Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
1 contributor

Users who have contributed to this file

207 lines (205 sloc) 12.8 KB
APPENDIX A:
203 URLS THAT RETURNED SHADE (TROLDESH) RANSOMWARE EXE FROM 2019-03-01 THROUGH 2019-04-24:
hxxp://333media[.]co[.]uk/.tmb/inf.inf
hxxp://3faddi.000webhostapp[.]com/wp-content/themes/shapely/inc/custom-controls/hp.gf
hxxp://abcstudio[.]sk/wp-content/themes/fusion-base/fonts/msg.jpg
hxxp://abyaz[.]ir/wp-content/themes/woodstock/js/1.pdf
hxxp://acffiorentina[.]ru/assets/1.pdf
hxxp://actinix[.]com/wp-content/themes/ultra/images/msg.jpg
hxxp://adelekeoluwakemiandco[.]com/wp-content/themes/twentyseventeen/inc/inf.inf
hxxp://afterstars.000webhostapp[.]com/wp-content/themes/twentyseventeen/assets/css/hp.gf
hxxp://agava[.]ee/wp-content/themes/graphene/bootstrap-rtl/1.pdf
hxxp://alpadegra[.]pe/wp-content/themes/mesmerize/customizer/css/hp.gf
hxxp://ambulatorium[.]sk/wp-admin/css/colors/blue/hp.gf
hxxp://amsr[.]ma/templates/businessplan/html/com_contact/categories/msg.jpg
hxxp://andyburkholder[.]com/wordpress/wp-admin/css/colors/blue/hp.gf
hxxp://andyliotta[.]com/wp-content/themes/musicpro/js/cookie/msg.jpg
hxxp://anselmi[.]at/templates/rt_hadron/css-compiled/hp.gf
hxxp://anyadavidson[.]com/wordpress/wp-admin/css/colors/blue/hp.gf
hxxp://app.expalglobal[.]com/upload/items/img/1.pdf
hxxp://arbanstore[.]com/wp-admin/css/colors/blue/hp.gf
hxxp://arbanstore[.]com/wp-admin/css/colors/blue/inf.inf
hxxp://archiaidbd[.]com/templates/shaper_helix3/css/presets/inf.inf
hxxp://ascentprint[.]ru/scripts/1.pdf
hxxp://auroradx[.]com/adxwp/wp-content/backups-dup-pro/tmp/gr.mpwq
hxxp://auroradx[.]com/adxwp/wp-content/nfwlog/cache/hp.gf
hxxp://automodernshop[.]com/.quarantine/inf.inf
hxxp://b-compu[.]de/templates/conext/content_images_source/msg.jpg
hxxp://b-compu[.]de/templates/conext/html/com_contact/contact/msg.jpg
hxxp://balloflightning[.]com/wp-content/themes/vigilance/css/msg.jpg
hxxp://bamferproductions[.]com/GeneratedItems/1.pdf
hxxp://banzay[.]com/wp-content/themes/di-blog/languages/msg.jpg
hxxp://bbbrown[.]com/wp-content/themes/twentyten/languages/msg.jpg
hxxp://berkaytulpar[.]com[.]tr/inf.inf
hxxp://bitcoinqrgen[.]com/wp-content/ai1wm-backups/hp.gf
hxxp://bjlaser[.]com/templates/outsourcing-fjt/html/com_contact/contact/msg.jpg
hxxp://britishcollege[.]edu[.]lk/.well-known/acme-challenge/inf.inf
hxxp://bursabowling[.]com/templates/rt_myriad/custom/1.pdf
hxxp://canadianpricespharmacy[.]xyz/wp-content/themes/maxshop/images/hp.gf
hxxp://capablecanines[.]org/wp-content/themes/Divi/css/hp.gf
hxxp://clubdelideres[.]org/font-awesome/css/hp.gf
hxxp://coastalcrestgroup[.]com/wp-content/themes/betheme/assets/animations/hp.gf
hxxp://conozcatlanta[.]com/.well-known/acme-challenge/hp.gf
hxxp://consultantlegality[.]com/wp-content/themes/llorix-one-lite/css/hp.gf
hxxp://costiran[.]com/wp-admin/css/colors/blue/inf.inf
hxxp://crlagoa.cdecantanhede[.]pt/wp-admin/css/colors/blue/hp.gf
hxxp://customercarelist[.]info/wp-content/themes/Newspaper/parts/footer/hp.gf
hxxp://cvpass[.]net/wp-content/themes/twentyseventeen/assets/css/inf.inf
hxxp://damyo[.]co[.]kr/wp-content/themes/enfold/config-gravityforms/hp.gf
hxxp://damyo[.]co[.]kr/wp-content/themes/enfold/lang/hp.gf
hxxp://davanaweb[.]com/wp-content/themes/arras-theme/@eaDir/hp.gf
hxxp://davidgillettephotography[.]com/wp-content/themes/boilerplate/boilerplate-admin/inf.inf
hxxp://demo.art-of-digital[.]com/yoga/2018/12/24/live-a-perfect-life/feed/inf.inf
hxxp://dicaconsultores[.]com/wp-content/themes/empowerment/inc/msg.jpg
hxxp://dnz17[.]in[.]ua/tmp/inf.inf
hxxp://dongavienthong[.]com/wp-includes/ID3/inf.inf
hxxp://donmago[.]com/wp-content/themes/betheme/js/parallax/msg.jpg
hxxp://dresscollection[.]ru/errors/default/css/msg.jpg
hxxp://ekolog[.]org/687a0eb9e70069aa3c7f5a7bc1b08bf0/msg.jpg
hxxp://elurnsummit[.]com/wp-content/themes/writee/templates/inf.inf
hxxp://emfbd[.]org/wp-content/themes/frontier/includes/genericons/hp.gf
hxxp://enaghsh[.]ir/wp-content/themes/mweb-digiland/dokan/hp.gf
hxxp://entrepreneurspider[.]com/wp-content/themes/astra/languages/inf.inf
hxxp://escwireless[.]com/templates/jm-0013/css/gr.mpwq
hxxp://eurotecheu[.]com/wp-content/themes/skt-solar-energy/js/inf.inf
hxxp://farmworldtech[.]com/wp-content/themes/generatepress/inc/customizer/controls/css/1.pdf
hxxp://fcbiolog[.]com/errordocs/style/inf.inf
hxxp://fenapro.org.br/templates/ja_edenite/css/colors/msg.jpg
hxxp://flashsale88[.]com/wp-admin/css/colors/blue/inf.inf
hxxp://flirtwithclassdemo.racevmarketing[.]com/wp-admin/css/colors/blue/1.pdf
hxxp://foodera[.]co/wp-admin/css/colors/blue/1.pdf
hxxp://forestandseaclub.racevmarketing[.]com/wp-content/cache/et/26/1.pdf
hxxp://frenchdoitbetter[.]my/wp-includes/ID3/hp.gf
hxxp://gimnazjum-zawichost[.]pl/dokumenty/mlody_naukowiec/msg.jpg
hxxp://gpcezhukone[.]org/templates/rt_audacity/html/com_content/archive/hp.gf
hxxp://greenerpathway[.]info/wp-admin/css/colors/blue/gr.mpwq
hxxp://grunert[.]biz/wp-content/themes/sydney/languages/hp.gf
hxxp://hamayeshgroup[.]com/.well-known/pki-validation/inf.inf
hxxp://hitechontheweb[.]com/wp-content/themes/advanced-twenty-seventeen-child/template-parts/footer/inf.inf
hxxp://importfish[.]ru/dynamic/msg.jpg
hxxp://inhome.theadleaf[.]net/wordpress/inf.inf
hxxp://innovationsolarinc[.]com/wp-content/themes/isi/bbpress/inf.inf
hxxp://instanttechnology[.]com[.]au/wp-content/themes/skyline/inc/footers/inf.inf
hxxp://invokeshop[.]com/wp-content/ai1wm-backups/inf.inf
hxxp://iqra[.]tn/fbs/hp.gf
hxxp://iqra[.]tn/wp-admin/css/colors/blue/hp.gf
hxxp://isfacca[.]ir/IrSans/css/inf.inf
hxxp://jazarah[.]net/wp-content/themes/truemag/admin/assets/css/msg.jpg
hxxp://jbrealestategroups[.]com/wp-content/themes/bridge/export/msg.jpg
hxxp://jgcarpetcleaning[.]com/wp-content/themes/bb-theme/classes/1.pdf
hxxp://joeksdj[.]nl/VT555/_vti_cnf/msg.jpg
hxxp://kean3[.]com/.well-known/pki-validation/hp.gf
hxxp://khabbas[.]com/wp-content/themes/twentyseventeen/inc/hp.gf
hxxp://kokkelering[.]no/wp-content/themes/Divi/core/admin/css/inf.inf
hxxp://koren[.]cc/wp-content/themes/twentyseventeen/template-parts/footer/inf.inf
hxxp://languardia[.]ru/wp-content/languages/plugins/msg.jpg
hxxp://leamoreconstruction[.]com/wp-content/themes/buildplus/admin/1.pdf
hxxp://liliatomova[.]com/wp-includes/ID3/1.pdf
hxxp://linetours[.]ru/wp-content/themes/untitled/styles/msg.jpg
hxxp://louismoreno[.]com/wp-content/themes/asterion/page-templates/msg.jpg
hxxp://magicsounds[.]net/wp-admin/css/colors/blue/1.pdf
hxxp://mail.333media[.]co[.]uk/public_html/plugins/acl/localization/inf.inf
hxxp://mail.360cleaning[.]co[.]uk/skins/classic/images/buttons/hp.gf
hxxp://mail.360cleaning[.]co[.]uk/wp_caden_package_1.3/Licensing/inf.inf
hxxp://mail.creativerentacar[.]com/installer/images/inf.inf
hxxp://mail.creativetravelworld[.]com/plugins/acl/localization/hp.gf
hxxp://mail.zadiaks90[.]com/installer/images/inf.inf
hxxp://makeupp[.]site/wp-content/themes/twentysixteen/genericons/1.pdf
hxxp://makeupp[.]site/wp-content/themes/twentysixteen/genericons/inf.inf
hxxp://mapsu[.]org/awstats/msg.jpg
hxxp://marathonbuilding[.]com/wp-content/themes/Marathon20140204a/images/msg.jpg
hxxp://marketingcoachth[.]com/wp-admin/css/colors/blue/msg.jpg
hxxp://meeweb[.]com/admin/swfupload/css/inf.inf
hxxp://meurls[.]xyz/wp-content/plugins/ad-ace/assets/css/fonts/iconfont/msg.jpg
hxxp://miumilkshop[.]com/wp-includes/ID3/hp.gf
hxxp://mmonteironavegacao[.]com[.]br/blog/category/msg.jpg
hxxp://montaneproperties[.]co[.]za/cache/1.pdf
hxxp://musiciansassociationofthephilippines[.]com/wp-includes/ID3/inf.inf
hxxp://muslimlifestyleexpo[.]info/wp-content/themes/singlepage/languages/1.pdf
hxxp://myclientsdemo[.]com/cannadyz/css/hp.gf
hxxp://nest[.]sn/wp-content/themes/education-web/languages/msg.jpg
hxxp://new4.pipl[.]ua/.well-known/acme-challenge/inf.inf
hxxp://noblechild[.]com/wp-content/themes/mt-dark/languages/hp.gf
hxxp://northernoceanmarine[.]com/wp-content/themes/nom/images/hp.gf
hxxp://northernoceanmarine[.]com/wp-content/themes/nom/images/inf.inf
hxxp://novotravel[.]ir/wp-snapshots/hp.gf
hxxp://oestervraafys.dk/templates/rt_cygnet/fields/hp.gf
hxxp://orielliespinoza[.]com/wp-content/themes/rara-business/images/hp.gf
hxxp://orielliespinoza[.]com/wp-content/themes/rara-business/inc/css/hp.gf
hxxp://ozemag[.]com/wp-content/themes/emag/template-parts/msg.jpg
hxxp://panamacitybeachcondosforsale[.]net/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/hp.gf
hxxp://pitbullcreative[.]net/wp-content/themes/alyeska/lang/hp.gf
hxxp://pixonet[.]ir/wp-snapshots/hp.gf
hxxp://plasticbottle-factory[.]com/wp-content/themes/baiila/fonts/hp.gf
hxxp://prathmeshbiotech[.]com/templates/jd_miami/css/presets/inf.inf
hxxp://precision[.]bc[.]ca/wp-content/themes/precision/colors/hp.gf
hxxp://prigo[.]com/bluewhale/hp.gf
hxxp://rayaxiaomi[.]com/wp-content/themes/abchlik/widgets/hp.gf
hxxp://repairinc.wsid[.]net/wp-admin/css/colors/blue/inf.inf
hxxp://rickspringfield[.]jp/PHOTOS/PHOTOS_files/msg.jpg
hxxp://robinchahal[.]com/ftp/msg.jpg
hxxp://rockett[.]net/wp-content/themes/simplemag/formats/hp.gf
hxxp://ryzconstruccionesciviles[.]com/wp-content/themes/spacious/font-awesome/css/inf.inf
hxxp://sabbath.weswesmusic[.]com/wp-includes/ID3/hp.gf
hxxp://sagami-suisan[.]com/wpBK/msg.jpg
hxxp://schwimmerforum[.]de/archive/hp.gf
hxxp://shop.albertgrafica[.]com[.]br/vqmod/install/msg.jpg
hxxp://smarthost.kiev[.]ua/templates/sunshine/css/msg.jpg
hxxp://snowfeel[.]in/wp-admin/css/colors/blue/hp.gf
hxxp://solutionpc[.]be/modules/php/1.pdf
hxxp://spidernet.comuv[.]com/wp-content/themes/twentyseventeen/inc/inf.inf
hxxp://standard-cement[.]kz/hp.gf
hxxp://stilldesigning[.]com/wp-content/themes/stilldesigning-2014/css/hp.gf
hxxp://subastaomarwheels[.]com/wp-content/themes/revo/css/fancy/hp.gf
hxxp://szimano[.]org/wordpress/wp-admin/css/colors/blue/1.pdf
hxxp://tanmoy[.]xyz/wp-content/themes/sility/files/hp.gf
hxxp://tasooshi[.]com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/msg.jpg
hxxp://tasooshi[.]com/wp-content/themes/astra/inc/addons/transparent-header/assets/js/minified/msg.jpg
hxxp://taxi-kazan[.]su/administrator/cache/msg.jpg
hxxp://telebriscom[.]cl/wp-content/themes/fitness-wellness/languages/msg.jpg
hxxp://thabazimbi[.]net/css/1.pdf
hxxp://thaisell[.]com/AM/hp.gf
hxxp://thefourthseasona-1-z[.]com/wp-includes/ID3/1.pdf
hxxp://thegioibds[.]net/wp-includes/ID3/1.pdf
hxxp://thelearningcompany[.]com[.]au/templates/eventus2/images/presets/default/inf.inf
hxxp://tilmenyoresel[.]com/catalog/controller/account/inf.inf
hxxp://tntnailswoodlands[.]com/wp-admin/css/colors/blue/hp.gf
hxxp://tntnailswoodlands[.]com/wp-admin/css/colors/blue/inf.inf
hxxp://tosama[.]de/templates/jsn_artista_pro/js/inf.inf
hxxp://tourview[.]ir/wp-includes/ID3/hp.gf
hxxp://trdesign[.]org/themes/bartik/color/1.pdf
hxxp://tugaukina[.]com/wp-content/themes/sahifa/framework/admin/images/inf.inf
hxxp://twosisterstravelco[.]com/wp-content/themes/uncode/languages/hp.gf
hxxp://tyger[.]ro/wp-content/themes/twentysixteen/inc/inf.inf
hxxp://unoppressive-operat.000webhostapp[.]com/wp-content/themes/zerif-lite/images/hp.gf
hxxp://varfolomeev[.]ru/cgi-bin/msg.jpg
hxxp://veganwarrior.racevmarketing[.]com/wp-content/cache/et/8/1.pdf
hxxp://vehiclescanner[.]co[.]uk/.quarantine/hp.gf
hxxp://visionfirst[.]site/wp-admin/css/colors/blue/gr.mpwq
hxxp://visitjourney[.]org/wp-content/plugins/admin-menu-editor/ajax-wrapper/hp.gf
hxxp://vlakvarkproductions[.]co[.]za/.well-known/acme-challenge/inf.inf
hxxp://voasi[.]com/wp-content/themes/twentyseventeen/assets/css/msg.jpg
hxxp://www.333media[.]co[.]uk/wp-content/plugins/Plugin/Licensing/inf.inf
hxxp://www.baumont[.]fr/wp-content/themes/dt-the7/languages/hp.gf
hxxp://www.djyan[.]net/administrator/cache/inf.inf
hxxp://www.eliasmetal[.]co[.]il/wp-content/languages/plugins/1.pdf
hxxp://www.glitzygal[.]net/wp-content/themes/FreshClean/includes/msg.jpg
hxxp://www.gran-premio[.]es/wp-content/themes/elastico/functions/css/hp.gf
hxxp://www.gran-premio[.]es/wp-content/themes/elastico/js/hp.gf
hxxp://www.illustr8design[.]co[.]uk/wp-content/themes/illustr8black/font/hp.gf
hxxp://www.insidepoolmag[.]com/wp-content/themes/vidorev/page-templates/msg.jpg
hxxp://www.krayot[.]ru/includes/hp.gf
hxxp://www.krohm[.]net/wp-content/themes/Flexible_old/css/hp.gf
hxxp://www.leamoreconstruction[.]com/wp-content/themes/buildplus/admin/1.pdf
hxxp://www.mashmul[.]ir/components/com_ajax/hp.gf
hxxp://www.phazethree[.]com/wp-content/themes/customizr/inc/admin/css/msg.jpg
hxxp://www.plasticbottle-factory[.]com/wp-content/themes/baiila/fonts/hp.gf
hxxp://www.scottpatton[.]com/birthday/hp.gf
hxxp://www.scottpatton[.]com/img/common/hp.gf
hxxp://www.sey-org[.]com/wp-content/themes/frindle/templ/msg.jpg
hxxp://www.soundtel[.]com/cgi-bin/msg.jpg
hxxp://www.thecustomboxeshelp[.]com/wp-content/themes/Newspaper/mobile/amp/css/inf.inf
hxxp://www.x-ng[.]de/wp-content/themes/my-vcard-resume/vendors/bootstrap/css/hp.gf
hxxp://www.xfreaks[.]at/templates/reinhard4/css/inf.inf
hxxp://zipcarbahamas[.]com/wp-admin/css/colors/blue/inf.inf
hxxp://zzb[.]kz/libraries/cms/captcha/hp.gf
You can’t perform that action at this time.