107		60.29.15.54	NAT





Malware.flyboy


一款常见的DDoS木马。


IOCs


3s.dkys.org



Clients


Count   Client          TAGS
1		60.28.101.104	NAT





Malware.zusy


隐藏在PowerShell中，当用户打开，代码将被执行并连接到CC，接下来就会下载文件并执行，最终部署恶意程序downloader。


IOCs


buy1.amzjhhl.ru
buy1.gsnrrtf.net
buy1.csfnlpg.com
buy1.cdpgphm.ru
buy1.dhccyjw.net
buy1.tnnxkzu.ru
buy1.emafzud.net
buy1.rcdibnh.net
buy1.uxesjmg.ru
buy1.swexydc.ru
buy1.jgbfjlp.net
buy1.zwnbddh.com
buy1.xrcugmy.net
buy1.bgnlbfi.ru
buy1.nonyans.net
buy1.xfwwcmk.net
buy1.iqcpfzo.ru
buy1.anzxoii.net
buy1.ntlucrd.com
buy1.tiksrzr.com
buy1.otkmgkl.ru
buy1.icwastp.ru
buy1.rmpokmg.ru
buy1.gyhhgrc.ru
buy1.aenqzfk.net
buy1.hbjxtas.com
buy1.tpibfhe.ru
buy1.nuawren.com
buy1.nzuibjx.net
buy1.swemrgx.ru
buy1.qzojbhw.net
buy1.qwlhrkg.net
buy1.cbbfywr.ru
buy1.iryjeqo.com
buy1.eftctph.com
buy1.rdggegr.ru
buy1.fmrolhu.ru
buy1.rksgxwu.com
buy1.ddplnfp.net
buy1.yhbayam.net
buy1.uqccxlp.com
buy1.mnplqfs.net
buy1.dhzozeh.com
buy1.tlwrshg.net
buy1.aldloqz.ru
buy1.lrtapbs.ru
buy1.blwszto.ru
buy1.ejuzlle.net
buy1.gxhrnou.net
buy1.iwjsndf.com
buy1.pkhruee.net
buy1.zrsglol.com
buy1.kfysswc.com
buy1.jlaxfgb.ru
buy1.lyksyom.ru
buy1.mbtndqh.ru
buy1.pmhncfh.com
buy1.pfccfpb.ru
buy1.ihtmojm.ru
buy1.jzwhkrf.ru
buy1.mbiaean.ru
buy1.oddcucl.net
buy1.wzxtbjj.com
buy1.fpkrylz.com
buy1.jrwgrbg.ru
buy1.qnmbbdf.com
buy1.ddxkizq.net
buy1.yyalymk.net
buy1.acthwqo.com
buy1.snpntqd.com
buy1.azcduku.net
buy1.ncfnqjq.ru
buy1.ipqwqms.com
buy1.ofcllwd.net
buy1.xbxkmpp.com
buy1.alxluqi.ru
buy1.dyimlqp.net
buy1.fiocywx.com
buy1.abqlnrj.net
buy1.rrsywps.net
buy1.dyqzunc.ru
buy1.arhaqps.net
buy1.zpoxqcm.com
buy1.loakwst.net
buy1.nmwfrco.net
buy1.bhwfnll.net
buy1.osqmhxk.com
buy1.tzsduod.ru
buy1.lzssazr.net
buy1.icuieia.com
buy1.subbsty.net
buy1.fyalcld.net
buy1.odadidc.net
buy1.oabnnmt.net
buy1.aypoxyp.ru
buy1.nzliqic.net
buy1.xcypwuk.com
buy1.kfxzzsn.com
buy1.iywiqzr.com
buy1.rkacqse.ru
buy1.ymqfcbd.net
buy1.pypylia.com
buy1.gcyzgmf.com
buy1.xkxkdrn.com
buy1.cuoohzc.net
buy1.umjumsm.ru
buy1.pyyynza.com
buy1.udcjmjp.com
buy1.jpczuxg.com
buy1.bhnlbnh.net
buy1.gkhdxpf.net
buy1.hcgrnpn.ru
buy1.mslethd.ru
buy1.rfigznh.com
buy1.fkixudk.com
buy1.dqjkgce.net
buy1.rpxiwkc.com
buy1.niobmdi.com
buy1.dgwxumj.net
buy1.xalccbx.net
buy1.rzlqryz.net
buy1.dmbszul.com
buy1.uxxbwrr.ru
buy1.lgllgjs.net
buy1.tklwfah.ru
buy1.bbjzotm.ru
buy1.muxizct.ru
buy1.iexcrzz.net
buy1.gqoshyz.com
buy1.kyjbpwo.com
buy1.qxicnnb.com
buy1.yhpgwbd.net
buy1.txhkpgx.ru
buy1.iyfekft.ru
buy1.rfjllrs.net
buy1.xfqhajt.ru
buy1.zdfytrg.net
buy1.dfllbal.com
buy1.ctxjyex.com
buy1.yeyagrf.net
buy1.ulijgtz.com
buy1.rpskkwa.ru
buy1.yltzlez.ru
buy1.uwzghwb.net
buy1.jsitazi.ru
buy1.fehllnd.ru
buy1.ewkuzls.com
buy1.gciwhdc.net
buy1.khjizyn.com
buy1.ajjchrq.com
buy1.hizfyzc.ru
buy1.acejruk.com
buy1.jcerqdu.com
buy1.litporj.net
buy1.xygtuqr.net
buy1.zhzecai.ru
buy1.lrqfxhc.net
buy1.plbjxaw.net
buy1.xisphiu.ru
buy1.nmdmzxk.com
buy1.whowczd.net
buy1.gfygooj.net
buy1.bkfhpoo.net
buy1.xfojdma.com
buy1.zzcsctw.com
buy1.shkjsxn.com
buy1.sczeedr.com
buy1.jlqawun.net
buy1.zbrxzcd.net
buy1.eawlrfo.net
buy1.lkwwnuy.com
buy1.eojrzia.com
buy1.mkehkqw.ru
buy1.bunndlc.net
buy1.caejtfs.com
buy1.qdlycsz.ru
buy1.aamdljg.net
buy1.uarszmk.net
buy1.eghszki.ru
buy1.kyzweka.ru
buy1.ucykaub.net
buy1.unxoyqg.net
buy1.ujgrmdw.net
buy1.oftxynb.com
buy1.byimnch.com
buy1.agipcrc.com
buy1.eqsjnjm.com
buy1.wqrtqpc.com
buy1.wosqlhp.com
buy1.txrytdk.ru
buy1.ncmxoby.net
buy1.fkztbqc.ru
buy1.yyeytoh.ru
buy1.xxegozl.net
buy1.umlddds.com
buy1.ihsfmzs.ru
buy1.bzloyhl.com
buy1.fpucsex.net
buy1.dhenkce.ru
buy1.wqpquur.com
buy1.jeuggdx.net
buy1.bqsmdwo.net
buy1.mswcoje.ru
buy1.snabueo.com
buy1.zsczqfy.ru
buy1.fwtoowy.ru
buy1.ofinzks.net
buy1.ctemxrb.com
buy1.bwfakki.com
buy1.losoipz.net
buy1.wyxhwju.net
buy1.zkznpjx.net
buy1.wtiksxd.com
buy1.swhjoah.com
buy1.nasuofo.net
buy1.yuwtdkb.net
buy1.gtdiebz.net
buy1.whihyrr.net
buy1.jslmhdt.ru
buy1.jsbutdx.net
buy1.ztkwpnt.net
buy1.nrtqgnk.ru
buy1.kmmeycg.net
buy1.jhlzgnx.com
buy1.holmewx.com
buy1.kqktsmm.net
buy1.sbbcsds.ru
buy1.ldqfpjt.ru
buy1.nnhaioe.ru
buy1.ibhyldi.com
buy1.konsxcs.net
buy1.cbhsshp.com
buy1.gopdypa.net
buy1.trozbgi.com
buy1.kaohkbo.ru
buy1.zjfyxty.com
buy1.llhwqrb.ru
buy1.dmyldke.ru
buy1.efyncmf.net
buy1.emjrsao.com
buy1.xwyntku.com
buy1.hltlxfs.net
buy1.thbjtrm.net
buy1.qwgsncg.com
buy1.fbbefbz.com
buy1.twgpprb.net
buy1.nhexpdk.ru
buy1.gehbfee.ru
buy1.mgqwpyq.net
buy1.gykmlbd.com
buy1.xtxflqf.net
buy1.nweqxdp.com
buy1.alggopl.com
buy1.hpczbok.com
buy1.rgqkjoz.net
buy1.hyldyiu.com
buy1.mnbqzcx.com
buy1.ppolbqq.com
buy1.zhytqnk.com
buy1.lntgdkt.net
buy1.egrsdno.ru
buy1.sningaz.net
buy1.wbtjqns.com
buy1.twqqspy.ru
buy1.uaegzfg.net
buy1.lybnmaq.net
buy1.tqebcid.com
buy1.gyqxhuk.com
buy1.lgppbam.net
buy1.oyzkzhk.ru
buy1.tbsnaoq.ru
buy1.jfmnyjj.net
buy1.lrzgxti.ru
buy1.byosnwr.ru
buy1.deutskr.net
buy1.rhaaxsx.net
buy1.ptprctl.ru
buy1.jaisoap.net
buy1.ifjzgwm.com
buy1.rynffwj.net
buy1.gbcdmyk.com
buy1.uzinsse.ru
buy1.ioicphz.com
buy1.ukciate.ru
buy1.lezsbdq.com
buy1.dertjgm.net



Clients


Count   Client          TAGS
298		111.160.240.107	NAT





Malware.woring


woring是一款针对Linux平台的 DDoS类型的botnet，因为函数命名存在一个typo: working->woring 故得名。woring主要感染x86 CPU架构的系统，支持常见的DDoS攻击手段。


IOCs


ak-74.top



Clients


Count   Client          TAGS
1		60.27.119.49	





Malware.miner


各种挖矿软件家族，包括LSDminer、MSRAminer等等。


IOCs


mine.ppxxmr.com
p.awcna.com
p.zer2.com
pool.minexmr.com
tgoodluck.info
fr.ppxxmr.org
x.csrss.website
pool.usa-138.com
lpp.zer2.com
rapid7cpfqnwxodo.tor2web.fyi
testnet-seed.bitcoin.jonasschnelli.ch
xmr.crypto-pool.fr
task.estonine.com
urlxxx.at.ua
pluck.moisture.tk
xmr.f2pool.com
donate.v2.googel-dns.com
xmr-eu2.nanopool.org
log.miniast.com
lsd.systemten.org
seed.tbtc.petertodd.org
loop.haqo.net
a.csrss.website
reader.pamphler.com
t.awcna.com
luoxkexp.com
poole.laofubtc.com
indonesias.me
tar.kziu0tpofwf.club
p1.qsd2xjpzfky.site
p3.qsd2xjpzfky.site
systemten.org
xmr-eu1.nanopool.org
lpp.awcna.com
swt.njaavfxcgk3.club
null.exhauest.com
www.zeculiar.tk
dns.posthash.org
guojun.website
p.amxny.com
loop.sawmilliner.com
z.drawal.tk
morphed.ru
xmr.pool.minergate.com
rapid7cpfqnwxodo.onion.in.net
dnsseed.bluematt.me
s.csrss.website
rer.njaavfxcgk3.club
pool.supportxmr.com
europe.cryptonight-hub.miningpoolhub.com
emergency.kiss58.org
emergency.googel-dns.com
seed.testnet.bitcoin.sprovoost.nl
fox.weilders.com
acs.njaavfxcgk3.club
monerohash.com
w.3ei.xyz
jump.taucepan.com
fee.googel-dns.com
ccc.njaavfxcgk3.club
xmr.usa-138.com
seed.bitcoinstats.com



Clients


Count   Client          TAGS
900		60.30.199.26	NAT
892		221.239.96.146	NAT
891		111.160.156.10	NAT
803		111.164.175.157	NAT
574		111.160.82.66	NAT
521		111.160.204.62	
494		60.30.197.110	NAT
467		60.28.104.130	NAT
415		60.28.252.2 	NAT;IDC
352		221.196.92.246	NAT
269		60.29.103.44	NAT
241		60.29.17.222	NAT
239		218.68.45.209	NAT
164		117.9.18.201	NAT
142		218.68.105.24	NAT
130		202.99.114.74	NAT
130		111.160.167.194	NAT
110		60.28.47.90	    NAT
78		60.28.253.182	NAT
69		218.69.133.62	NAT
68		61.181.131.66	NAT
43		61.240.24.130	NAT
37		60.24.90.72	    NAT
36		111.160.119.178	NAT
35		60.30.240.226	NAT
35		60.30.134.99	NAT
34		221.197.42.171	
28		125.35.210.209	NAT
27		60.28.102.2	    NAT
26		221.197.55.168	NAT
26		61.181.207.7	NAT
25		125.35.210.222	NAT
24		125.35.210.204	NAT
24		125.35.210.229	NAT
19		125.39.71.19	
19		61.181.76.146	NAT
18		60.25.251.11	NAT
18		111.33.30.44	NAT
17		117.14.201.183	NAT
17		60.30.69.36	    NAT
16		221.197.139.246	NAT
16		60.28.101.104	NAT
16		60.28.108.201	NAT
15		218.69.96.14	NAT
15		60.30.193.162	NAT
15		222.36.63.83	
15		60.30.208.226	NAT
15		111.160.40.106	NAT
14		61.136.11.38	NAT
14		60.28.156.216	
14		60.28.101.74	NAT
14		60.29.158.82	NAT
14		111.160.122.98	NAT
14		218.69.11.174	NAT
13		60.28.101.105	NAT
13		117.9.164.4	    NAT
12		117.15.169.6	
12		61.181.70.210	NAT
11		180.213.5.10	NAT
10		111.164.49.39	NAT
10		218.68.5.141	NAT
10		60.29.15.54	    NAT
10		218.68.0.210	NAT
10		111.164.183.26	NAT
10		60.30.186.26	NAT
10		125.39.151.188	
9		221.239.124.90	NAT
9		117.131.173.16	NAT
8		123.150.44.5	NAT
8		111.160.97.18	NAT
8		221.238.238.234	NAT
8		117.9.8.157	    NAT
8		61.181.123.67	
8		125.35.211.131	NAT
8		123.150.44.3	NAT
7		60.29.133.19	NAT
6		111.160.80.250	NAT
6		111.160.7.62	NAT
6		125.36.59.125	NAT
6		123.150.44.11	NAT
6		218.68.204.18	NAT
6		218.69.11.58	NAT
5		60.29.64.138	NAT
5		123.151.25.136	NAT
5		125.37.77.156	NAT
5		111.164.183.91	NAT
5		111.162.128.53	NAT
5		117.11.10.12	NAT
5		117.13.140.93	NAT
5		60.30.149.98	NAT
4		221.196.67.188	NAT
4		60.25.179.9	    NAT
4		60.30.120.132	NAT
4		218.68.102.37	NAT
4		218.69.61.140	NAT
4		218.68.147.61	NAT
4		60.28.84.197	NAT
4		111.160.240.109	NAT
4		60.29.64.139	NAT
4		218.68.1.195	NAT
3		60.28.101.14	NAT
3		111.160.166.189	NAT
3		61.181.97.162	NAT
3		61.181.112.102	NAT
3		60.28.101.103	NAT
3		117.9.18.204	NAT
3		117.10.138.188	NAT
3		218.68.235.209	NAT
3		218.69.156.59	NAT
3		117.131.135.209	NAT
2		60.29.195.26	NAT
2		221.197.97.97	
2		60.26.78.4	
2		218.67.246.54	NAT
2		111.160.166.58	NAT
2		61.181.103.46	NAT
2		60.27.79.17	    NAT
2		60.30.172.82	NAT
2		60.29.153.61	NAT
2		60.28.63.85	    NAT
2		60.29.158.138	NAT
2		60.30.42.78	    NAT
2		111.163.122.136	NAT
2		111.30.78.46	NAT
2		60.30.33.70	
2		221.197.220.35	NAT
2		60.28.41.18	    NAT
2		111.30.101.238	NAT
2		60.29.153.45	NAT
2		60.29.179.118	NAT
2		117.9.199.42	NAT
2		123.150.44.9	NAT
2		60.28.104.118	NAT
2		111.160.70.46	NAT
2		61.181.107.107	NAT
1		111.162.215.164	NAT
1		111.162.68.202	NAT
1		103.233.4.30	NAT
1		218.69.25.110	NAT
1		60.29.153.43	NAT
1		221.196.108.202	NAT
1		60.30.149.10	NAT
1		117.131.245.101	NAT
1		111.33.17.70	NAT
1		61.181.5.114	NAT
1		117.13.72.198	NAT
1		60.30.177.62	NAT
1		211.94.248.30	NAT
1		125.38.179.109	NAT
1		221.196.108.163	NAT
1		218.68.159.45	NAT
1		60.29.4.206	    NAT
1		111.160.49.188	NAT
1		111.160.49.186	
1		117.11.117.118	NAT
1		111.162.201.182	NAT
1		218.68.105.125	NAT
1		111.162.219.115	NAT
1		218.68.204.86	NAT
1		60.30.155.10	NAT
1		221.239.89.186	NAT
1		111.164.40.153	NAT
1		60.29.154.210	NAT
1		61.181.15.212	NAT
1		111.163.141.224	NAT
1		60.28.114.2	    NAT
1		60.29.77.202	NAT
1		221.239.26.30	NAT
1		111.160.242.66	NAT
1		60.30.162.14	
1		103.233.4.29	NAT
1		111.166.50.41	NAT
1		111.166.87.206	NAT





Malware.wannacry


一种“蠕虫式”的勒索病毒软件，由不法分子利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播。被该勒索软件入侵后，用户主机系统内的照片、图片、文档、音频、视频等几乎所有类型的文件都将被加密，加密文件的后缀名被统一修改为 WNCRY。


IOCs


www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com



Clients


Count   Client          TAGS
104		60.30.147.86	
8		125.35.211.131	NAT
3		111.164.183.91	NAT
2		221.238.232.218	NAT
2		111.160.40.106	NAT
1		60.29.64.22	    NAT
1		61.181.70.210	NAT





Malware.sality


一款多态感染性病毒，一旦被他们感染，电脑上大部分文件都会被感染成病毒文件。


IOCs


vancityprinters.com
724hizmetgrup.com
vinasonthanh.com
affiliate.free.rongrean.com
amsamex.com
zanzoul.aya.com.sy
bbeakemegood24.com
chicostara.com
www.ceylanogullari.com
family-international.de
yavuztuncil.ya.funpic.de
pelcpawel.fm.interia.pl
www.liongrup.com
bazyar-arya.com
aocuoikhanhlinh.vn
ohne-steuer.de
cevatpasa.com
jrsx.jre.net.cn
reliancepublications.co.in
bem.dk
arthur.niria.biz
lpbmx.ru
banboon.com
ankara-cambalkon.net
dewpoint-eg.com
twilight-duo.com
www.bluecubecreatives.com
apple-pie.in
ahmediye.net
abpowqbvcfds677.info
www.unigas.mn
www.vancityprinters.com
kuplu.bel.tr



Clients


Count   Client          TAGS
108		111.160.182.10	NAT
20		117.9.152.25	NAT
13		60.27.193.240	NAT
12		125.36.117.141	NAT
8		60.29.43.82	    NAT
7		218.68.102.172	NAT
6		218.69.108.45	NAT
6		60.28.250.46	IDC
6		60.25.253.157	NAT
4		219.150.87.130	NAT
4		111.160.92.74	NAT
4		221.197.156.59	NAT
4		221.239.124.90	NAT
3		117.9.228.28	NAT
3		218.69.11.58	NAT
3		117.12.17.73	NAT
3		123.151.34.82	NAT
2		61.181.63.26	NAT
2		111.167.244.137	NAT
2		117.11.239.126	NAT
2		60.28.101.104	NAT
2		60.30.69.36	    NAT
1		117.12.197.138	NAT
1		218.68.6.194	NAT
1		117.15.191.13	NAT
1		61.181.63.138	NAT
1		111.163.145.187	NAT
1		111.33.56.2	NAT





Malware.dofloo


dofloo又名AES.DDOS，针对Linux设备，已经发现的变种主要感染运行x86和ARM CPU的设备。dofloo 支持SYN/TCP/UDP/DNS/HTTP等多种flood攻击。


IOCs


www.santananb.info



Clients


Count   Client          TAGS
1		60.30.172.82	NAT





Malware.artemis


artemis家族针对windows系统，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。


IOCs


lang12397007.3322.org
scrk.3322.org
rat2.100geili.com
liyongyong88.3322.org
fei9988.3322.org
doss456.3322.org
meihaoddos.3322.org
dingtao333.3322.org
rat3.100geili.com



Clients


Count   Client          TAGS
51		117.9.146.131	NAT
45		117.11.147.243	NAT
44		111.160.156.10	NAT
41		117.9.64.214	NAT
40		111.163.123.186	NAT
35		125.36.119.78	NAT
18		117.10.53.124	NAT
15		125.37.188.225	NAT
15		117.13.192.248	NAT
15		218.67.254.131	NAT
12		218.68.190.107	NAT
11		117.15.6.163	NAT
11		125.36.80.149	NAT
10		218.67.145.251	NAT
9		60.28.101.104	NAT
8		117.9.158.203	NAT
8		111.160.132.158	NAT
7		111.163.22.135	NAT
6		111.161.188.102	NAT
5		221.196.205.193	NAT
4		60.26.102.238	NAT
4		125.37.189.211	NAT
4		218.69.102.106	NAT
4		60.28.101.103	NAT
4		111.167.180.105	NAT
3		218.67.165.2	NAT
3		125.38.137.250	NAT
2		221.198.67.125	NAT
2		60.28.101.105	NAT
2		221.196.61.39	NAT
1		60.29.38.118	NAT
1		221.197.255.115	NAT
1		111.163.90.226	NAT
1		117.9.238.225	NAT
1		218.68.45.180	NAT
1		221.197.8.155	





Malware.unknown


一部分我们正在跟踪的明确恶意但未归类的汇总


IOCs


pccp.youdns17.com
lp.beahh.com
v.beahh.com
ii.ackng.com
healthdevicetracker.com
lp.haqo.net
suoye1.eatuo.com
oxy.imbceon.com
cake.pilutce.com
wqerveybrstyhcerveantbe.com
workforce.ignorelist.com
ghoost-souf.no-ip.org
down.wmwky.tw
www.santananb.info
doc.to0ls.com
jltx131.cc
booomaahuuoooapl.ru
hewle.kielsoservice.net
wys810302.f3322.net
www3.cedesunjerinkas.com
2.dfdf332.com
mdzz2019.noip.cn
spring.tulipnetworks.net
aj1732.online
ii.haqo.net
suoye1.f3322.net
nevernews.club
www2.cedesunjerinkas.com
lp.abbny.com
booomaahuuoooapl.in
yzzweb.f3322.net
almasoodgroup.com
maeobnaoefhgoajo.com
fiaoiaegiieogjjed.ru
5123.2288.org
api.dfdf332.com
3600hk.no-ip.org
i.haqo.net
eu.dspmulti.com
fget-career.com
www4.cedesunjerinkas.com
johnhop77.ddns.net
aroundtheworld123.net
twangzhan.website
srgsiuhedufiusfo.ru
iim.ackng.com
uaeihefiuaefhuhe.ru
9.zxzx776.com
xsdf3f.com
w.beahh.com
download.pofenglun.cn
mage.ignorelist.com
pall.ndypkh.com
down.qwpkk.tw
aeiziaezieidiebg.biz
zergbase.mooo.com
cnc.stresser.pw
aaaaaaaaaa.re67das.com



Clients


Count   Client          TAGS
1137	60.28.104.130	NAT
1020	60.30.186.26	NAT
988		117.12.96.213	NAT
718		218.68.105.24	NAT
596		60.28.47.90	    NAT
352		61.240.6.210	NAT
310		121.193.161.217	NAT
261		111.160.132.158	NAT
238		61.181.252.146	NAT
221		221.197.56.106	NAT
176		60.30.199.26	NAT
145		111.160.201.202	
133		60.29.153.61	NAT
86		60.30.149.10	NAT
79		125.36.152.117	NAT
77		117.12.134.159	NAT
55		218.69.234.252	NAT
39		221.197.29.110	NAT
38		218.67.233.191	NAT
37		117.11.225.137	NAT
36		111.165.96.157	NAT
34		61.181.108.2	NAT
33		111.162.219.197	NAT
32		60.28.156.216	
32		117.12.1.165	NAT
31		117.8.100.206	NAT
31		111.164.235.52	NAT
31		218.67.255.90	NAT
31		117.9.17.157	NAT
30		125.38.176.114	NAT
30		218.68.200.50	NAT
30		60.29.18.14	    NAT
30		117.131.173.16	NAT
30		221.197.12.90	NAT
29		218.68.190.43	NAT
29		180.213.5.10	NAT
27		60.29.37.38	    NAT
25		221.196.119.133	NAT
25		111.160.91.94	NAT
25		117.9.91.224	NAT
24		60.28.38.14	    NAT
24		111.164.235.232	NAT
23		60.30.130.126	NAT
20		111.30.30.18	NAT
20		221.197.94.180	NAT
19		60.29.64.22 	NAT
19		111.165.24.101	NAT
18		117.13.128.209	
18		125.37.182.24	NAT
17		117.11.147.153	NAT
16		60.28.101.104	NAT
16		111.164.20.30	NAT
15		60.30.4.11	
15		218.69.11.58	NAT
14		60.28.101.103	NAT
14		117.9.16.229	NAT
14		218.69.133.37	NAT
14		221.239.93.251	
13		60.29.133.19	NAT
13		60.29.208.115	
13		60.28.250.40	IDC
13		60.29.22.98	    NAT
12		60.28.108.21	NAT
12		117.9.18.246	NAT
12		218.69.90.46	NAT
12		60.25.11.13	    NAT
11		111.160.156.10	NAT
11		221.196.149.170	NAT
10		60.29.89.34	    NAT
10		60.29.70.132	
10		218.68.224.88	NAT
10		117.13.157.191	NAT
10		60.29.31.98	    NAT
10		60.24.140.80	NAT
10		221.238.238.234	NAT
10		60.29.90.230	NAT
9		60.30.164.26	NAT
9		60.25.251.11	NAT
9		218.68.158.40	NAT
9		60.26.101.13	NAT
8		111.160.87.122	NAT
8		218.68.107.240	NAT
8		218.68.233.132	NAT
8		111.164.183.91	NAT
8		221.197.139.99	NAT
8		221.197.122.193	NAT
7		60.30.105.50	NAT
7		117.9.93.13	    NAT
7		117.11.218.223	NAT
7		61.181.143.34	NAT
7		60.28.41.18	    NAT
7		60.24.189.172	NAT
7		218.68.5.141	NAT
7		221.196.108.115	NAT
7		61.181.70.210	NAT
7		111.30.35.142	NAT
6		60.28.101.105	NAT
6		221.198.66.44	NAT
6		111.162.212.244	NAT
6		111.160.233.182	NAT
6		60.24.143.117	NAT
6		117.9.90.145	NAT
6		103.233.5.254	NAT
6		218.69.129.222	NAT
6		221.196.180.62	NAT
6		125.38.176.178	NAT
6		60.26.225.158	NAT
6		60.27.31.62	    NAT
6		218.68.234.159	NAT
6		117.11.153.212	NAT
5		60.30.208.226	NAT
5		125.36.153.16	NAT
5		111.162.149.78	NAT
5		111.163.158.181	NAT
5		218.69.226.106	NAT
5		60.27.79.149	NAT
5		221.198.170.164	NAT
5		211.94.243.185	NAT
5		117.9.18.2	    NAT
5		106.47.29.70	NAT
5		125.37.29.120	NAT
5		60.29.145.254	NAT
5		218.68.0.6	    NAT
5		117.10.62.226	NAT
5		117.12.202.189	NAT
5		111.160.246.140	NAT
5		61.181.74.42	NAT
5		218.69.55.166	NAT
5		218.69.54.167	NAT
5		218.68.6.50	    NAT
5		117.13.115.123	NAT
4		211.94.254.85	NAT
4		60.24.90.226	NAT
4		60.26.4.19	    NAT
4		60.28.101.106	NAT
4		221.198.238.209	NAT
4		111.166.237.230	NAT
4		125.36.255.122	NAT
4		218.68.105.7	NAT
4		117.9.237.225	NAT
4		61.181.103.138	NAT
4		218.68.229.81	NAT
4		61.181.140.42	NAT
4		218.69.6.74	    NAT
4		111.160.120.54	NAT
4		60.29.93.221	NAT
4		218.69.91.84	
4		125.37.29.23	NAT
4		60.24.184.70	NAT
4		221.196.46.61	NAT
4		117.14.119.35	NAT
4		60.26.203.160	NAT
4		111.163.123.7	NAT
4		111.161.158.131	NAT
4		111.33.17.70	NAT
4		111.160.230.18	NAT
4		60.27.31.0	    NAT
4		117.12.37.223	NAT
4		117.15.93.189	NAT
4		117.10.124.4	NAT
4		60.24.233.164	NAT
4		60.28.84.197	NAT
4		218.68.200.243	NAT
4		218.68.219.29	NAT
4		221.198.86.145	NAT
4		218.69.18.147	NAT
4		111.164.233.130	NAT
4		111.163.143.228	NAT
4		60.25.148.35	NAT
4		117.15.125.181	NAT
4		218.67.234.60	NAT
4		125.38.176.229	NAT
4		60.30.92.74	    NAT
4		117.11.10.12	NAT
4		111.160.91.250	NAT
3		60.24.45.218	NAT
3		60.29.154.226	NAT
3		111.163.144.224	NAT
3		111.161.150.34	NAT
3		111.160.166.58	NAT
3		111.162.163.231	NAT
3		125.37.182.99	NAT
3		60.29.16.94	    NAT
3		111.163.120.92	NAT
3		221.198.67.88	NAT
3		117.15.192.231	NAT
3		117.10.138.46	NAT
3		218.69.95.90	NAT
3		60.27.60.159	NAT
3		117.13.168.162	NAT
3		117.13.106.191	NAT
3		60.29.15.2	    NAT
3		111.165.11.60	NAT
3		60.30.193.162	NAT
3		60.29.43.46	    NAT
3		117.12.146.72	NAT
3		43.249.136.20	NAT
3		111.165.188.122	NAT
3		221.196.152.151	NAT
3		111.163.144.67	NAT
3		60.26.142.193	NAT
3		60.29.63.18	    NAT
3		111.160.80.3	NAT
3		117.13.140.5	NAT
3		117.10.236.245	NAT
3		211.94.243.121	NAT
3		111.165.105.247	NAT
3		61.181.219.120	NAT
3		123.151.34.82	NAT
3		111.166.238.248	NAT
3		202.99.106.47	NAT
3		221.197.179.98	NAT
3		211.94.226.74	NAT
3		60.26.239.60	NAT
3		117.9.191.22	NAT
3		117.14.66.156	NAT
3		61.181.202.5	
3		218.69.78.253	NAT
3		218.69.52.252	NAT
3		221.196.97.11	NAT
3		218.67.181.124	NAT
2		221.196.194.253	NAT
2		218.68.102.247	NAT
2		111.165.128.30	NAT
2		60.26.132.173	NAT
2		125.35.249.1	NAT
2		221.197.139.235	NAT
2		117.15.22.130	NAT
2		60.29.179.114	NAT
2		221.198.80.189	
2		111.162.216.127	NAT
2		221.197.54.42	NAT
2		221.197.97.39	NAT
2		117.13.244.21	NAT
2		111.160.198.83	NAT
2		103.233.6.2	
2		60.27.189.44	NAT
2		111.160.166.189	NAT
2		125.36.59.125	NAT
2		211.94.248.28	NAT
2		218.69.55.247	NAT
2		111.160.166.206	NAT
2		125.36.101.224	NAT
2		111.165.56.53	NAT
2		61.181.65.154	NAT
2		61.181.109.234	NAT
2		117.9.199.42	NAT
2		221.197.133.137	NAT
2		218.68.102.58	NAT
2		125.37.217.118	NAT
2		221.196.97.36	NAT
2		61.181.103.46	NAT
2		60.27.119.49	
2		117.12.133.191	NAT
2		221.198.64.35	NAT
2		125.37.191.155	NAT
2		221.198.60.201	NAT
2		111.162.147.134	NAT
2		60.25.179.50	NAT
2		61.181.63.138	NAT
2		60.24.127.98	NAT
2		61.181.24.234	NAT
2		125.37.212.67	NAT
2		111.167.149.238	NAT
2		221.197.154.147	NAT
2		117.10.28.225	NAT
2		60.30.149.102	NAT
2		60.30.105.33	NAT
2		111.160.97.18	NAT
2		125.37.202.10	NAT
2		117.9.18.201	NAT
2		117.14.151.96	NAT
2		60.30.156.190	NAT
2		111.167.17.208	NAT
2		117.15.90.239	NAT
2		111.162.151.214	NAT
2		111.162.154.253	NAT
2		61.181.49.105	NAT
2		218.68.224.39	NAT
2		60.27.138.17	NAT
2		117.9.70.23	    NAT
2		221.196.180.242	NAT
2		117.12.125.160	NAT
2		111.162.157.177	
2		218.68.107.108	NAT
2		218.69.129.94	NAT
2		111.167.46.70	NAT
2		117.15.90.205	NAT
2		103.233.4.26	NAT
1		60.24.89.15	    NAT
1		218.69.55.60	NAT
1		117.11.239.56	NAT
1		111.163.140.152	NAT
1		111.160.108.34	NAT
1		60.29.140.66	NAT
1		202.99.69.243	
1		221.196.194.2	NAT
1		60.27.42.62	    NAT
1		60.24.188.12	NAT
1		117.8.101.63	NAT
1		218.69.147.133	NAT
1		111.163.22.227	NAT
1		111.160.118.230	NAT
1		111.167.144.199	NAT
1		60.29.154.210	NAT
1		221.196.227.20	NAT
1		60.28.38.18	    NAT
1		60.29.77.203	NAT
1		60.29.153.45	NAT
1		125.38.191.184	NAT
1		221.198.236.232	NAT
1		60.25.10.147	NAT
1		111.164.209.21	NAT
1		218.67.254.17	NAT
1		60.30.180.150	NAT
1		111.160.70.203	NAT
1		111.160.70.201	NAT
1		60.29.116.18	NAT
1		60.30.215.242	NAT
1		111.162.152.192	NAT
1		60.29.95.82	    NAT
1		111.160.166.186	NAT
1		117.9.229.148	NAT
1		61.181.60.34	NAT
1		221.198.118.158	NAT
1		60.28.135.3	    NAT
1		60.25.63.52	    NAT
1		111.160.97.42	NAT
1		117.12.144.7	NAT
1		111.162.221.168	NAT
1		221.198.110.209	NAT
1		61.181.83.10	NAT
1		221.197.84.199	NAT
1		60.29.179.42	NAT
1		60.29.77.194	NAT
1		60.27.174.82	NAT
1		111.166.156.237	NAT
1		60.29.30.190	NAT
1		117.12.133.124	NAT
1		117.13.140.144	NAT
1		218.69.243.164	NAT
1		218.69.11.110	NAT
1		111.165.133.156	NAT
1		111.162.163.241	NAT
1		221.197.252.248	NAT
1		60.28.250.46	IDC
1		60.27.133.165	NAT
1		111.167.211.108	NAT
1		111.160.70.204	NAT
1		60.30.240.226	NAT
1		221.197.29.195	NAT
1		125.36.145.207	NAT
1		60.27.79.17	    NAT
1		125.37.125.3	NAT
1		60.30.172.82	NAT
1		117.131.145.156	NAT
1		111.30.85.18	NAT
1		221.198.218.112	NAT
1		117.14.13.25	NAT
1		117.14.70.156	NAT
1		111.163.143.193	NAT
1		111.160.216.87	NAT
1		60.28.101.126	NAT
1		60.29.185.242	NAT
1		111.163.78.80	NAT
1		125.37.182.185	NAT
1		117.15.191.57	NAT
1		111.160.104.66	NAT
1		221.197.162.54	NAT
1		211.94.242.118	NAT
1		125.37.162.103	NAT
1		117.8.100.70	NAT
1		117.15.214.65	NAT
1		125.38.177.138	NAT
1		60.30.204.26	NAT
1		60.27.205.187	NAT
1		117.12.158.82	NAT
1		60.26.180.205	NAT
1		111.165.72.25	NAT
1		61.181.125.37	NAT
1		60.29.0.101	    NAT
1		60.25.16.184	NAT
1		111.30.78.46	NAT
1		111.160.40.106	NAT
1		117.15.138.221	NAT
1		111.161.189.215	NAT
1		111.160.80.250	NAT
1		103.233.4.29	NAT
1		221.239.72.170	NAT





Malware.bondat


利用受害机器资源 进行门罗币挖矿，并组建一个攻击WordPress站点的僵尸网络。


IOCs


urchintelemetry.com



Clients


Count   Client          TAGS
8		117.9.92.217	NAT
2		60.30.105.33	NAT
2		61.181.88.218	NAT





Malware.storm


针对Windows平台的DDoS类型的botnet家族。


IOCs


www.mojimojimojimoji.com
www.ody.cc
imddos.my03.com



Clients


Count   Client          TAGS
432		125.36.152.117	NAT
425		111.160.156.10	NAT
315		61.181.252.146	NAT
34		111.160.182.10	NAT
19		111.160.132.158	NAT
11		218.68.105.191	NAT
10		117.15.53.253	NAT
8		218.68.228.63	NAT
8		60.27.104.153	NAT
7		117.13.140.144	NAT
5		61.181.125.37	NAT
5		60.28.101.104	NAT
4		221.198.64.35	NAT
3		111.163.12.68	NAT
2		117.11.239.138	NAT
2		111.164.47.25	
2		125.37.162.103	NAT
2		117.9.90.137	NAT
1		111.162.102.7	NAT
1		60.24.244.41	NAT
1		61.240.5.226	NAT
1		111.162.12.44	NAT





Malware.Morto


一款蠕虫病毒，通过爆破内网、外网主机的RDP密码，登陆到受害主机，进行自我复制并运行，来实现病毒的传播。


IOCs


ms.jifr.net
ms.jifr.co.cc
ms.jifr.co.be
dos1.jifr.net
ms.jifr.info
flt1.jifr.net



Clients


Count   Client          TAGS
506		218.69.16.26	NAT
241		60.29.174.70	NAT
219		60.29.173.226	NAT
194		60.24.189.11	NAT
162		60.30.57.29	    NAT
106		111.164.41.211	NAT
75		117.131.175.138	NAT
69		111.160.186.146	NAT
45		218.68.156.51	NAT
27		125.36.228.182	NAT
20		125.36.228.187	NAT
16		125.36.228.184	NAT





Malware.Mylobot


mylobot是针对Windows的malware，属于downloader类型，用于在感染机器上下载和安装其它的malware。


IOCs


m16.pseyumd.ru
m11.pseyumd.ru
m25.oxduwil.com
m20.oxduwil.com
m0.fnjxpwy.com
m32.oqemwbj.in
v2.otwzgnl.ru
m0.zqfqjwd.biz
m34.oxduwil.com
m34.oqemwbj.in
m28.oqemwbj.in
m16.oqemwbj.in
v2.baidupic.net



Clients


Count   Client          TAGS
12		60.28.101.104	NAT
4		60.28.101.103	NAT
2		60.25.16.92	    NAT
1		117.11.239.72	NAT
1		60.28.101.105	NAT






未知恶意


基于360安全大脑的云端数据，我们DNSMon系统会实时监测各种未知的恶意和高度可疑的域名，包括各种未知APT和Botnet等等，这些被归为 DNSMon.gray 以及 DNSMon.black 类别。


由于客户端数据太大，且具体的恶意行为需要其他维度数据关联分析，在此暂时不展开。

{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"\n# 天津DNS数据安全分析报告\n\n<br/>\n\n> ###### 版本：tj-sec.01\n> ###### 时间：2019-06-17\n> ###### 作者：360网络安全研究院 & 360CERT\n\n<br/>\n\n\n## 摘要\n\n* 采集了 2019-06-09 日 10 点数据，共计 33650792 条DNS日志\n* 排除掉DNS解析服务器日志，共计 19190292 条客户端请求DNS日志\n* 其中黑域名请求共计 99095 条，占总请求的 0.516%\n* 去重后域名共计 725093 个，其中黑域名共计 4424 个，占比 0.61%\n* 恶意类型覆盖 6 个APT组织的活动，以及40个僵尸网络/远控/后门/木马等恶意软件家族\n\n---\n\n\n## 整体分布\n\n\n字段说明：\n* TAG 是我们为恶意域名归类的标记，比如“APT.turla”表明是APT组织turla，“Malware.driverlife”表明是恶意软件家族“驱动人生”等等\n* DNS_Records_Count 是对应类别恶意域名在所有DNS请求中的请求数\n* Unique_Clients 是对应类别恶意域名的去重客户端个数\n* Unique_Domains 是对应恶意类别中在数据中出现过的去重恶意域名数\n* Infos 针对某些类别的额外解释说明\n\n<br/>\n\n<font size=\"0.6\">\n\nTAG|DNS_Records_Count|Unique_Clients|Unique_Domains|Infos\n---|---|---|---|---\nDNSMon.gray|22331|2629|926|DNSMon自动发现的高度可疑恶意域名\nMalware.miner|11898|193|62|所有的挖矿恶意软件都归为该类，不再细分\nMalware.driverlife|10397|86|22|\nBlackHit.vt|9779|257|84|\nMalware.unknown|9587|410|58|正在持续跟踪的一批暂未归类恶意软件\nMalware.mykings|5613|45|13|\nDNSMon.black|3734|178|48|DNSMon自动发现的确定恶意域名\nAPT.turla|3620|2|15|\nMalware.Morto|3397|14|6|\nDGA.conficker|2760|41|224|\nMalware.xorddos|2415|9|14|\nMalware.nitol|2248|20|11|\nMalware.2gun|2049|349|26|\nMalware.ramnit|1985|246|7|\nMalware.nadrac|1416|16|5|\nMalware.mirai|1404|4|4|\nMalware.elknot|1325|5|3|\nMalware.storm|1301|23|3|\nMalware.gh0st|1066|17|11|\nMalware.zombieboy|472|3|2|\nMalware.artemis|445|37|9|\nWebSafe.coinhive|299|1|1|\nMalware.zusy|298|1|286|\nMalware.darkshell|297|3|1|\nMalware.sality|246|30|33|\nMalware.wannycry|221|5|2|\nMalware.NuggetPhantom|174|26|6|\nMalware.remcos|150|1|1|\nMalware.wannacry|122|8|2|\nMalware.DUNIHi|107|1|1|\nAPT.irontiger|98|1|2|\nBlackHit.nd|79|19|3|\nAPT.unclassified|76|38|1|\nDGA.hardcoded_fake_dga|72|31|30|\nMalware.dbnt|44|18|2|\nMalware.dsl|32|1|1|\nMalware.Mylobot|20|5|13|\nWebSafe.ad_flush|16|14|3|\nMalware.bondat|12|3|1|\nMalware.posioncake|11|4|2|\nMalware.Dorkbot|9|1|4|\nAPT.bitter|8|1|4|\nDGA.popad|8|6|3|\nAPT.oceanlotus|7|1|4|\nMalware.barhera|6|2|3|\nMalware.irc3|4|1|2|\nAPT.menupass|4|1|1|\nMalware.dy2004|2|1|1|\nMalware.loki|1|1|1|\nMalware.rcshark|1|1|1|\nMalware.humpler|1|1|1|\nMalware.flyboy|1|1|1|\nMalware.woring|1|1|1|\nMalware.dofloo|1|1|1|\n\n</font>\n\n\n---\n\n## 分类描述\n\n由于恶意类型比较多且繁杂，分类描述中只汇总了 APT 类 和 Malware 类危害较大的类别。\n\n\"IOCs\" 列出在数据中出现过的对应类别的恶意域名，“Clients”是数据中出现过的访问了恶意域名的客户端IP，按照访问次数从大到小排列，访问次数越多，可以认为是该IP后面对应的恶意软件越活跃。客户端IP有可能是机构/宽带出口IP，会标记类别 NAT，有可能是机房IP，会标记类别IDC。\n\n有些访问可能是安全研究人员的测试性访问，这需要具体IP的归属来判断，通过当前数据不能区分，如果后续追溯，需要注意。\n\n\n### APT 类\n\n当前一小时采样数据中，共发现6个公开的APT组织的活动迹象，共涉及失陷客户端XXX个，其中可能是政府单位的YYY个，需要高度关注。\n\n\n#### APT.bitter\n\n蔓灵花（T-APT-17、BITTER）APT组织是一个长期针对中国、巴基斯坦等国家进行攻击活动的APT组织，该APT组织为目前活跃的针对境内目标进行攻击的境外APT组织之一。该组织主要针对政府、军工业、电力、核等单位进行攻击，窃取敏感资料，具有强烈的政治背景。该组织最早在2016由美国安全公司Forcepoint进行了披露，并且命名为“BITTER”。\n\n该组织主要采用鱼叉钓鱼的方式，对相关目标单位的个人直接发送嵌入了攻击诱饵的钓鱼邮件。此外，为了提高成功率，也会先对目标发送安全提示相关的钓鱼邮件，诱使被钓鱼用户修改邮件账户密码，从而获取用户的邮箱密码，而后再用被控制的邮箱继续对企业内的其他人进行嵌入攻击诱饵的钓鱼邮件。\n\n详细报告参见 [https://www.freebuf.com/articles/database/192726.html ](https://www.freebuf.com/articles/database/192726.html)\n\n##### IOCs\n\n```\nhewle.kielsoservice.net\nspring.tulipnetworks.net\naroundtheworld123.net\nthepandaservices.nsiagenthoster.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n8\t    60.29.208.115\t\n```\n\n\n</br>\n\n\n#### APT.irontiger\n\n铁虎（Iron Tiger）APT行动背后的“熊猫使者”APT组织，被怀疑（必须）是天朝的一个黑客组织，他们专门以政府和相关领域的技术部门作为其主要的攻击目标，并尝试从这些组织和机构中监视和窃取高价值的数据。\n\n该恶意软件的主要攻击目标是亚洲和美国的政府组织、科技公司、教育和通信企业等。最早的攻击是从附有恶意VBS文件的垃圾邮件开始的，VBS文件的作用是从分布式服务器下载恶意payload的下载器。\n\n详细报告参见[https://zhuanlan.zhihu.com/p/33636123](https://zhuanlan.zhihu.com/p/33636123)\n\n##### IOCs\n\n```\ndll.pzchao.com\nzll855.gicp.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n98\t    60.28.230.130\tNAT\n```\n\n\n</br>\n\n\n\n#### APT.unclassified\n\n\n详细报告参见 [https://www.anquanke.com/post/id/167077](https://www.anquanke.com/post/id/167077)，\n[http://www.mottoin.com/detail/3398.html](http://www.mottoin.com/detail/3398.html)\n\n\n##### IOCs\n\n```\nftp.byethost10.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n10\t    117.13.67.150\tNAT\n3\t    218.69.72.38\tNAT\n2\t    218.68.156.153\tNAT\n2\t    218.68.62.28\tNAT\n2\t    218.67.252.149\tNAT\n2\t    218.69.6.74\t    NAT\n2\t    117.13.3.103\tNAT\n1   \t221.196.149.170\tNAT\n1   \t60.24.88.214\tNAT\n1   \t60.30.254.92\tNAT\n1   \t125.37.184.21\tNAT\n1   \t125.36.33.16\tNAT\n1   \t111.165.222.113\tNAT\n1   \t60.27.152.188\tNAT\n1   \t221.197.154.8\tNAT\n1   \t60.24.142.12\tNAT\n1   \t60.26.72.241\tNAT\n1   \t111.163.144.208\tNAT\n1   \t111.33.50.98\tNAT\n1   \t111.160.43.14\tNAT\n1   \t117.15.191.151\tNAT\n1   \t111.162.212.244\tNAT\n1   \t117.11.117.145\tNAT\n1   \t117.10.138.132\tNAT\n1   \t60.27.193.224\tNAT\n1   \t117.13.192.197\tNAT\n1   \t117.14.147.119\tNAT\n1   \t218.68.148.99\tNAT\n1   \t125.36.107.131\tNAT\n1   \t111.164.215.206\tNAT\n1   \t211.94.237.146\tNAT\n1   \t111.167.9.209\tNAT\n1   \t117.15.190.49\tNAT\n1   \t218.68.108.222\tNAT\n```\n\n\n\n</br>\n\n\n\n#### APT.menupass\n\n详细报告参见 [https://zhuanlan.zhihu.com/p/52960249](https://zhuanlan.zhihu.com/p/52960249)\n\n\n##### IOCs\n\n```\ncia.toh.info\n```\n\n##### Clients\n```\nCount   Client          TAGS\n4\t    117.14.156.22\tNAT\n```\n\n\n</br>\n\n\n\n#### APT.turla\n\n90年代著名网络间谍组织“月光迷宫”（Moonlight Maze）已经演变成了今天的Turla APT，它们都具有或多或少相同的技术手段，且共同背景就是：与俄罗斯政府黑客相关。\n以中国和美国等地的政府、军事、大使馆、研究和制药组职为入侵目标，之前也制作过Linux 木马。据说他们是受到俄罗斯政府支持。虽然他们会有行动，但执法机关一直没法知道他们所在何方，因为他们善于隐藏自己。\n\n在网络入侵活动中，黑客一般会利用中转或跳板机作为攻击代理，防止溯源调查，而“月光迷宫”入侵者也是最早采用该技术的攻击者。他们利用很多国家的一系列大学、图书馆等存在系统漏洞的机构电脑作为中转跳板，存储攻击工具，发起网络攻击，以此迷惑调查行为。\n\n详细报告参见 [https://blog.csdn.net/DJY1992/article/details/88994695](https://blog.csdn.net/DJY1992/article/details/88994695)\n\n##### IOCs\n\n```\nmusic-world.servemp3.com\nforum.sytes.net\ntiger.got-game.org\nx-files.zapto.org\nhealth-everyday.faqserv.com\nfifa-rules.25u.com\nweather-online.hopto.org\nhockey-news.servehttp.com\nolympik-blog.4dq.com\ntop-facts.sytes.net\nsupernews.sytes.net\ncars-online.zapto.org\nnhl-blog.servegame.com\nmarketplace.servehttp.com\nnewutils.3utilities.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n3495\t218.69.186.173\tNAT\n125\t    218.69.133.129\tNAT\n```\n\n\n</br>\n\n\n\n#### APT.oceanlotus\n\n海莲花（OceanLotus）也叫APT32或APT-C-00，是一个长期针对中国及其他东亚国家（地区）政府、科研机构、海运企业等领域进行攻击的APT组织。\n\n海莲花的攻击途径为使用木马病毒攻陷、控制政府人员、外包商及行业专家等目标人群的计算机，从中窃取受害者计算机中的机密数据，截获受害计算机与外界传递的情报，甚至操纵该计算机自动发送相关情报。而这一攻击方式有“ 鱼叉攻击 ”和“ 水坑攻击 ”两种。\n\n详细报告参见 [https://zh.wikipedia.org/zh/%E6%B5%B7%E8%8E%B2%E8%8A%B1](https://zh.wikipedia.org/zh/%E6%B5%B7%E8%8E%B2%E8%8A%B1)\n\n##### IOCs\n\n```\ndominikmagoffin.com\ncheck.homeip.net\ncortana.homelinux.com\nhk.cnnewspapers.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n7\t    60.29.208.115\t\n```\n\n\n</br>\n\n---\n\n### Malware 类\n\n\n#### Malware.mykings\n\nMyKings 是一个由多个子僵尸网络构成的多重僵尸网络，2017 年 4 月底以来，该僵尸网络一直积极地扫描互联网上 1433 及其他多个端口，并在渗透进入受害者主机后传播包括 DDoS、Proxy、RAT、Miner 在内的多种不同用途的恶意代码。\n\n详细报告参见：__GHOST_URL__/mykings-the-botnet-behind-multiple-active-spreading-botnets/\n\n\n##### IOCs\n\n```\nwmi.mykings.top\nloop2.haqo.net\nloop.haqo.net\np.abbny.com\nlpp.beahh.com\no.beahh.com\nlplp.beahh.com\njs.f4321y.com\noo.beahh.com\npp.abbny.com\nloop.abbny.com\ndown.f4321y.com\ndown.b591.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1670\t60.28.104.130\tNAT\n1193\t218.68.105.24\tNAT\n951\t\t60.28.47.90\tNAT\n726\t\t60.30.186.26\tNAT\n434\t\t218.69.112.141\tNAT\n300\t\t221.239.96.146\tNAT\n100\t\t61.181.103.46\tNAT\n48\t\t111.160.80.250\tNAT\n22\t\t221.238.238.234\tNAT\n16\t\t61.181.70.210\tNAT\n12\t\t123.151.34.82\tNAT\n8\t\t117.12.96.213\tNAT\n8\t\t180.213.6.237\tNAT\n8\t\t60.28.101.104\tNAT\n7\t\t111.160.40.106\tNAT\n6\t\t60.25.251.11\tNAT\n6\t\t60.29.153.61\tNAT\n6\t\t60.26.80.98\tNAT\n6\t\t218.68.5.141\tNAT\n6\t\t60.30.149.102\tNAT\n6\t\t111.163.120.92\tNAT\n4\t\t111.160.230.18\tNAT\n4\t\t61.181.49.105\tNAT\n4\t\t60.28.101.103\tNAT\n4\t\t111.30.26.21\tNAT\n4\t\t218.69.11.110\tNAT\n4\t\t60.29.90.230\tNAT\n4\t\t111.160.166.58\tNAT\n3\t\t111.163.145.128\tNAT\n2\t\t61.181.49.102\tNAT\n2\t\t111.30.31.137\t\n2\t\t111.165.4.199\tNAT\n2\t\t61.181.60.34\tNAT\n2\t\t61.181.49.104\tNAT\n2\t\t218.68.6.50\tNAT\n2\t\t60.28.101.106\tNAT\n1\t\t117.11.14.62\tNAT\n1\t\t60.24.90.130\tNAT\n1\t\t111.163.45.102\tNAT\n1\t\t111.160.56.130\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.driverlife\n\n“驱动人生”旗下多款软件携带后门病毒DTStealer，仅半天时间感染了数万台电脑。该病毒进入电脑后，继续通过“永恒之蓝”高危漏洞进行全网传播（特别是政企单位局域网），并回传被感染电脑的IP地址、CPU型号等信息。\n\n\n##### IOCs\n\n```\nlplp.haqo.net\nv.beahh.com\np.awcna.com\np.zer2.com\nlpp.ackng.com\np.amxny.com\noo.beahh.com\nlpp.zer2.com\ndown.ackng.com\nv.bddp.net\nt.awcna.com\nlplp.beahh.com\nt.zer2.com\npp.abbny.com\nlplp.abbny.com\nlpp.awcna.com\noom.beahh.com\ndown.bddp.net\nlpp.haqo.net\nt.amxny.com\nppm.abbny.com\nv.y6h.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1564\t\t221.239.96.146\tNAT\n1486\t\t218.69.112.141\tNAT\n1458\t\t60.30.186.26\tNAT\n1324\t\t60.28.104.130\tNAT\n956\t\t218.68.105.24\tNAT\n786\t\t60.28.47.90\tNAT\n408\t\t61.181.65.154\tNAT\n326\t\t61.181.103.46\tNAT\n188\t\t111.160.80.250\tNAT\n168\t\t111.164.183.26\tNAT\n156\t\t111.164.175.157\tNAT\n156\t\t221.238.238.234\tNAT\n134\t\t111.160.167.194\tNAT\n78\t\t60.28.101.104\tNAT\n74\t\t111.160.231.178\tNAT\n72\t\t111.164.183.91\tNAT\n61\t\t218.68.5.141\tNAT\n55\t\t61.181.70.210\tNAT\n52\t\t60.28.101.103\tNAT\n50\t\t60.25.251.11\tNAT\n49\t\t60.28.101.105\tNAT\n46\t\t218.68.102.37\tNAT\n42\t\t221.197.55.168\tNAT\n36\t\t111.160.97.18\tNAT\n36\t\t60.28.108.201\tNAT\n24\t\t60.26.80.98\tNAT\n24\t\t123.150.44.3\tNAT\n24\t\t125.36.59.125\tNAT\n20\t\t60.28.41.18\tNAT\n18\t\t61.181.60.34\tNAT\n16\t\t111.160.166.58\tNAT\n16\t\t60.29.153.61\tNAT\n14\t\t221.196.67.188\tNAT\n14\t\t60.29.153.45\tNAT\n12\t\t123.151.34.82\tNAT\n12\t\t60.28.108.21\tNAT\n12\t\t123.150.44.11\tNAT\n10\t\t60.28.101.74\tNAT\n10\t\t218.68.0.210\tNAT\n10\t\t111.160.70.46\tNAT\n8\t\t123.150.44.5\tNAT\n8\t\t117.12.96.213\tNAT\n8\t\t180.213.6.237\tNAT\n8\t\t60.28.101.106\tNAT\n8\t\t111.165.4.199\tNAT\n8\t\t61.181.252.146\tNAT\n8\t\t221.197.66.60\tNAT\n8\t\t60.29.145.254\tNAT\n6\t\t61.181.49.105\tNAT\n6\t\t111.30.78.46\tNAT\n6\t\t111.160.172.18\tNAT\n6\t\t111.30.101.238\tNAT\n6\t\t218.69.11.174\tNAT\n6\t\t117.9.199.42\tNAT\n6\t\t111.163.120.92\tNAT\n4\t\t111.160.212.19\tNAT\n4\t\t218.69.11.110\tNAT\n4\t\t111.160.230.18\tNAT\n4\t\t60.29.90.230\tNAT\n4\t\t60.29.241.4\tNAT;IDC\n4\t\t125.35.214.114\tNAT\n4\t\t111.30.35.142\tNAT\n4\t\t111.160.40.106\tNAT\n4\t\t60.30.149.102\tNAT\n2\t\t111.30.31.137\t\n2\t\t123.150.44.9\tNAT\n2\t\t218.69.129.94\tNAT\n2\t\t60.29.241.1\tNAT;IDC\n2\t\t60.28.101.102\tNAT\n2\t\t117.9.18.201\tNAT\n2\t\t61.181.49.102\tNAT\n2\t\t61.181.49.104\tNAT\n2\t\t60.27.119.49\t\n2\t\t218.68.6.50\tNAT\n2\t\t60.29.158.138\tNAT\n2\t\t123.151.196.187\tNAT\n2\t\t117.9.121.135\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.dbnt\n\n一款用于网吧客户机系统维护的软件，同时也是一个win恶意软件下载器，可以下载各种恶意软件，用于流量劫持等恶意行为。\n\n##### IOCs\n\n```\nwj.center.oldlist.info\necount.2019cn.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n6\t\t61.181.61.82\tNAT\n6\t\t60.28.130.170\tNAT\n6\t\t60.30.67.234\tNAT\n4\t\t60.28.38.18\tNAT\n3\t\t60.30.111.99\tNAT\n3\t\t111.160.91.94\tNAT\n2\t\t125.37.20.209\tNAT\n2\t\t117.8.246.134\tNAT\n2\t\t117.13.157.191\tNAT\n2\t\t111.164.179.188\tNAT\n1\t\t60.25.31.73\tNAT\n1\t\t111.164.20.60\tNAT\n1\t\t60.26.240.155\tNAT\n1\t\t111.162.55.162\tNAT\n1\t\t111.164.175.4\tNAT\n1\t\t125.37.20.206\tNAT\n1\t\t61.181.111.18\tNAT\n1\t\t221.197.54.42\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.irc\n\n\n基于IRC协议的家族统称，包括Windows和Linux两种平台。基于IRC的典型家族有dstd和tsunami，但并非使用了IRC就一定是恶意的。 irc允许私有扩展，所以上线包会有不同的字段和换行格式，我们这里初步的细分为irc1/2/3.\n\n\n##### IOCs\n\n```\nn.ezjhyxxbf.ru\nn.vbemnggcj.ru\n```\n\n##### Clients\n```\nCount   Client          TAGS\n4\t\t111.161.200.159\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.remcos\n\n通过钓鱼邮件传播的远控，可在被感染的系统执行键盘记录，远程截屏，文件管理，命令执行等多个功能。\n\n\n##### IOCs\n\n```\nmaxeuro.ddns.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n150\t\t111.163.141.154\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.xorddos\n\n该家族针对Linux设备，用于DDoS攻击。因为样本内的配置信息和C2通信均使用了一个自定义的XOR加密算法，故得名XOR.DDOS。该家族支持syn/dns/tcp等flood攻击。\n\n\n##### IOCs\n\n```\naaa.xxxatat456.com\np6.2018fly.com\np11.2018fly.com\na381422.f3322.net\nwww1.gggatat456.com\naaa.gggatat456.com\nppp.xxxatat456.com\naaaaaaaaaa.re67das.com\ngh.dsaj2a1.org\nk1.2018fly.com\nb12.xxxatat456.com\nppp.gggatat456.com\np12.2018fly.com\nb12.gggatat456.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n577\t\t60.29.208.112\t\n461\t\t125.39.151.184\t\n452\t\t125.39.71.19\t\n211\t\t124.68.10.20\t\n145\t\t111.160.201.202\t\n144\t\t60.28.54.30\tNAT\n116\t\t61.181.59.88\t\n2\t\t60.29.141.95\t\n```\n\n\n</br>\n\n\n\n#### Malware.NuggetPhantom\n\n模块化恶意工具集“NuggetPhantom（掘金幽灵）”最早出现于2016年底，其曾在2016年底的“天翼校园客户端蓝屏事件”以及2017年底的“天翼校园客户端挖矿程序事件”中有所行动。攻击者获知用户计算机存在EternalBlue漏洞后，利用该漏洞向用户计算机发送Eternal_Blue_Payload载荷，该载荷及其所释放的各模块皆通过访问下载服务器来获取加密后的各用途模块文件，并在内存中动态解密这些模块代码，执行模块对应的恶意功能。\n\n##### IOCs\n\n```\nnew.szyfpga.com\ndeg.szyfpg.com\nbuy.szyfpg.com\ncpu.szyfpg.com\nnew.szyfpg.com\ndeg.szyfpga.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n57\t\t60.29.64.22\tNAT\n18\t\t60.24.251.190\tNAT\n15\t\t117.11.121.200\tNAT\n15\t\t111.162.220.212\tNAT\n12\t\t111.162.217.67\tNAT\n8\t\t117.11.144.69\tNAT\n8\t\t111.162.216.179\tNAT\n7\t\t60.29.148.146\tNAT\n5\t\t218.67.167.157\tNAT\n5\t\t218.68.24.157\tNAT\n4\t\t117.15.28.197\tNAT\n3\t\t211.94.237.161\tNAT\n3\t\t60.24.248.46\tNAT\n2\t\t117.12.37.38\tNAT\n1\t\t60.24.34.84\tNAT\n1\t\t60.27.137.164\tNAT\n1\t\t111.162.219.177\tNAT\n1\t\t111.160.119.194\tNAT\n1\t\t60.27.152.186\tNAT\n1\t\t218.67.199.206\tNAT\n1\t\t60.26.234.195\tNAT\n1\t\t218.67.233.167\tNAT\n1\t\t218.67.186.15\tNAT\n1\t\t218.69.42.199\tNAT\n1\t\t60.27.191.194\tNAT\n1\t\t218.69.156.136\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.2gun\n\n\n涉及业务种类繁杂，除了传播双枪木马的恶意驱动程序，还传播游戏私服驱动，还会盗窃 Steam 账号、劫持 QQ 进行恶意推广\n\n\n##### IOCs\n\n```\nua.minding99.com\nba.minding99.com\nia.minding99.com\nwww.0311bj.cn\na.dearqy.cn\nwhite.shougouji.top\ncn4.ppzos.com\nwww.360gege.com\nic.dztworld.com\ncn2.ppzos.com\nbc.dztworld.com\nsogous.sayblurb.com\npc.ppzos.com\ncn5.ppzos.com\nba.dztworld.com\nsogousss.srcbooks.com\nub.minding99.com\nrat2.100geili.com\nib.dztworld.com\nwhite.fjxmxslaw.com\ncn1.ppzos.com\nub.dztworld.com\ncn3.ppzos.com\nbb.dztworld.com\nrat3.100geili.com\nsogouss.srcbooks.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n44\t\t111.160.156.10\tNAT\n27\t\t125.36.117.113\tNAT\n27\t\t218.69.42.199\tNAT\n24\t\t117.9.55.29\tNAT\n22\t\t221.197.187.187\tNAT\n22\t\t61.181.206.154\tNAT\n20\t\t218.69.64.130\tNAT\n20\t\t218.68.145.150\tNAT\n20\t\t221.198.203.162\tNAT\n20\t\t221.197.55.4\tNAT\n20\t\t117.11.128.45\tNAT\n19\t\t60.26.187.29\tNAT\n18\t\t117.13.15.45\tNAT\n18\t\t61.181.131.46\tNAT\n18\t\t117.11.155.93\tNAT\n18\t\t60.27.30.20\tNAT\n18\t\t218.69.74.187\tNAT\n17\t\t218.68.236.120\tNAT\n17\t\t61.181.92.130\tNAT\n16\t\t117.15.222.228\tNAT\n16\t\t218.68.220.53\tNAT\n16\t\t218.67.233.167\tNAT\n16\t\t111.162.24.203\tNAT\n15\t\t125.38.137.213\tNAT\n15\t\t60.24.144.117\tNAT\n15\t\t111.163.146.62\tNAT\n14\t\t60.25.16.227\tNAT\n14\t\t60.24.189.241\tNAT\n14\t\t117.13.140.142\tNAT\n14\t\t218.69.242.43\tNAT\n14\t\t60.27.207.61\tNAT\n14\t\t125.38.176.2\tNAT\n13\t\t218.68.201.81\tNAT\n13\t\t60.25.27.238\tNAT\n13\t\t117.14.249.51\tNAT\n13\t\t111.167.149.205\tNAT\n13\t\t111.161.191.151\tNAT\n12\t\t221.198.110.24\tNAT\n12\t\t125.38.168.10\tNAT\n12\t\t60.27.205.7\tNAT\n12\t\t117.13.140.6\tNAT\n12\t\t221.197.69.44\tNAT\n12\t\t117.14.103.18\tNAT\n12\t\t117.13.168.100\tNAT\n11\t\t111.163.211.201\t\n11\t\t117.15.6.163\tNAT\n11\t\t111.165.7.69\tNAT\n11\t\t125.37.218.227\tNAT\n11\t\t111.165.117.68\tNAT\n11\t\t125.37.188.224\tNAT\n11\t\t218.68.24.30\tNAT\n11\t\t111.161.188.225\tNAT\n11\t\t60.28.35.130\tNAT\n11\t\t111.167.39.103\tNAT\n11\t\t221.198.75.232\tNAT\n10\t\t117.12.144.200\tNAT\n10\t\t111.162.215.214\tNAT\n10\t\t218.67.137.157\tNAT\n10\t\t111.160.66.38\tNAT\n10\t\t221.197.207.233\tNAT\n10\t\t218.69.66.23\tNAT\n10\t\t117.9.138.237\tNAT\n10\t\t117.14.225.113\tNAT\n10\t\t221.198.55.86\tNAT\n10\t\t60.28.137.114\tNAT\n10\t\t111.166.240.107\tNAT\n10\t\t60.30.215.214\tNAT\n10\t\t60.26.60.73\tNAT\n9\t\t125.36.168.151\tNAT\n9\t\t111.166.78.107\tNAT\n9\t\t211.94.226.80\tNAT\n9\t\t117.15.204.67\tNAT\n9\t\t117.9.137.247\tNAT\n9\t\t125.36.159.143\tNAT\n9\t\t117.9.92.253\tNAT\n9\t\t218.67.255.130\tNAT\n9\t\t60.30.177.62\tNAT\n9\t\t60.27.30.93\tNAT\n8\t\t111.161.175.142\tNAT\n8\t\t221.198.205.55\tNAT\n8\t\t61.181.237.149\tNAT\n8\t\t111.162.203.133\tNAT\n8\t\t117.13.15.171\tNAT\n8\t\t111.160.132.158\tNAT\n8\t\t221.196.253.224\tNAT\n8\t\t111.167.55.23\tNAT\n8\t\t111.163.194.85\tNAT\n8\t\t125.37.64.100\tNAT\n8\t\t60.26.75.38\tNAT\n8\t\t117.15.213.63\tNAT\n8\t\t111.167.141.36\tNAT\n8\t\t111.163.213.221\tNAT\n8\t\t60.29.148.130\tNAT\n8\t\t218.68.105.107\tNAT\n7\t\t111.165.249.178\tNAT\n7\t\t111.163.87.125\tNAT\n7\t\t125.36.36.45\tNAT\n7\t\t221.197.12.168\tNAT\n7\t\t60.27.136.30\tNAT\n7\t\t218.68.201.142\tNAT\n7\t\t218.69.166.164\tNAT\n7\t\t117.11.15.253\tNAT\n7\t\t125.36.33.178\tNAT\n7\t\t218.67.166.249\tNAT\n7\t\t125.36.118.3\tNAT\n7\t\t60.27.136.126\tNAT\n7\t\t60.30.10.178\tNAT\n7\t\t218.69.242.148\tNAT\n7\t\t221.197.132.12\tNAT\n6\t\t60.24.89.15\tNAT\n6\t\t117.11.233.183\tNAT\n6\t\t60.27.188.32\tNAT\n6\t\t60.27.193.191\tNAT\n6\t\t111.162.223.220\tNAT\n6\t\t60.29.153.58\tNAT\n6\t\t60.29.153.52\tNAT\n6\t\t111.163.151.192\tNAT\n6\t\t60.29.94.82\tNAT\n6\t\t218.69.133.140\tNAT\n6\t\t117.14.58.46\tNAT\n6\t\t218.69.66.151\tNAT\n6\t\t221.197.29.129\tNAT\n6\t\t117.11.108.75\tNAT\n6\t\t117.12.133.137\tNAT\n6\t\t60.25.50.209\tNAT\n6\t\t218.69.78.11\tNAT\n6\t\t117.11.147.199\tNAT\n6\t\t218.67.199.206\tNAT\n6\t\t60.29.128.211\tNAT\n6\t\t60.27.189.251\tNAT\n5\t\t218.68.114.85\tNAT\n5\t\t111.160.253.30\tNAT\n5\t\t60.26.42.206\tNAT\n5\t\t61.181.63.46\tNAT\n5\t\t111.163.154.184\tNAT\n5\t\t60.27.103.152\tNAT\n5\t\t221.198.228.243\tNAT\n5\t\t111.164.10.211\tNAT\n5\t\t117.13.51.90\tNAT\n5\t\t117.10.10.40\tNAT\n5\t\t111.162.216.132\tNAT\n5\t\t111.164.122.84\tNAT\n5\t\t60.26.41.154\tNAT\n5\t\t117.8.100.67\tNAT\n5\t\t111.163.142.158\tNAT\n5\t\t218.68.158.47\tNAT\n5\t\t111.163.146.242\tNAT\n5\t\t111.163.147.202\tNAT\n5\t\t60.30.98.210\tNAT\n5\t\t202.99.106.45\tNAT\n5\t\t60.29.37.38\tNAT\n5\t\t60.24.88.26\tNAT\n5\t\t60.27.88.181\tNAT\n5\t\t60.27.42.203\tNAT\n4\t\t218.68.114.88\tNAT\n4\t\t117.14.201.101\tNAT\n4\t\t60.25.121.64\tNAT\n4\t\t117.14.132.138\tNAT\n4\t\t60.27.43.13\tNAT\n4\t\t221.197.69.167\tNAT\n4\t\t218.69.186.4\tNAT\n4\t\t111.163.73.91\tNAT\n4\t\t218.69.156.112\tNAT\n4\t\t221.198.239.23\tNAT\n4\t\t221.196.51.133\tNAT\n4\t\t60.25.57.45\tNAT\n4\t\t60.24.71.118\tNAT\n4\t\t218.67.255.20\tNAT\n4\t\t60.27.95.94\tNAT\n4\t\t117.11.242.161\tNAT\n4\t\t61.181.5.171\tNAT\n4\t\t221.198.228.100\tNAT\n4\t\t111.166.68.224\tNAT\n4\t\t221.198.27.32\tNAT\n4\t\t218.68.245.188\tNAT\n4\t\t221.198.235.137\tNAT\n4\t\t60.27.189.130\tNAT\n4\t\t111.161.190.189\tNAT\n4\t\t221.197.133.108\tNAT\n4\t\t218.68.233.233\tNAT\n4\t\t221.197.139.0\tNAT\n4\t\t60.24.249.103\tNAT\n4\t\t218.69.74.97\tNAT\n4\t\t125.37.183.60\tNAT\n4\t\t125.38.176.178\tNAT\n4\t\t60.27.188.239\tNAT\n4\t\t218.68.236.207\tNAT\n4\t\t111.163.220.92\tNAT\n4\t\t125.38.62.105\tNAT\n4\t\t61.181.208.87\tNAT\n4\t\t218.67.255.132\tNAT\n4\t\t211.94.242.63\tNAT\n4\t\t125.37.189.121\tNAT\n4\t\t117.11.144.138\tNAT\n4\t\t60.27.136.92\tNAT\n4\t\t125.38.177.227\tNAT\n3\t\t218.68.233.60\tNAT\n3\t\t117.10.62.116\tNAT\n3\t\t218.69.133.156\tNAT\n3\t\t60.30.37.92\tNAT\n3\t\t218.69.74.76\tNAT\n3\t\t125.38.179.187\tNAT\n3\t\t218.68.233.4\tNAT\n3\t\t218.67.164.94\tNAT\n3\t\t117.13.67.54\tNAT\n3\t\t60.30.158.118\tNAT\n3\t\t111.167.10.59\tNAT\n3\t\t117.11.117.136\tNAT\n3\t\t221.198.98.75\tNAT\n3\t\t111.164.38.243\tNAT\n3\t\t221.196.194.139\tNAT\n3\t\t117.9.120.72\tNAT\n3\t\t218.69.164.111\tNAT\n3\t\t221.198.167.50\tNAT\n3\t\t221.198.218.193\tNAT\n3\t\t111.163.156.144\tNAT\n3\t\t221.197.177.239\tNAT\n3\t\t221.196.56.129\tNAT\n3\t\t60.26.94.128\tNAT\n3\t\t221.198.104.101\t\n3\t\t125.36.52.31\tNAT\n3\t\t117.9.239.187\tNAT\n3\t\t117.11.239.145\tNAT\n3\t\t60.24.91.72\tNAT\n3\t\t221.198.174.199\tNAT\n3\t\t218.69.242.4\tNAT\n3\t\t125.37.183.147\tNAT\n3\t\t60.27.60.238\tNAT\n3\t\t218.67.234.37\tNAT\n3\t\t117.11.121.171\tNAT\n3\t\t218.68.204.2\tNAT\n3\t\t117.12.80.93\tNAT\n3\t\t111.167.205.126\tNAT\n3\t\t221.198.61.203\t\n3\t\t221.197.222.238\tNAT\n3\t\t218.68.102.6\tNAT\n3\t\t60.24.226.134\tNAT\n3\t\t117.14.249.216\tNAT\n3\t\t125.37.189.53\tNAT\n3\t\t60.25.2.192\tNAT\n3\t\t60.27.174.218\tNAT\n3\t\t60.27.173.241\tNAT\n3\t\t117.12.20.146\tNAT\n3\t\t60.28.48.194\tNAT\n3\t\t111.163.150.91\tNAT\n3\t\t117.13.3.30\tNAT\n2\t\t60.24.91.55\tNAT\n2\t\t218.68.219.19\tNAT\n2\t\t125.37.121.172\tNAT\n2\t\t60.26.79.134\tNAT\n2\t\t60.30.203.70\tNAT\n2\t\t117.14.207.142\tNAT\n2\t\t111.165.120.223\tNAT\n2\t\t117.10.65.170\tNAT\n2\t\t111.162.200.171\tNAT\n2\t\t111.163.77.247\tNAT\n2\t\t60.27.138.181\tNAT\n2\t\t117.14.249.26\tNAT\n2\t\t117.15.222.52\tNAT\n2\t\t60.27.136.84\tNAT\n2\t\t60.29.215.153\tNAT\n2\t\t117.15.190.58\tNAT\n2\t\t111.163.198.248\tNAT\n2\t\t60.26.122.202\tNAT\n2\t\t111.161.221.189\tNAT\n2\t\t111.162.216.62\tNAT\n2\t\t111.166.213.251\tNAT\n2\t\t111.165.116.208\t\n2\t\t111.160.120.54\tNAT\n2\t\t111.165.30.69\tNAT\n2\t\t221.196.203.65\tNAT\n2\t\t218.67.146.57\t\n2\t\t111.166.66.253\t\n2\t\t111.167.79.178\t\n2\t\t111.162.8.186\tNAT\n2\t\t125.37.183.50\tNAT\n2\t\t111.161.190.225\tNAT\n2\t\t117.10.249.226\tNAT\n2\t\t117.13.104.78\tNAT\n2\t\t221.197.162.210\tNAT\n2\t\t60.25.115.96\tNAT\n2\t\t111.165.214.234\tNAT\n2\t\t221.196.172.170\tNAT\n2\t\t117.10.68.185\t\n2\t\t125.37.191.87\tNAT\n2\t\t60.24.127.98\tNAT\n2\t\t117.12.16.123\tNAT\n2\t\t117.14.126.217\tNAT\n2\t\t111.162.200.108\tNAT\n2\t\t60.26.95.79\tNAT\n2\t\t221.198.59.196\t\n2\t\t125.37.167.208\tNAT\n2\t\t60.27.104.1\tNAT\n2\t\t218.69.234.247\tNAT\n2\t\t111.166.117.229\tNAT\n2\t\t117.10.138.212\tNAT\n2\t\t60.25.17.106\tNAT\n2\t\t117.8.71.114\tNAT\n2\t\t60.25.154.32\tNAT\n2\t\t117.10.105.154\t\n1\t\t218.68.114.232\tNAT\n1\t\t218.68.201.255\tNAT\n1\t\t125.37.29.177\tNAT\n1\t\t218.67.254.103\tNAT\n1\t\t61.181.40.58\tNAT\n1\t\t111.161.235.57\tNAT\n1\t\t60.24.88.219\tNAT\n1\t\t218.68.146.254\tNAT\n1\t\t218.68.102.48\tNAT\n1\t\t117.9.88.178\tNAT\n1\t\t60.24.12.95\tNAT\n1\t\t111.163.208.48\tNAT\n1\t\t117.14.227.37\t\n1\t\t125.37.189.90\tNAT\n1\t\t218.67.204.218\tNAT\n1\t\t125.37.182.15\tNAT\n1\t\t60.24.12.200\tNAT\n1\t\t218.69.72.24\tNAT\n1\t\t117.12.233.224\tNAT\n1\t\t111.163.16.168\tNAT\n1\t\t111.163.122.25\tNAT\n1\t\t221.198.131.25\tNAT\n1\t\t60.25.39.56\tNAT\n1\t\t117.13.95.251\tNAT\n1\t\t221.196.194.116\tNAT\n1\t\t60.26.158.69\tNAT\n1\t\t117.14.249.73\tNAT\n1\t\t111.163.142.187\tNAT\n1\t\t125.37.190.50\tNAT\n1\t\t218.68.147.89\tNAT\n1\t\t221.197.69.49\tNAT\n1\t\t117.14.107.42\tNAT\n1\t\t117.15.192.109\tNAT\n1\t\t117.10.64.131\tNAT\n1\t\t111.163.151.214\tNAT\n1\t\t111.165.106.1\t\n1\t\t221.196.51.5\tNAT\n1\t\t125.36.118.252\tNAT\n1\t\t117.10.64.187\tNAT\n1\t\t221.197.54.203\tNAT\n1\t\t218.68.156.175\tNAT\n1\t\t60.24.88.200\tNAT\n1\t\t111.163.146.23\tNAT\n1\t\t221.197.12.150\tNAT\n1\t\t125.38.18.28\tNAT\n1\t\t117.8.85.121\tNAT\n1\t\t60.25.13.211\tNAT\n1\t\t111.162.220.193\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.darkshell\n\ndarkshell 是面向Window平台的DDoS malware，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。\n\n##### IOCs\n\n```\nequant.wang\n```\n\n##### Clients\n```\nCount   Client          TAGS\n257\t\t125.37.163.193\tNAT\n35\t\t60.30.158.118\tNAT\n5\t\t117.131.173.13\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.nadrac\n\n一款简单的远控程序，又被称为Farfli, YongLouts。一般主要是充当下载器，包含键盘记录，代理，音视频监听等多个插件。\n\n##### IOCs\n\n```\ndllhost.website\nbaijinddos.xyz\nmdzz2018.msns.cn\nsky.hobuff.info\nindonesias.website\n```\n\n##### Clients\n```\nCount   Client          TAGS\n526\t\t60.30.199.26\tNAT\n509\t\t111.160.156.10\tNAT\n203\t\t111.163.143.228\tNAT\n84\t\t60.28.140.93\tNAT\n54\t\t60.29.124.250\tNAT\n8\t\t60.28.114.2\tNAT\n7\t\t60.29.133.19\tNAT\n4\t\t111.160.110.26\tNAT\n4\t\t218.69.27.222\tNAT\n4\t\t125.37.162.202\tNAT\n3\t\t111.165.217.222\tNAT\n3\t\t60.28.101.14\tNAT\n2\t\t125.39.151.188\t\n2\t\t60.29.64.86\tNAT\n1\t\t60.28.114.30\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.elknot\n\n一款比较知名的木马，它允许远程攻击者利用受感染计算机发动DDoS攻击。\n\n##### IOCs\n\n```\nfk.appledoesnt.com\nll.8suf.com\nbaijinddos.xyz\n```\n\n##### Clients\n```\nCount   Client          TAGS\n452\t\t61.181.59.88\t\n258\t\t60.30.26.124\t\n257\t\t60.29.144.220\t\n203\t\t111.163.143.228\tNAT\n155\t\t218.68.0.210\tNAT\n```\n\n</br>\n\n\n#### Malware.loki\n\nloki是一款针对windows平台的恶意软件，其主要目的在于窃取受害者的敏感信息，browser,email,ftp,以及诸多付费工具的licence等。\n\n##### IOCs\n\n```\nsilverlinehospital.in\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t125.37.160.100\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.barhera\n\n一款木马后门，用于下载其他的恶意软件。\n\n##### IOCs\n\n```\np.raidmedia.com.cn\nupdate.bainv.net\nl.raidmedia.com.cn\n```\n\n##### Clients\n```\nCount   Client          TAGS\n3\t\t221.197.133.137\tNAT\n3\t\t61.181.5.31\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.zombieboy\n\nzombieboy是一款针对windows平台的加密货币挖矿蠕虫。\n\n##### IOCs\n\n```\ncuijiahuq.f3322.net\ndns.fq520000.org\n```\n\n##### Clients\n```\nCount   Client          TAGS\n13\t\t218.69.133.37\tNAT\n1\t\t125.35.213.157\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.rcshark\n\nrcshark是一款针对windows平台的后门病毒，其主要功能是窃取用户的敏感信息。\n\n##### IOCs\n\n```\nxiangban1988.3322.org\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t60.27.188.109\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.Dorkbot\n\n属于蠕虫病毒，被感染的所有主机都会沦为黑客的肉鸡，不定期对外网主机进行DDoS攻击，同时其还具有极强的隐蔽性，运行之后会把恶意代码注入到合法进程，然后删除自身。\n\n##### IOCs\n\n```\na.amous1epadsafa42.com\na.ajjjqws1fkxx42.com\na.adoyou1understandme42.com\na.aiphon1egalaxyblack42.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n9\t\t60.30.214.50\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.ramnit\n\nramnit是一款针对windows平台的病毒，最初表现为一款感染U盘，FTP服务器文件的蠕虫，传播大量广告软件，随后发展成银行木马，用于窃取用户金融以及其它敏感信息。\n\n##### IOCs\n\n```\nstromoliks.com\njdskfjkfw3232234.com\nfkjdeljfeew32233.com\nrterybrstutnrsbberve.com\nfget-career.com\nfdwelklwe3093443.com\nsupnewdmn.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n256\t\t61.181.30.138\tNAT\n112\t\t60.28.141.50\tNAT\n79\t\t125.36.152.117\tNAT\n34\t\t61.181.108.2\tNAT\n32\t\t60.28.156.216\t\n30\t\t117.131.173.16\tNAT\n30\t\t221.197.12.90\tNAT\n27\t\t60.29.37.38\tNAT\n25\t\t117.15.99.67\tNAT\n25\t\t111.160.91.94\tNAT\n20\t\t111.30.30.18\tNAT\n19\t\t111.160.100.230\tNAT\n19\t\t111.165.24.101\tNAT\n16\t\t61.181.252.146\tNAT\n16\t\t111.164.20.30\tNAT\n15\t\t60.30.4.11\t\n14\t\t221.239.93.251\t\n13\t\t60.29.22.98\t    NAT\n12\t\t60.25.11.13 \tNAT\n12\t\t218.69.90.46\tNAT\n11\t\t111.160.156.10\tNAT\n11\t\t111.160.132.158\tNAT\n10\t\t60.30.199.26\tNAT\n10\t\t60.29.89.34 \tNAT\n10\t\t218.68.224.88\tNAT\n9\t\t218.68.158.40\tNAT\n9\t\t60.30.164.26\tNAT\n8\t\t60.26.101.13\tNAT\n8\t\t218.68.233.132\tNAT\n8\t\t221.197.139.99\tNAT\n8\t\t221.197.122.193\tNAT\n7\t\t221.196.108.115\tNAT\n7\t\t61.181.143.34\tNAT\n7\t\t117.9.93.13 \tNAT\n7\t\t60.25.148.35\tNAT\n7\t\t180.213.5.10\tNAT\n7\t\t117.11.218.223\tNAT\n6\t\t60.27.31.62\t    NAT\n6\t\t218.69.129.222\tNAT\n6\t\t111.162.212.244\tNAT\n6\t\t218.68.234.159\tNAT\n6\t\t218.68.234.64\tNAT\n6\t\t111.160.233.182\tNAT\n6\t\t125.38.176.178\tNAT\n6\t\t117.11.153.212\tNAT\n6\t\t221.196.180.62\tNAT\n6\t\t221.198.66.44\tNAT\n6\t\t60.26.225.158\tNAT\n5\t\t221.198.170.164\tNAT\n5\t\t111.163.158.181\tNAT\n5\t\t125.36.153.16\tNAT\n5\t\t117.10.62.226\tNAT\n5\t\t117.12.202.189\tNAT\n5\t\t218.69.226.106\tNAT\n5\t\t117.13.115.123\tNAT\n5\t\t61.181.74.42\tNAT\n5\t\t60.29.133.19\tNAT\n5\t\t218.69.55.166\tNAT\n5\t\t218.69.54.167\tNAT\n5\t\t211.94.243.185\tNAT\n5\t\t60.30.208.226\tNAT\n5\t\t117.9.18.2  \tNAT\n5\t\t106.47.29.70\tNAT\n5\t\t125.37.29.120\tNAT\n5\t\t111.162.149.78\tNAT\n5\t\t218.68.0.6\t    NAT\n4\t\t111.161.158.131\tNAT\n4\t\t211.94.254.85\tNAT\n4\t\t218.69.6.74\t    NAT\n4\t\t221.198.86.145\tNAT\n4\t\t111.160.120.54\tNAT\n4\t\t60.24.90.226\tNAT\n4\t\t60.29.93.221\tNAT\n4\t\t111.163.143.228\tNAT\n4\t\t111.163.123.7\tNAT\n4\t\t221.198.238.209\tNAT\n4\t\t60.24.184.70\tNAT\n4\t\t60.27.31.0  \tNAT\n4\t\t117.15.125.181\tNAT\n4\t\t61.181.140.42\tNAT\n4\t\t117.12.37.223\tNAT\n4\t\t218.67.234.60\tNAT\n4\t\t125.38.176.229\tNAT\n4\t\t125.37.29.23\tNAT\n4\t\t61.181.103.138\tNAT\n4\t\t117.11.10.12\tNAT\n4\t\t60.24.233.164\tNAT\n4\t\t60.28.104.130\tNAT\n4\t\t218.68.105.7\tNAT\n4\t\t111.166.237.230\tNAT\n4\t\t221.196.46.61\tNAT\n4\t\t117.14.119.35\tNAT\n4\t\t60.26.203.160\tNAT\n4\t\t117.9.237.225\tNAT\n4\t\t218.68.200.243\tNAT\n4\t\t218.68.229.81\tNAT\n4\t\t218.68.219.29\tNAT\n3\t\t221.198.67.88\tNAT\n3\t\t117.10.236.245\tNAT\n3\t\t117.15.192.231\tNAT\n3\t\t60.24.45.218\tNAT\n3\t\t117.12.146.72\tNAT\n3\t\t60.29.43.46\t    NAT\n3\t\t117.9.191.22\tNAT\n3\t\t111.163.144.224\tNAT\n3\t\t125.37.182.99\tNAT\n3\t\t117.10.138.46\tNAT\n3\t\t211.94.243.121\tNAT\n3\t\t111.161.150.34\tNAT\n3\t\t61.181.219.120\tNAT\n3\t\t60.27.60.159\tNAT\n3\t\t111.162.163.231\tNAT\n3\t\t111.166.238.248\tNAT\n3\t\t117.12.1.165\tNAT\n3\t\t117.13.168.162\tNAT\n3\t\t202.99.106.47\tNAT\n3\t\t221.197.179.98\tNAT\n3\t\t211.94.226.74\tNAT\n3\t\t60.28.101.104\tNAT\n3\t\t111.165.188.122\tNAT\n3\t\t60.29.154.226\tNAT\n3\t\t60.29.15.2\t    NAT\n3\t\t111.165.105.247\tNAT\n3\t\t60.26.239.60\tNAT\n3\t\t43.249.136.20\tNAT\n3\t\t61.181.202.5\t\n3\t\t60.26.142.193\tNAT\n3\t\t117.13.106.191\tNAT\n3\t\t60.29.63.18\t    NAT\n3\t\t60.29.16.94\t    NAT\n3\t\t218.69.52.252\tNAT\n3\t\t117.14.66.156\tNAT\n3\t\t221.196.97.11\tNAT\n3\t\t218.67.181.124\tNAT\n3\t\t111.160.80.3\tNAT\n3\t\t117.13.140.5\tNAT\n3\t\t111.165.11.60\tNAT\n3\t\t60.25.251.11\tNAT\n2\t\t111.160.97.18\tNAT\n2\t\t218.68.102.58\tNAT\n2\t\t125.37.217.118\tNAT\n2\t\t125.37.191.155\tNAT\n2\t\t221.196.97.36\tNAT\n2\t\t221.196.194.253\tNAT\n2\t\t218.68.224.39\tNAT\n2\t\t218.68.102.247\tNAT\n2\t\t111.160.198.83\tNAT\n2\t\t60.27.189.44\tNAT\n2\t\t117.12.133.191\tNAT\n2\t\t60.30.156.190\tNAT\n2\t\t211.94.248.28\tNAT\n2\t\t221.198.60.201\tNAT\n2\t\t60.26.132.173\tNAT\n2\t\t117.15.22.130\tNAT\n2\t\t218.69.55.247\tNAT\n2\t\t117.9.70.23 \tNAT\n2\t\t111.162.216.127\tNAT\n2\t\t61.181.63.138\tNAT\n2\t\t60.24.127.98\tNAT\n2\t\t125.36.101.224\tNAT\n2\t\t117.12.125.160\tNAT\n2\t\t111.165.56.53\tNAT\n2\t\t111.165.128.30\tNAT\n2\t\t125.37.212.67\tNAT\n2\t\t218.68.107.108\tNAT\n2\t\t111.167.149.238\tNAT\n2\t\t221.197.154.147\tNAT\n2\t\t117.13.244.21\tNAT\n2\t\t125.35.249.1\tNAT\n2\t\t218.69.11.58\tNAT\n2\t\t117.10.28.225\tNAT\n2\t\t221.197.133.137\tNAT\n2\t\t111.167.46.70\tNAT\n2\t\t60.29.179.114\tNAT\n2\t\t221.196.180.242\tNAT\n2\t\t60.30.105.33\tNAT\n2\t\t60.27.138.17\tNAT\n1\t\t218.67.254.17\tNAT\n1\t\t117.11.225.137\tNAT\n1\t\t111.163.143.193\tNAT\n1\t\t60.24.89.15\t    NAT\n1\t\t218.69.55.60\tNAT\n1\t\t60.30.215.242\tNAT\n1\t\t111.163.140.152\tNAT\n1\t\t111.160.108.34\tNAT\n1\t\t221.198.218.112\tNAT\n1\t\t125.38.177.138\tNAT\n1\t\t60.29.95.82\t    NAT\n1\t\t221.196.194.2\tNAT\n1\t\t221.197.162.54\tNAT\n1\t\t117.15.191.57\tNAT\n1\t\t60.27.42.62\tNAT\n1\t\t117.9.229.148\tNAT\n1\t\t218.69.234.252\tNAT\n1\t\t60.27.79.17\t    NAT\n1\t\t117.8.101.63\tNAT\n1\t\t60.30.105.41\tNAT\n1\t\t125.37.125.3\tNAT\n1\t\t221.198.118.158\tNAT\n1\t\t60.28.101.103\tNAT\n1\t\t60.28.101.106\tNAT\n1\t\t60.27.205.187\tNAT\n1\t\t211.94.242.118\tNAT\n1\t\t117.12.144.7\tNAT\n1\t\t117.8.100.70\tNAT\n1\t\t60.29.30.190\tNAT\n1\t\t60.26.180.205\tNAT\n1\t\t111.162.221.168\tNAT\n1\t\t221.198.110.209\tNAT\n1\t\t117.14.70.156\tNAT\n1\t\t60.29.116.18\tNAT\n1\t\t111.165.72.25\tNAT\n1\t\t218.69.147.133\tNAT\n1\t\t60.29.153.61\tNAT\n1\t\t221.196.119.133\tNAT\n1\t\t111.163.22.227\tNAT\n1\t\t60.30.204.82\tNAT\n1\t\t111.167.144.199\tNAT\n1\t\t60.30.240.226\tNAT\n1\t\t111.166.156.237\tNAT\n1\t\t60.28.38.18\t    NAT\n1\t\t125.37.182.185\tNAT\n1\t\t218.68.235.133\tNAT\n1\t\t125.38.191.184\tNAT\n1\t\t111.160.97.42\tNAT\n1\t\t111.163.78.80\tNAT\n1\t\t111.161.189.215\tNAT\n1\t\t117.11.239.56\tNAT\n1\t\t218.69.243.164\tNAT\n1\t\t60.29.179.42\tNAT\n1\t\t117.12.158.82\tNAT\n1\t\t60.25.63.52\t    NAT\n1\t\t60.25.10.147\tNAT\n1\t\t60.27.79.149\tNAT\n1\t\t111.162.163.241\tNAT\n1\t\t221.239.72.170\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.gh0st\n\nGH0ST是一款经典的RAT，针对Windows系统，支持截屏、录像、录音等多种spy功能。GH0ST由中国人编写，已经开放源码，因而存在较多的变种。\n\n##### IOCs\n\n```\nwww.sousouweb.com\nime.mys2005.xyz\nlinux145.f3322.net\n3s.dkys.org\nyk.520yxsf.com\nbaijinddos.xyz\nxiangban1988.3322.org\nfwq2020.f3322.net\nzerococoll.f3322.net\nsky.hobuff.info\nwww.wulei168.pw\n```\n\n##### Clients\n```\nCount   Client          TAGS\n509\t\t111.160.156.10\tNAT\n203\t\t111.163.143.228\tNAT\n103\t\t125.39.138.171\t\n94\t\t60.28.34.59\t\n54\t\t60.29.124.250\tNAT\n34\t\t60.30.199.26\tNAT\n20\t\t60.28.99.74 \tNAT\n18\t\t61.181.81.82\tNAT\n12\t\t218.69.11.58\tNAT\n4\t\t103.233.4.30\tNAT\n3\t\t111.165.217.222\tNAT\n3\t\t221.239.104.13\t\n3\t\t60.28.101.14\tNAT\n2\t\t125.39.151.188\t\n1\t\t60.27.188.109\tNAT\n1\t\t60.28.101.104\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.posioncake\n\n一款内置于手机ROM的恶意代码模块，注入Phone进程，拦截短信和发送短信，自动扣费，窃取信息等等。\n\n##### IOCs\n\n```\nhcbh.heycould.com\nhacdl.junwonsil.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n6\t\t60.27.42.111\tNAT\n2\t\t125.37.189.42\tNAT\n2\t\t60.27.43.103\tNAT\n1\t\t111.162.129.93\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.nitol\n\n又名dsl，是国内著名的面向Window平台的DDoS类型的 botnet家族，支持icmp/udp/tcp/http等多种攻击手段，具有较多的变种。\n\n##### IOCs\n\n```\ndllhost.website\nmssql.noip.cn\nmdzz2018.msns.cn\nyk.520yxsf.com\nakmfs.com\n40kam.cn\nsky.hobuff.info\na.aklianfa.com\nindonesias.website\n3s.dkys.org\nak-74.top\n```\n\n##### Clients\n```\nCount   Client          TAGS\n709\t\t60.30.199.26\tNAT\n509\t\t111.160.156.10\tNAT\n84\t\t60.28.140.93\tNAT\n54\t\t60.29.124.250\tNAT\n11\t\t111.163.143.228\tNAT\n8\t\t60.28.114.2\t    NAT\n7\t\t60.29.133.19\tNAT\n4\t\t125.37.162.202\tNAT\n4\t\t111.160.110.26\tNAT\n4\t\t218.69.27.222\tNAT\n3\t\t111.165.217.222\tNAT\n3\t\t60.28.101.14\tNAT\n2\t\t125.39.151.188\t\n2\t\t60.29.64.86\t    NAT\n1\t\t60.27.119.49\t\n1\t\t60.28.114.30\tNAT\n1\t\t60.28.101.104\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.mirai\n\n通过大规模弱口令扫描来实现传播的蠕虫病毒，将Linux平台的Iot设备控制，用于DDoS攻击。\n\n##### IOCs\n\n```\nscan.santaiot.net\nseven.nadns.info\nnetflux.r00ts.online\ncnc.stresser.pw\n```\n\n##### Clients\n```\nCount   Client          TAGS\n585\t\t60.29.215.141\tNAT\n527\t\t111.160.57.142\tNAT\n290\t\t61.181.115.50\tNAT\n2\t\t111.167.211.108\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.humpler\n\n该病毒伪装成多款小工具（如：老板键、屏幕亮度调节等），正通过2345软件大全等多个知名下载站进行传播。病毒入侵电脑后，会劫持QQ、360、搜狗等（市面上所有主流）浏览器首页。\n\n##### IOCs\n\n```\nwww.baidu-home.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t60.27.136.24\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.wannycry\n\n一种“蠕虫式”的勒索病毒软件，利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播，感染计算机后会向计算机中植入敲诈者病毒，导致电脑大量文件被加密。\n\n##### IOCs\n\n```\niuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\nwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n215\t\t60.30.147.86\t\n3\t\t125.35.211.131\tNAT\n1\t\t61.181.70.210\tNAT\n1\t\t60.29.64.22\t    NAT\n```\n\n\n</br>\n\n\n\n#### Malware.DUNIHi\n\nDUNIHI (VBS_DUNIHI.ELDSAVJ)是一个有后门和蠕虫功能的很著名的VB脚本，在某些单独的事件中，该脚本在垃圾邮件活动中与Adwind一起释放。\n\n##### IOCs\n\n```\npm2bitcoin.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n107\t\t60.29.15.54\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.flyboy\n\n一款常见的DDoS木马。\n\n##### IOCs\n\n```\n3s.dkys.org\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t60.28.101.104\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.zusy\n\n隐藏在PowerShell中，当用户打开，代码将被执行并连接到CC，接下来就会下载文件并执行，最终部署恶意程序downloader。\n\n##### IOCs\n\n```\nbuy1.amzjhhl.ru\nbuy1.gsnrrtf.net\nbuy1.csfnlpg.com\nbuy1.cdpgphm.ru\nbuy1.dhccyjw.net\nbuy1.tnnxkzu.ru\nbuy1.emafzud.net\nbuy1.rcdibnh.net\nbuy1.uxesjmg.ru\nbuy1.swexydc.ru\nbuy1.jgbfjlp.net\nbuy1.zwnbddh.com\nbuy1.xrcugmy.net\nbuy1.bgnlbfi.ru\nbuy1.nonyans.net\nbuy1.xfwwcmk.net\nbuy1.iqcpfzo.ru\nbuy1.anzxoii.net\nbuy1.ntlucrd.com\nbuy1.tiksrzr.com\nbuy1.otkmgkl.ru\nbuy1.icwastp.ru\nbuy1.rmpokmg.ru\nbuy1.gyhhgrc.ru\nbuy1.aenqzfk.net\nbuy1.hbjxtas.com\nbuy1.tpibfhe.ru\nbuy1.nuawren.com\nbuy1.nzuibjx.net\nbuy1.swemrgx.ru\nbuy1.qzojbhw.net\nbuy1.qwlhrkg.net\nbuy1.cbbfywr.ru\nbuy1.iryjeqo.com\nbuy1.eftctph.com\nbuy1.rdggegr.ru\nbuy1.fmrolhu.ru\nbuy1.rksgxwu.com\nbuy1.ddplnfp.net\nbuy1.yhbayam.net\nbuy1.uqccxlp.com\nbuy1.mnplqfs.net\nbuy1.dhzozeh.com\nbuy1.tlwrshg.net\nbuy1.aldloqz.ru\nbuy1.lrtapbs.ru\nbuy1.blwszto.ru\nbuy1.ejuzlle.net\nbuy1.gxhrnou.net\nbuy1.iwjsndf.com\nbuy1.pkhruee.net\nbuy1.zrsglol.com\nbuy1.kfysswc.com\nbuy1.jlaxfgb.ru\nbuy1.lyksyom.ru\nbuy1.mbtndqh.ru\nbuy1.pmhncfh.com\nbuy1.pfccfpb.ru\nbuy1.ihtmojm.ru\nbuy1.jzwhkrf.ru\nbuy1.mbiaean.ru\nbuy1.oddcucl.net\nbuy1.wzxtbjj.com\nbuy1.fpkrylz.com\nbuy1.jrwgrbg.ru\nbuy1.qnmbbdf.com\nbuy1.ddxkizq.net\nbuy1.yyalymk.net\nbuy1.acthwqo.com\nbuy1.snpntqd.com\nbuy1.azcduku.net\nbuy1.ncfnqjq.ru\nbuy1.ipqwqms.com\nbuy1.ofcllwd.net\nbuy1.xbxkmpp.com\nbuy1.alxluqi.ru\nbuy1.dyimlqp.net\nbuy1.fiocywx.com\nbuy1.abqlnrj.net\nbuy1.rrsywps.net\nbuy1.dyqzunc.ru\nbuy1.arhaqps.net\nbuy1.zpoxqcm.com\nbuy1.loakwst.net\nbuy1.nmwfrco.net\nbuy1.bhwfnll.net\nbuy1.osqmhxk.com\nbuy1.tzsduod.ru\nbuy1.lzssazr.net\nbuy1.icuieia.com\nbuy1.subbsty.net\nbuy1.fyalcld.net\nbuy1.odadidc.net\nbuy1.oabnnmt.net\nbuy1.aypoxyp.ru\nbuy1.nzliqic.net\nbuy1.xcypwuk.com\nbuy1.kfxzzsn.com\nbuy1.iywiqzr.com\nbuy1.rkacqse.ru\nbuy1.ymqfcbd.net\nbuy1.pypylia.com\nbuy1.gcyzgmf.com\nbuy1.xkxkdrn.com\nbuy1.cuoohzc.net\nbuy1.umjumsm.ru\nbuy1.pyyynza.com\nbuy1.udcjmjp.com\nbuy1.jpczuxg.com\nbuy1.bhnlbnh.net\nbuy1.gkhdxpf.net\nbuy1.hcgrnpn.ru\nbuy1.mslethd.ru\nbuy1.rfigznh.com\nbuy1.fkixudk.com\nbuy1.dqjkgce.net\nbuy1.rpxiwkc.com\nbuy1.niobmdi.com\nbuy1.dgwxumj.net\nbuy1.xalccbx.net\nbuy1.rzlqryz.net\nbuy1.dmbszul.com\nbuy1.uxxbwrr.ru\nbuy1.lgllgjs.net\nbuy1.tklwfah.ru\nbuy1.bbjzotm.ru\nbuy1.muxizct.ru\nbuy1.iexcrzz.net\nbuy1.gqoshyz.com\nbuy1.kyjbpwo.com\nbuy1.qxicnnb.com\nbuy1.yhpgwbd.net\nbuy1.txhkpgx.ru\nbuy1.iyfekft.ru\nbuy1.rfjllrs.net\nbuy1.xfqhajt.ru\nbuy1.zdfytrg.net\nbuy1.dfllbal.com\nbuy1.ctxjyex.com\nbuy1.yeyagrf.net\nbuy1.ulijgtz.com\nbuy1.rpskkwa.ru\nbuy1.yltzlez.ru\nbuy1.uwzghwb.net\nbuy1.jsitazi.ru\nbuy1.fehllnd.ru\nbuy1.ewkuzls.com\nbuy1.gciwhdc.net\nbuy1.khjizyn.com\nbuy1.ajjchrq.com\nbuy1.hizfyzc.ru\nbuy1.acejruk.com\nbuy1.jcerqdu.com\nbuy1.litporj.net\nbuy1.xygtuqr.net\nbuy1.zhzecai.ru\nbuy1.lrqfxhc.net\nbuy1.plbjxaw.net\nbuy1.xisphiu.ru\nbuy1.nmdmzxk.com\nbuy1.whowczd.net\nbuy1.gfygooj.net\nbuy1.bkfhpoo.net\nbuy1.xfojdma.com\nbuy1.zzcsctw.com\nbuy1.shkjsxn.com\nbuy1.sczeedr.com\nbuy1.jlqawun.net\nbuy1.zbrxzcd.net\nbuy1.eawlrfo.net\nbuy1.lkwwnuy.com\nbuy1.eojrzia.com\nbuy1.mkehkqw.ru\nbuy1.bunndlc.net\nbuy1.caejtfs.com\nbuy1.qdlycsz.ru\nbuy1.aamdljg.net\nbuy1.uarszmk.net\nbuy1.eghszki.ru\nbuy1.kyzweka.ru\nbuy1.ucykaub.net\nbuy1.unxoyqg.net\nbuy1.ujgrmdw.net\nbuy1.oftxynb.com\nbuy1.byimnch.com\nbuy1.agipcrc.com\nbuy1.eqsjnjm.com\nbuy1.wqrtqpc.com\nbuy1.wosqlhp.com\nbuy1.txrytdk.ru\nbuy1.ncmxoby.net\nbuy1.fkztbqc.ru\nbuy1.yyeytoh.ru\nbuy1.xxegozl.net\nbuy1.umlddds.com\nbuy1.ihsfmzs.ru\nbuy1.bzloyhl.com\nbuy1.fpucsex.net\nbuy1.dhenkce.ru\nbuy1.wqpquur.com\nbuy1.jeuggdx.net\nbuy1.bqsmdwo.net\nbuy1.mswcoje.ru\nbuy1.snabueo.com\nbuy1.zsczqfy.ru\nbuy1.fwtoowy.ru\nbuy1.ofinzks.net\nbuy1.ctemxrb.com\nbuy1.bwfakki.com\nbuy1.losoipz.net\nbuy1.wyxhwju.net\nbuy1.zkznpjx.net\nbuy1.wtiksxd.com\nbuy1.swhjoah.com\nbuy1.nasuofo.net\nbuy1.yuwtdkb.net\nbuy1.gtdiebz.net\nbuy1.whihyrr.net\nbuy1.jslmhdt.ru\nbuy1.jsbutdx.net\nbuy1.ztkwpnt.net\nbuy1.nrtqgnk.ru\nbuy1.kmmeycg.net\nbuy1.jhlzgnx.com\nbuy1.holmewx.com\nbuy1.kqktsmm.net\nbuy1.sbbcsds.ru\nbuy1.ldqfpjt.ru\nbuy1.nnhaioe.ru\nbuy1.ibhyldi.com\nbuy1.konsxcs.net\nbuy1.cbhsshp.com\nbuy1.gopdypa.net\nbuy1.trozbgi.com\nbuy1.kaohkbo.ru\nbuy1.zjfyxty.com\nbuy1.llhwqrb.ru\nbuy1.dmyldke.ru\nbuy1.efyncmf.net\nbuy1.emjrsao.com\nbuy1.xwyntku.com\nbuy1.hltlxfs.net\nbuy1.thbjtrm.net\nbuy1.qwgsncg.com\nbuy1.fbbefbz.com\nbuy1.twgpprb.net\nbuy1.nhexpdk.ru\nbuy1.gehbfee.ru\nbuy1.mgqwpyq.net\nbuy1.gykmlbd.com\nbuy1.xtxflqf.net\nbuy1.nweqxdp.com\nbuy1.alggopl.com\nbuy1.hpczbok.com\nbuy1.rgqkjoz.net\nbuy1.hyldyiu.com\nbuy1.mnbqzcx.com\nbuy1.ppolbqq.com\nbuy1.zhytqnk.com\nbuy1.lntgdkt.net\nbuy1.egrsdno.ru\nbuy1.sningaz.net\nbuy1.wbtjqns.com\nbuy1.twqqspy.ru\nbuy1.uaegzfg.net\nbuy1.lybnmaq.net\nbuy1.tqebcid.com\nbuy1.gyqxhuk.com\nbuy1.lgppbam.net\nbuy1.oyzkzhk.ru\nbuy1.tbsnaoq.ru\nbuy1.jfmnyjj.net\nbuy1.lrzgxti.ru\nbuy1.byosnwr.ru\nbuy1.deutskr.net\nbuy1.rhaaxsx.net\nbuy1.ptprctl.ru\nbuy1.jaisoap.net\nbuy1.ifjzgwm.com\nbuy1.rynffwj.net\nbuy1.gbcdmyk.com\nbuy1.uzinsse.ru\nbuy1.ioicphz.com\nbuy1.ukciate.ru\nbuy1.lezsbdq.com\nbuy1.dertjgm.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n298\t\t111.160.240.107\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.woring\n\nworing是一款针对Linux平台的 DDoS类型的botnet，因为函数命名存在一个typo: working->woring 故得名。woring主要感染x86 CPU架构的系统，支持常见的DDoS攻击手段。\n\n##### IOCs\n\n```\nak-74.top\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t60.27.119.49\t\n```\n\n\n</br>\n\n\n\n#### Malware.miner\n\n各种挖矿软件家族，包括LSDminer、MSRAminer等等。\n\n##### IOCs\n\n```\nmine.ppxxmr.com\np.awcna.com\np.zer2.com\npool.minexmr.com\ntgoodluck.info\nfr.ppxxmr.org\nx.csrss.website\npool.usa-138.com\nlpp.zer2.com\nrapid7cpfqnwxodo.tor2web.fyi\ntestnet-seed.bitcoin.jonasschnelli.ch\nxmr.crypto-pool.fr\ntask.estonine.com\nurlxxx.at.ua\npluck.moisture.tk\nxmr.f2pool.com\ndonate.v2.googel-dns.com\nxmr-eu2.nanopool.org\nlog.miniast.com\nlsd.systemten.org\nseed.tbtc.petertodd.org\nloop.haqo.net\na.csrss.website\nreader.pamphler.com\nt.awcna.com\nluoxkexp.com\npoole.laofubtc.com\nindonesias.me\ntar.kziu0tpofwf.club\np1.qsd2xjpzfky.site\np3.qsd2xjpzfky.site\nsystemten.org\nxmr-eu1.nanopool.org\nlpp.awcna.com\nswt.njaavfxcgk3.club\nnull.exhauest.com\nwww.zeculiar.tk\ndns.posthash.org\nguojun.website\np.amxny.com\nloop.sawmilliner.com\nz.drawal.tk\nmorphed.ru\nxmr.pool.minergate.com\nrapid7cpfqnwxodo.onion.in.net\ndnsseed.bluematt.me\ns.csrss.website\nrer.njaavfxcgk3.club\npool.supportxmr.com\neurope.cryptonight-hub.miningpoolhub.com\nemergency.kiss58.org\nemergency.googel-dns.com\nseed.testnet.bitcoin.sprovoost.nl\nfox.weilders.com\nacs.njaavfxcgk3.club\nmonerohash.com\nw.3ei.xyz\njump.taucepan.com\nfee.googel-dns.com\nccc.njaavfxcgk3.club\nxmr.usa-138.com\nseed.bitcoinstats.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n900\t\t60.30.199.26\tNAT\n892\t\t221.239.96.146\tNAT\n891\t\t111.160.156.10\tNAT\n803\t\t111.164.175.157\tNAT\n574\t\t111.160.82.66\tNAT\n521\t\t111.160.204.62\t\n494\t\t60.30.197.110\tNAT\n467\t\t60.28.104.130\tNAT\n415\t\t60.28.252.2 \tNAT;IDC\n352\t\t221.196.92.246\tNAT\n269\t\t60.29.103.44\tNAT\n241\t\t60.29.17.222\tNAT\n239\t\t218.68.45.209\tNAT\n164\t\t117.9.18.201\tNAT\n142\t\t218.68.105.24\tNAT\n130\t\t202.99.114.74\tNAT\n130\t\t111.160.167.194\tNAT\n110\t\t60.28.47.90\t    NAT\n78\t\t60.28.253.182\tNAT\n69\t\t218.69.133.62\tNAT\n68\t\t61.181.131.66\tNAT\n43\t\t61.240.24.130\tNAT\n37\t\t60.24.90.72\t    NAT\n36\t\t111.160.119.178\tNAT\n35\t\t60.30.240.226\tNAT\n35\t\t60.30.134.99\tNAT\n34\t\t221.197.42.171\t\n28\t\t125.35.210.209\tNAT\n27\t\t60.28.102.2\t    NAT\n26\t\t221.197.55.168\tNAT\n26\t\t61.181.207.7\tNAT\n25\t\t125.35.210.222\tNAT\n24\t\t125.35.210.204\tNAT\n24\t\t125.35.210.229\tNAT\n19\t\t125.39.71.19\t\n19\t\t61.181.76.146\tNAT\n18\t\t60.25.251.11\tNAT\n18\t\t111.33.30.44\tNAT\n17\t\t117.14.201.183\tNAT\n17\t\t60.30.69.36\t    NAT\n16\t\t221.197.139.246\tNAT\n16\t\t60.28.101.104\tNAT\n16\t\t60.28.108.201\tNAT\n15\t\t218.69.96.14\tNAT\n15\t\t60.30.193.162\tNAT\n15\t\t222.36.63.83\t\n15\t\t60.30.208.226\tNAT\n15\t\t111.160.40.106\tNAT\n14\t\t61.136.11.38\tNAT\n14\t\t60.28.156.216\t\n14\t\t60.28.101.74\tNAT\n14\t\t60.29.158.82\tNAT\n14\t\t111.160.122.98\tNAT\n14\t\t218.69.11.174\tNAT\n13\t\t60.28.101.105\tNAT\n13\t\t117.9.164.4\t    NAT\n12\t\t117.15.169.6\t\n12\t\t61.181.70.210\tNAT\n11\t\t180.213.5.10\tNAT\n10\t\t111.164.49.39\tNAT\n10\t\t218.68.5.141\tNAT\n10\t\t60.29.15.54\t    NAT\n10\t\t218.68.0.210\tNAT\n10\t\t111.164.183.26\tNAT\n10\t\t60.30.186.26\tNAT\n10\t\t125.39.151.188\t\n9\t\t221.239.124.90\tNAT\n9\t\t117.131.173.16\tNAT\n8\t\t123.150.44.5\tNAT\n8\t\t111.160.97.18\tNAT\n8\t\t221.238.238.234\tNAT\n8\t\t117.9.8.157\t    NAT\n8\t\t61.181.123.67\t\n8\t\t125.35.211.131\tNAT\n8\t\t123.150.44.3\tNAT\n7\t\t60.29.133.19\tNAT\n6\t\t111.160.80.250\tNAT\n6\t\t111.160.7.62\tNAT\n6\t\t125.36.59.125\tNAT\n6\t\t123.150.44.11\tNAT\n6\t\t218.68.204.18\tNAT\n6\t\t218.69.11.58\tNAT\n5\t\t60.29.64.138\tNAT\n5\t\t123.151.25.136\tNAT\n5\t\t125.37.77.156\tNAT\n5\t\t111.164.183.91\tNAT\n5\t\t111.162.128.53\tNAT\n5\t\t117.11.10.12\tNAT\n5\t\t117.13.140.93\tNAT\n5\t\t60.30.149.98\tNAT\n4\t\t221.196.67.188\tNAT\n4\t\t60.25.179.9\t    NAT\n4\t\t60.30.120.132\tNAT\n4\t\t218.68.102.37\tNAT\n4\t\t218.69.61.140\tNAT\n4\t\t218.68.147.61\tNAT\n4\t\t60.28.84.197\tNAT\n4\t\t111.160.240.109\tNAT\n4\t\t60.29.64.139\tNAT\n4\t\t218.68.1.195\tNAT\n3\t\t60.28.101.14\tNAT\n3\t\t111.160.166.189\tNAT\n3\t\t61.181.97.162\tNAT\n3\t\t61.181.112.102\tNAT\n3\t\t60.28.101.103\tNAT\n3\t\t117.9.18.204\tNAT\n3\t\t117.10.138.188\tNAT\n3\t\t218.68.235.209\tNAT\n3\t\t218.69.156.59\tNAT\n3\t\t117.131.135.209\tNAT\n2\t\t60.29.195.26\tNAT\n2\t\t221.197.97.97\t\n2\t\t60.26.78.4\t\n2\t\t218.67.246.54\tNAT\n2\t\t111.160.166.58\tNAT\n2\t\t61.181.103.46\tNAT\n2\t\t60.27.79.17\t    NAT\n2\t\t60.30.172.82\tNAT\n2\t\t60.29.153.61\tNAT\n2\t\t60.28.63.85\t    NAT\n2\t\t60.29.158.138\tNAT\n2\t\t60.30.42.78\t    NAT\n2\t\t111.163.122.136\tNAT\n2\t\t111.30.78.46\tNAT\n2\t\t60.30.33.70\t\n2\t\t221.197.220.35\tNAT\n2\t\t60.28.41.18\t    NAT\n2\t\t111.30.101.238\tNAT\n2\t\t60.29.153.45\tNAT\n2\t\t60.29.179.118\tNAT\n2\t\t117.9.199.42\tNAT\n2\t\t123.150.44.9\tNAT\n2\t\t60.28.104.118\tNAT\n2\t\t111.160.70.46\tNAT\n2\t\t61.181.107.107\tNAT\n1\t\t111.162.215.164\tNAT\n1\t\t111.162.68.202\tNAT\n1\t\t103.233.4.30\tNAT\n1\t\t218.69.25.110\tNAT\n1\t\t60.29.153.43\tNAT\n1\t\t221.196.108.202\tNAT\n1\t\t60.30.149.10\tNAT\n1\t\t117.131.245.101\tNAT\n1\t\t111.33.17.70\tNAT\n1\t\t61.181.5.114\tNAT\n1\t\t117.13.72.198\tNAT\n1\t\t60.30.177.62\tNAT\n1\t\t211.94.248.30\tNAT\n1\t\t125.38.179.109\tNAT\n1\t\t221.196.108.163\tNAT\n1\t\t218.68.159.45\tNAT\n1\t\t60.29.4.206\t    NAT\n1\t\t111.160.49.188\tNAT\n1\t\t111.160.49.186\t\n1\t\t117.11.117.118\tNAT\n1\t\t111.162.201.182\tNAT\n1\t\t218.68.105.125\tNAT\n1\t\t111.162.219.115\tNAT\n1\t\t218.68.204.86\tNAT\n1\t\t60.30.155.10\tNAT\n1\t\t221.239.89.186\tNAT\n1\t\t111.164.40.153\tNAT\n1\t\t60.29.154.210\tNAT\n1\t\t61.181.15.212\tNAT\n1\t\t111.163.141.224\tNAT\n1\t\t60.28.114.2\t    NAT\n1\t\t60.29.77.202\tNAT\n1\t\t221.239.26.30\tNAT\n1\t\t111.160.242.66\tNAT\n1\t\t60.30.162.14\t\n1\t\t103.233.4.29\tNAT\n1\t\t111.166.50.41\tNAT\n1\t\t111.166.87.206\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.wannacry\n\n一种“蠕虫式”的勒索病毒软件，由不法分子利用NSA（National Security Agency，美国国家安全局）泄露的危险漏洞“EternalBlue”（永恒之蓝）进行传播。被该勒索软件入侵后，用户主机系统内的照片、图片、文档、音频、视频等几乎所有类型的文件都将被加密，加密文件的后缀名被统一修改为 WNCRY。\n\n##### IOCs\n\n```\nwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\nwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n104\t\t60.30.147.86\t\n8\t\t125.35.211.131\tNAT\n3\t\t111.164.183.91\tNAT\n2\t\t221.238.232.218\tNAT\n2\t\t111.160.40.106\tNAT\n1\t\t60.29.64.22\t    NAT\n1\t\t61.181.70.210\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.sality\n\n一款多态感染性病毒，一旦被他们感染，电脑上大部分文件都会被感染成病毒文件。\n\n##### IOCs\n\n```\nvancityprinters.com\n724hizmetgrup.com\nvinasonthanh.com\naffiliate.free.rongrean.com\namsamex.com\nzanzoul.aya.com.sy\nbbeakemegood24.com\nchicostara.com\nwww.ceylanogullari.com\nfamily-international.de\nyavuztuncil.ya.funpic.de\npelcpawel.fm.interia.pl\nwww.liongrup.com\nbazyar-arya.com\naocuoikhanhlinh.vn\nohne-steuer.de\ncevatpasa.com\njrsx.jre.net.cn\nreliancepublications.co.in\nbem.dk\narthur.niria.biz\nlpbmx.ru\nbanboon.com\nankara-cambalkon.net\ndewpoint-eg.com\ntwilight-duo.com\nwww.bluecubecreatives.com\napple-pie.in\nahmediye.net\nabpowqbvcfds677.info\nwww.unigas.mn\nwww.vancityprinters.com\nkuplu.bel.tr\n```\n\n##### Clients\n```\nCount   Client          TAGS\n108\t\t111.160.182.10\tNAT\n20\t\t117.9.152.25\tNAT\n13\t\t60.27.193.240\tNAT\n12\t\t125.36.117.141\tNAT\n8\t\t60.29.43.82\t    NAT\n7\t\t218.68.102.172\tNAT\n6\t\t218.69.108.45\tNAT\n6\t\t60.28.250.46\tIDC\n6\t\t60.25.253.157\tNAT\n4\t\t219.150.87.130\tNAT\n4\t\t111.160.92.74\tNAT\n4\t\t221.197.156.59\tNAT\n4\t\t221.239.124.90\tNAT\n3\t\t117.9.228.28\tNAT\n3\t\t218.69.11.58\tNAT\n3\t\t117.12.17.73\tNAT\n3\t\t123.151.34.82\tNAT\n2\t\t61.181.63.26\tNAT\n2\t\t111.167.244.137\tNAT\n2\t\t117.11.239.126\tNAT\n2\t\t60.28.101.104\tNAT\n2\t\t60.30.69.36\t    NAT\n1\t\t117.12.197.138\tNAT\n1\t\t218.68.6.194\tNAT\n1\t\t117.15.191.13\tNAT\n1\t\t61.181.63.138\tNAT\n1\t\t111.163.145.187\tNAT\n1\t\t111.33.56.2\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.dofloo\n\ndofloo又名AES.DDOS，针对Linux设备，已经发现的变种主要感染运行x86和ARM CPU的设备。dofloo 支持SYN/TCP/UDP/DNS/HTTP等多种flood攻击。\n\n##### IOCs\n\n```\nwww.santananb.info\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1\t\t60.30.172.82\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.artemis\n\nartemis家族针对windows系统，用于DDoS攻击，支持UDP/TCP/DNS/HTTP 4种攻击方式。 \n\n##### IOCs\n\n```\nlang12397007.3322.org\nscrk.3322.org\nrat2.100geili.com\nliyongyong88.3322.org\nfei9988.3322.org\ndoss456.3322.org\nmeihaoddos.3322.org\ndingtao333.3322.org\nrat3.100geili.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n51\t\t117.9.146.131\tNAT\n45\t\t117.11.147.243\tNAT\n44\t\t111.160.156.10\tNAT\n41\t\t117.9.64.214\tNAT\n40\t\t111.163.123.186\tNAT\n35\t\t125.36.119.78\tNAT\n18\t\t117.10.53.124\tNAT\n15\t\t125.37.188.225\tNAT\n15\t\t117.13.192.248\tNAT\n15\t\t218.67.254.131\tNAT\n12\t\t218.68.190.107\tNAT\n11\t\t117.15.6.163\tNAT\n11\t\t125.36.80.149\tNAT\n10\t\t218.67.145.251\tNAT\n9\t\t60.28.101.104\tNAT\n8\t\t117.9.158.203\tNAT\n8\t\t111.160.132.158\tNAT\n7\t\t111.163.22.135\tNAT\n6\t\t111.161.188.102\tNAT\n5\t\t221.196.205.193\tNAT\n4\t\t60.26.102.238\tNAT\n4\t\t125.37.189.211\tNAT\n4\t\t218.69.102.106\tNAT\n4\t\t60.28.101.103\tNAT\n4\t\t111.167.180.105\tNAT\n3\t\t218.67.165.2\tNAT\n3\t\t125.38.137.250\tNAT\n2\t\t221.198.67.125\tNAT\n2\t\t60.28.101.105\tNAT\n2\t\t221.196.61.39\tNAT\n1\t\t60.29.38.118\tNAT\n1\t\t221.197.255.115\tNAT\n1\t\t111.163.90.226\tNAT\n1\t\t117.9.238.225\tNAT\n1\t\t218.68.45.180\tNAT\n1\t\t221.197.8.155\t\n```\n\n\n</br>\n\n\n\n#### Malware.unknown\n\n一部分我们正在跟踪的明确恶意但未归类的汇总\n\n##### IOCs\n\n```\npccp.youdns17.com\nlp.beahh.com\nv.beahh.com\nii.ackng.com\nhealthdevicetracker.com\nlp.haqo.net\nsuoye1.eatuo.com\noxy.imbceon.com\ncake.pilutce.com\nwqerveybrstyhcerveantbe.com\nworkforce.ignorelist.com\nghoost-souf.no-ip.org\ndown.wmwky.tw\nwww.santananb.info\ndoc.to0ls.com\njltx131.cc\nbooomaahuuoooapl.ru\nhewle.kielsoservice.net\nwys810302.f3322.net\nwww3.cedesunjerinkas.com\n2.dfdf332.com\nmdzz2019.noip.cn\nspring.tulipnetworks.net\naj1732.online\nii.haqo.net\nsuoye1.f3322.net\nnevernews.club\nwww2.cedesunjerinkas.com\nlp.abbny.com\nbooomaahuuoooapl.in\nyzzweb.f3322.net\nalmasoodgroup.com\nmaeobnaoefhgoajo.com\nfiaoiaegiieogjjed.ru\n5123.2288.org\napi.dfdf332.com\n3600hk.no-ip.org\ni.haqo.net\neu.dspmulti.com\nfget-career.com\nwww4.cedesunjerinkas.com\njohnhop77.ddns.net\naroundtheworld123.net\ntwangzhan.website\nsrgsiuhedufiusfo.ru\niim.ackng.com\nuaeihefiuaefhuhe.ru\n9.zxzx776.com\nxsdf3f.com\nw.beahh.com\ndownload.pofenglun.cn\nmage.ignorelist.com\npall.ndypkh.com\ndown.qwpkk.tw\naeiziaezieidiebg.biz\nzergbase.mooo.com\ncnc.stresser.pw\naaaaaaaaaa.re67das.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n1137\t60.28.104.130\tNAT\n1020\t60.30.186.26\tNAT\n988\t\t117.12.96.213\tNAT\n718\t\t218.68.105.24\tNAT\n596\t\t60.28.47.90\t    NAT\n352\t\t61.240.6.210\tNAT\n310\t\t121.193.161.217\tNAT\n261\t\t111.160.132.158\tNAT\n238\t\t61.181.252.146\tNAT\n221\t\t221.197.56.106\tNAT\n176\t\t60.30.199.26\tNAT\n145\t\t111.160.201.202\t\n133\t\t60.29.153.61\tNAT\n86\t\t60.30.149.10\tNAT\n79\t\t125.36.152.117\tNAT\n77\t\t117.12.134.159\tNAT\n55\t\t218.69.234.252\tNAT\n39\t\t221.197.29.110\tNAT\n38\t\t218.67.233.191\tNAT\n37\t\t117.11.225.137\tNAT\n36\t\t111.165.96.157\tNAT\n34\t\t61.181.108.2\tNAT\n33\t\t111.162.219.197\tNAT\n32\t\t60.28.156.216\t\n32\t\t117.12.1.165\tNAT\n31\t\t117.8.100.206\tNAT\n31\t\t111.164.235.52\tNAT\n31\t\t218.67.255.90\tNAT\n31\t\t117.9.17.157\tNAT\n30\t\t125.38.176.114\tNAT\n30\t\t218.68.200.50\tNAT\n30\t\t60.29.18.14\t    NAT\n30\t\t117.131.173.16\tNAT\n30\t\t221.197.12.90\tNAT\n29\t\t218.68.190.43\tNAT\n29\t\t180.213.5.10\tNAT\n27\t\t60.29.37.38\t    NAT\n25\t\t221.196.119.133\tNAT\n25\t\t111.160.91.94\tNAT\n25\t\t117.9.91.224\tNAT\n24\t\t60.28.38.14\t    NAT\n24\t\t111.164.235.232\tNAT\n23\t\t60.30.130.126\tNAT\n20\t\t111.30.30.18\tNAT\n20\t\t221.197.94.180\tNAT\n19\t\t60.29.64.22 \tNAT\n19\t\t111.165.24.101\tNAT\n18\t\t117.13.128.209\t\n18\t\t125.37.182.24\tNAT\n17\t\t117.11.147.153\tNAT\n16\t\t60.28.101.104\tNAT\n16\t\t111.164.20.30\tNAT\n15\t\t60.30.4.11\t\n15\t\t218.69.11.58\tNAT\n14\t\t60.28.101.103\tNAT\n14\t\t117.9.16.229\tNAT\n14\t\t218.69.133.37\tNAT\n14\t\t221.239.93.251\t\n13\t\t60.29.133.19\tNAT\n13\t\t60.29.208.115\t\n13\t\t60.28.250.40\tIDC\n13\t\t60.29.22.98\t    NAT\n12\t\t60.28.108.21\tNAT\n12\t\t117.9.18.246\tNAT\n12\t\t218.69.90.46\tNAT\n12\t\t60.25.11.13\t    NAT\n11\t\t111.160.156.10\tNAT\n11\t\t221.196.149.170\tNAT\n10\t\t60.29.89.34\t    NAT\n10\t\t60.29.70.132\t\n10\t\t218.68.224.88\tNAT\n10\t\t117.13.157.191\tNAT\n10\t\t60.29.31.98\t    NAT\n10\t\t60.24.140.80\tNAT\n10\t\t221.238.238.234\tNAT\n10\t\t60.29.90.230\tNAT\n9\t\t60.30.164.26\tNAT\n9\t\t60.25.251.11\tNAT\n9\t\t218.68.158.40\tNAT\n9\t\t60.26.101.13\tNAT\n8\t\t111.160.87.122\tNAT\n8\t\t218.68.107.240\tNAT\n8\t\t218.68.233.132\tNAT\n8\t\t111.164.183.91\tNAT\n8\t\t221.197.139.99\tNAT\n8\t\t221.197.122.193\tNAT\n7\t\t60.30.105.50\tNAT\n7\t\t117.9.93.13\t    NAT\n7\t\t117.11.218.223\tNAT\n7\t\t61.181.143.34\tNAT\n7\t\t60.28.41.18\t    NAT\n7\t\t60.24.189.172\tNAT\n7\t\t218.68.5.141\tNAT\n7\t\t221.196.108.115\tNAT\n7\t\t61.181.70.210\tNAT\n7\t\t111.30.35.142\tNAT\n6\t\t60.28.101.105\tNAT\n6\t\t221.198.66.44\tNAT\n6\t\t111.162.212.244\tNAT\n6\t\t111.160.233.182\tNAT\n6\t\t60.24.143.117\tNAT\n6\t\t117.9.90.145\tNAT\n6\t\t103.233.5.254\tNAT\n6\t\t218.69.129.222\tNAT\n6\t\t221.196.180.62\tNAT\n6\t\t125.38.176.178\tNAT\n6\t\t60.26.225.158\tNAT\n6\t\t60.27.31.62\t    NAT\n6\t\t218.68.234.159\tNAT\n6\t\t117.11.153.212\tNAT\n5\t\t60.30.208.226\tNAT\n5\t\t125.36.153.16\tNAT\n5\t\t111.162.149.78\tNAT\n5\t\t111.163.158.181\tNAT\n5\t\t218.69.226.106\tNAT\n5\t\t60.27.79.149\tNAT\n5\t\t221.198.170.164\tNAT\n5\t\t211.94.243.185\tNAT\n5\t\t117.9.18.2\t    NAT\n5\t\t106.47.29.70\tNAT\n5\t\t125.37.29.120\tNAT\n5\t\t60.29.145.254\tNAT\n5\t\t218.68.0.6\t    NAT\n5\t\t117.10.62.226\tNAT\n5\t\t117.12.202.189\tNAT\n5\t\t111.160.246.140\tNAT\n5\t\t61.181.74.42\tNAT\n5\t\t218.69.55.166\tNAT\n5\t\t218.69.54.167\tNAT\n5\t\t218.68.6.50\t    NAT\n5\t\t117.13.115.123\tNAT\n4\t\t211.94.254.85\tNAT\n4\t\t60.24.90.226\tNAT\n4\t\t60.26.4.19\t    NAT\n4\t\t60.28.101.106\tNAT\n4\t\t221.198.238.209\tNAT\n4\t\t111.166.237.230\tNAT\n4\t\t125.36.255.122\tNAT\n4\t\t218.68.105.7\tNAT\n4\t\t117.9.237.225\tNAT\n4\t\t61.181.103.138\tNAT\n4\t\t218.68.229.81\tNAT\n4\t\t61.181.140.42\tNAT\n4\t\t218.69.6.74\t    NAT\n4\t\t111.160.120.54\tNAT\n4\t\t60.29.93.221\tNAT\n4\t\t218.69.91.84\t\n4\t\t125.37.29.23\tNAT\n4\t\t60.24.184.70\tNAT\n4\t\t221.196.46.61\tNAT\n4\t\t117.14.119.35\tNAT\n4\t\t60.26.203.160\tNAT\n4\t\t111.163.123.7\tNAT\n4\t\t111.161.158.131\tNAT\n4\t\t111.33.17.70\tNAT\n4\t\t111.160.230.18\tNAT\n4\t\t60.27.31.0\t    NAT\n4\t\t117.12.37.223\tNAT\n4\t\t117.15.93.189\tNAT\n4\t\t117.10.124.4\tNAT\n4\t\t60.24.233.164\tNAT\n4\t\t60.28.84.197\tNAT\n4\t\t218.68.200.243\tNAT\n4\t\t218.68.219.29\tNAT\n4\t\t221.198.86.145\tNAT\n4\t\t218.69.18.147\tNAT\n4\t\t111.164.233.130\tNAT\n4\t\t111.163.143.228\tNAT\n4\t\t60.25.148.35\tNAT\n4\t\t117.15.125.181\tNAT\n4\t\t218.67.234.60\tNAT\n4\t\t125.38.176.229\tNAT\n4\t\t60.30.92.74\t    NAT\n4\t\t117.11.10.12\tNAT\n4\t\t111.160.91.250\tNAT\n3\t\t60.24.45.218\tNAT\n3\t\t60.29.154.226\tNAT\n3\t\t111.163.144.224\tNAT\n3\t\t111.161.150.34\tNAT\n3\t\t111.160.166.58\tNAT\n3\t\t111.162.163.231\tNAT\n3\t\t125.37.182.99\tNAT\n3\t\t60.29.16.94\t    NAT\n3\t\t111.163.120.92\tNAT\n3\t\t221.198.67.88\tNAT\n3\t\t117.15.192.231\tNAT\n3\t\t117.10.138.46\tNAT\n3\t\t218.69.95.90\tNAT\n3\t\t60.27.60.159\tNAT\n3\t\t117.13.168.162\tNAT\n3\t\t117.13.106.191\tNAT\n3\t\t60.29.15.2\t    NAT\n3\t\t111.165.11.60\tNAT\n3\t\t60.30.193.162\tNAT\n3\t\t60.29.43.46\t    NAT\n3\t\t117.12.146.72\tNAT\n3\t\t43.249.136.20\tNAT\n3\t\t111.165.188.122\tNAT\n3\t\t221.196.152.151\tNAT\n3\t\t111.163.144.67\tNAT\n3\t\t60.26.142.193\tNAT\n3\t\t60.29.63.18\t    NAT\n3\t\t111.160.80.3\tNAT\n3\t\t117.13.140.5\tNAT\n3\t\t117.10.236.245\tNAT\n3\t\t211.94.243.121\tNAT\n3\t\t111.165.105.247\tNAT\n3\t\t61.181.219.120\tNAT\n3\t\t123.151.34.82\tNAT\n3\t\t111.166.238.248\tNAT\n3\t\t202.99.106.47\tNAT\n3\t\t221.197.179.98\tNAT\n3\t\t211.94.226.74\tNAT\n3\t\t60.26.239.60\tNAT\n3\t\t117.9.191.22\tNAT\n3\t\t117.14.66.156\tNAT\n3\t\t61.181.202.5\t\n3\t\t218.69.78.253\tNAT\n3\t\t218.69.52.252\tNAT\n3\t\t221.196.97.11\tNAT\n3\t\t218.67.181.124\tNAT\n2\t\t221.196.194.253\tNAT\n2\t\t218.68.102.247\tNAT\n2\t\t111.165.128.30\tNAT\n2\t\t60.26.132.173\tNAT\n2\t\t125.35.249.1\tNAT\n2\t\t221.197.139.235\tNAT\n2\t\t117.15.22.130\tNAT\n2\t\t60.29.179.114\tNAT\n2\t\t221.198.80.189\t\n2\t\t111.162.216.127\tNAT\n2\t\t221.197.54.42\tNAT\n2\t\t221.197.97.39\tNAT\n2\t\t117.13.244.21\tNAT\n2\t\t111.160.198.83\tNAT\n2\t\t103.233.6.2\t\n2\t\t60.27.189.44\tNAT\n2\t\t111.160.166.189\tNAT\n2\t\t125.36.59.125\tNAT\n2\t\t211.94.248.28\tNAT\n2\t\t218.69.55.247\tNAT\n2\t\t111.160.166.206\tNAT\n2\t\t125.36.101.224\tNAT\n2\t\t111.165.56.53\tNAT\n2\t\t61.181.65.154\tNAT\n2\t\t61.181.109.234\tNAT\n2\t\t117.9.199.42\tNAT\n2\t\t221.197.133.137\tNAT\n2\t\t218.68.102.58\tNAT\n2\t\t125.37.217.118\tNAT\n2\t\t221.196.97.36\tNAT\n2\t\t61.181.103.46\tNAT\n2\t\t60.27.119.49\t\n2\t\t117.12.133.191\tNAT\n2\t\t221.198.64.35\tNAT\n2\t\t125.37.191.155\tNAT\n2\t\t221.198.60.201\tNAT\n2\t\t111.162.147.134\tNAT\n2\t\t60.25.179.50\tNAT\n2\t\t61.181.63.138\tNAT\n2\t\t60.24.127.98\tNAT\n2\t\t61.181.24.234\tNAT\n2\t\t125.37.212.67\tNAT\n2\t\t111.167.149.238\tNAT\n2\t\t221.197.154.147\tNAT\n2\t\t117.10.28.225\tNAT\n2\t\t60.30.149.102\tNAT\n2\t\t60.30.105.33\tNAT\n2\t\t111.160.97.18\tNAT\n2\t\t125.37.202.10\tNAT\n2\t\t117.9.18.201\tNAT\n2\t\t117.14.151.96\tNAT\n2\t\t60.30.156.190\tNAT\n2\t\t111.167.17.208\tNAT\n2\t\t117.15.90.239\tNAT\n2\t\t111.162.151.214\tNAT\n2\t\t111.162.154.253\tNAT\n2\t\t61.181.49.105\tNAT\n2\t\t218.68.224.39\tNAT\n2\t\t60.27.138.17\tNAT\n2\t\t117.9.70.23\t    NAT\n2\t\t221.196.180.242\tNAT\n2\t\t117.12.125.160\tNAT\n2\t\t111.162.157.177\t\n2\t\t218.68.107.108\tNAT\n2\t\t218.69.129.94\tNAT\n2\t\t111.167.46.70\tNAT\n2\t\t117.15.90.205\tNAT\n2\t\t103.233.4.26\tNAT\n1\t\t60.24.89.15\t    NAT\n1\t\t218.69.55.60\tNAT\n1\t\t117.11.239.56\tNAT\n1\t\t111.163.140.152\tNAT\n1\t\t111.160.108.34\tNAT\n1\t\t60.29.140.66\tNAT\n1\t\t202.99.69.243\t\n1\t\t221.196.194.2\tNAT\n1\t\t60.27.42.62\t    NAT\n1\t\t60.24.188.12\tNAT\n1\t\t117.8.101.63\tNAT\n1\t\t218.69.147.133\tNAT\n1\t\t111.163.22.227\tNAT\n1\t\t111.160.118.230\tNAT\n1\t\t111.167.144.199\tNAT\n1\t\t60.29.154.210\tNAT\n1\t\t221.196.227.20\tNAT\n1\t\t60.28.38.18\t    NAT\n1\t\t60.29.77.203\tNAT\n1\t\t60.29.153.45\tNAT\n1\t\t125.38.191.184\tNAT\n1\t\t221.198.236.232\tNAT\n1\t\t60.25.10.147\tNAT\n1\t\t111.164.209.21\tNAT\n1\t\t218.67.254.17\tNAT\n1\t\t60.30.180.150\tNAT\n1\t\t111.160.70.203\tNAT\n1\t\t111.160.70.201\tNAT\n1\t\t60.29.116.18\tNAT\n1\t\t60.30.215.242\tNAT\n1\t\t111.162.152.192\tNAT\n1\t\t60.29.95.82\t    NAT\n1\t\t111.160.166.186\tNAT\n1\t\t117.9.229.148\tNAT\n1\t\t61.181.60.34\tNAT\n1\t\t221.198.118.158\tNAT\n1\t\t60.28.135.3\t    NAT\n1\t\t60.25.63.52\t    NAT\n1\t\t111.160.97.42\tNAT\n1\t\t117.12.144.7\tNAT\n1\t\t111.162.221.168\tNAT\n1\t\t221.198.110.209\tNAT\n1\t\t61.181.83.10\tNAT\n1\t\t221.197.84.199\tNAT\n1\t\t60.29.179.42\tNAT\n1\t\t60.29.77.194\tNAT\n1\t\t60.27.174.82\tNAT\n1\t\t111.166.156.237\tNAT\n1\t\t60.29.30.190\tNAT\n1\t\t117.12.133.124\tNAT\n1\t\t117.13.140.144\tNAT\n1\t\t218.69.243.164\tNAT\n1\t\t218.69.11.110\tNAT\n1\t\t111.165.133.156\tNAT\n1\t\t111.162.163.241\tNAT\n1\t\t221.197.252.248\tNAT\n1\t\t60.28.250.46\tIDC\n1\t\t60.27.133.165\tNAT\n1\t\t111.167.211.108\tNAT\n1\t\t111.160.70.204\tNAT\n1\t\t60.30.240.226\tNAT\n1\t\t221.197.29.195\tNAT\n1\t\t125.36.145.207\tNAT\n1\t\t60.27.79.17\t    NAT\n1\t\t125.37.125.3\tNAT\n1\t\t60.30.172.82\tNAT\n1\t\t117.131.145.156\tNAT\n1\t\t111.30.85.18\tNAT\n1\t\t221.198.218.112\tNAT\n1\t\t117.14.13.25\tNAT\n1\t\t117.14.70.156\tNAT\n1\t\t111.163.143.193\tNAT\n1\t\t111.160.216.87\tNAT\n1\t\t60.28.101.126\tNAT\n1\t\t60.29.185.242\tNAT\n1\t\t111.163.78.80\tNAT\n1\t\t125.37.182.185\tNAT\n1\t\t117.15.191.57\tNAT\n1\t\t111.160.104.66\tNAT\n1\t\t221.197.162.54\tNAT\n1\t\t211.94.242.118\tNAT\n1\t\t125.37.162.103\tNAT\n1\t\t117.8.100.70\tNAT\n1\t\t117.15.214.65\tNAT\n1\t\t125.38.177.138\tNAT\n1\t\t60.30.204.26\tNAT\n1\t\t60.27.205.187\tNAT\n1\t\t117.12.158.82\tNAT\n1\t\t60.26.180.205\tNAT\n1\t\t111.165.72.25\tNAT\n1\t\t61.181.125.37\tNAT\n1\t\t60.29.0.101\t    NAT\n1\t\t60.25.16.184\tNAT\n1\t\t111.30.78.46\tNAT\n1\t\t111.160.40.106\tNAT\n1\t\t117.15.138.221\tNAT\n1\t\t111.161.189.215\tNAT\n1\t\t111.160.80.250\tNAT\n1\t\t103.233.4.29\tNAT\n1\t\t221.239.72.170\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.bondat\n\n利用受害机器资源 进行门罗币挖矿，并组建一个攻击WordPress站点的僵尸网络。\n\n##### IOCs\n\n```\nurchintelemetry.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n8\t\t117.9.92.217\tNAT\n2\t\t60.30.105.33\tNAT\n2\t\t61.181.88.218\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.storm\n\n针对Windows平台的DDoS类型的botnet家族。\n\n##### IOCs\n\n```\nwww.mojimojimojimoji.com\nwww.ody.cc\nimddos.my03.com\n```\n\n##### Clients\n```\nCount   Client          TAGS\n432\t\t125.36.152.117\tNAT\n425\t\t111.160.156.10\tNAT\n315\t\t61.181.252.146\tNAT\n34\t\t111.160.182.10\tNAT\n19\t\t111.160.132.158\tNAT\n11\t\t218.68.105.191\tNAT\n10\t\t117.15.53.253\tNAT\n8\t\t218.68.228.63\tNAT\n8\t\t60.27.104.153\tNAT\n7\t\t117.13.140.144\tNAT\n5\t\t61.181.125.37\tNAT\n5\t\t60.28.101.104\tNAT\n4\t\t221.198.64.35\tNAT\n3\t\t111.163.12.68\tNAT\n2\t\t117.11.239.138\tNAT\n2\t\t111.164.47.25\t\n2\t\t125.37.162.103\tNAT\n2\t\t117.9.90.137\tNAT\n1\t\t111.162.102.7\tNAT\n1\t\t60.24.244.41\tNAT\n1\t\t61.240.5.226\tNAT\n1\t\t111.162.12.44\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.Morto\n\n一款蠕虫病毒，通过爆破内网、外网主机的RDP密码，登陆到受害主机，进行自我复制并运行，来实现病毒的传播。\n\n##### IOCs\n\n```\nms.jifr.net\nms.jifr.co.cc\nms.jifr.co.be\ndos1.jifr.net\nms.jifr.info\nflt1.jifr.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n506\t\t218.69.16.26\tNAT\n241\t\t60.29.174.70\tNAT\n219\t\t60.29.173.226\tNAT\n194\t\t60.24.189.11\tNAT\n162\t\t60.30.57.29\t    NAT\n106\t\t111.164.41.211\tNAT\n75\t\t117.131.175.138\tNAT\n69\t\t111.160.186.146\tNAT\n45\t\t218.68.156.51\tNAT\n27\t\t125.36.228.182\tNAT\n20\t\t125.36.228.187\tNAT\n16\t\t125.36.228.184\tNAT\n```\n\n\n</br>\n\n\n\n#### Malware.Mylobot\n\nmylobot是针对Windows的malware，属于downloader类型，用于在感染机器上下载和安装其它的malware。\n\n##### IOCs\n\n```\nm16.pseyumd.ru\nm11.pseyumd.ru\nm25.oxduwil.com\nm20.oxduwil.com\nm0.fnjxpwy.com\nm32.oqemwbj.in\nv2.otwzgnl.ru\nm0.zqfqjwd.biz\nm34.oxduwil.com\nm34.oqemwbj.in\nm28.oqemwbj.in\nm16.oqemwbj.in\nv2.baidupic.net\n```\n\n##### Clients\n```\nCount   Client          TAGS\n12\t\t60.28.101.104\tNAT\n4\t\t60.28.101.103\tNAT\n2\t\t60.25.16.92\t    NAT\n1\t\t117.11.239.72\tNAT\n1\t\t60.28.101.105\tNAT\n```\n\n\n</br>\n\n\n### 未知恶意\n\n基于360安全大脑的云端数据，我们DNSMon系统会实时监测各种未知的恶意和高度可疑的域名，包括各种未知APT和Botnet等等，这些被归为 DNSMon.gray 以及 DNSMon.black 类别。\n\n由于客户端数据太大，且具体的恶意行为需要其他维度数据关联分析，在此暂时不展开。\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}