IOC du rapport source : https://blog.synapticsystems.de/north-koreas-hangro-revisited
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	aeoncredit[.]com[.]cn	active
domain	futurere[.]com[.]kp	active
domain	hero-huishan[.]cn	active
domain	hero-huishan[.]com	active
domain	kevin[.]com	active
domain	lnnk[.]com	active
domain	nkinternet[.]com	active
domain	silibank[.]com	active
ipv4	175[.]45[.]176[.]21	active
ipv4	175[.]45[.]176[.]22	active
ipv4	175[.]45[.]176[.]32	active
ipv4	175[.]45[.]177[.]33	active
ipv4	175[.]45[.]178[.]56	active
ipv4	175[.]45[.]178[.]57	active
ipv4	188[.]43[.]136[.]115	active
ipv4	188[.]43[.]136[.]116	active
ipv4	218[.]24[.]140[.]88	active
ipv4	218[.]24[.]140[.]94	active
ipv4	218[.]24[.]140[.]95	active
ipv4	218[.]24[.]161[.]240	active
ipv4	218[.]24[.]161[.]247	active
ipv4	218[.]25[.]125[.]144	active
ipv4	218[.]25[.]125[.]150	active
ipv4	218[.]25[.]125[.]158	active
ipv4	218[.]25[.]125[.]159	active
ipv4	218[.]25[.]171[.]88	active
ipv4	218[.]25[.]171[.]89	active
ipv4	218[.]25[.]43[.]208	active
ipv4	218[.]25[.]43[.]211	active
ipv4	218[.]25[.]43[.]212	active
ipv4	218[.]25[.]43[.]223	active
ipv4	61[.]189[.]49[.]233	active
ipv4	61[.]189[.]49[.]234	active
ipv4	61[.]189[.]49[.]240	active
sha256	5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b	active
sha256	b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01	active
url	hxxp[:]//silibank[.]com/fog/update_files/	active