AVrecon_IOCs.txt

AVrecon Sample
MD5:3ed1a6d57f00c1643cc85e049c82d1b4
SHA-1:e2856999ebac2af79ae812f1b8315754afdaa818
SHA-256:3d43f5b3b2c9142ca0c5cdc4a82f9088e090d077ef61c2297c51b4ccd3085d78

1st Stage Domains
utcp[.]cc
cleandone[.]cc

2nd Stage Servers (active prior to publication)
188.138.70[.]19 
85.25.217[.]95
148.72.155[.]174
148.72.155[.]189
188.138.41[.]157
50.30.36[.]27
209.126.105[.]43
155.254.23[.]254
50.30.36[.]132
139.59.231[.]113
209.126.107[.]197
148.72.155[.]187
69.64.55[.]106
148.72.155[.]112
85.25.214[.]74

2nd Stage Servers (used post-publication)
62.138.18[.]50
85.25.103[.]5
148.72.144[.]19
148.72.155[.]77
87.119.223[.]21
62.138.0[.]10
92.42.106[.]1
69.64.55[.]103
209.126.105[.]225

2021 AVrecon Samples/Domains
MD5:f81b9fceea2056ba2c3f261b56f577b1
SHA-1:96f5a4e67dc29da93cefab27dd56e20075fea19e
SHA-256:cfd3d123595fba37ec414b90cfa834753ad9ab2149651d48948e04875aecac98

MD5:8dcaf0e2a0baf54e65f46689b2a845ef
SHA-1:99e3b1616008106c89978d1c5fafdc3da2abc873
SHA-256:f18ddb10b3f9044fa2f9d1bb5152e388d4f68c2209165b117135fb2490243d2b
zerophone[.]cc