Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme

IP Address

88.86.124.114

185.100.87.116

185.100.87.223

213.218.160.48

Hash

852322e063872a025b711d5adf08531eac36a265

11f9fb29f2cc142e81c804f53599ae36282c95b3

50cf07b97ef999e9fc5c7efae19d0e5f39db39fa

850680506df7892d43b3382f0f89a06ef18837c7

1371b2b2da10ed178d26a7aad191634553f865ae

91e66d640b2a570bd83b408b51ebbf21e95e7469

39060c673aefa0902cb5fc787fa53364cad9ed6f

e2e836d16a1b50d4d091f7ae507b82c0a8e05376

56b819cb285dbdbc307268b4fadbddaa61319bb8

a1574476a616599a202cc731a6d5dbf9b3a635f0

48d011117eacf57128c7e473bb5d4d69e3d41ef6

ec730da64f9feae4259ebc88113c5cebdf2b1ad7

8e665c12b7d8e80c72d86ed4425663ecd74e453c

67e2a1e8ab963086bb768b28307cf58dadb0acc7

294ecf0550308dff9df0eea86ca127c064b3bfb8

65ca7e9363539282c2670dfab100b75c9bfb6253

dfd19ee8b550f21b99d63ce87d039d1e8e1e111b

217ab41d543278d0ecce797a71ef38a6bc1493fe

82a35dd0ec20791bc3161a87fdb6caa68fd3d4a6

6feeba25748996d3928f11ef774122e02b4b8850

1eac0c636edf181eec0315ffe3b5b1e310b1a352

ea2be784b2c08cd6f116e14079d6583ba606c556

e05575afe5a01d150daa8b4bb935213cc0e538f6

193078cda795dc2f12983e9b66821f7e67c6495d

38ca1bc31ccdc1c650720abd76bcc619532c0166

22fa5c967b0775c3f3398dcf5dbb46ff80e1708b

bce3d9b06a3fc2312fe5be213f3d98b9350c9b22

bc2bce53d71533c2eb1ccc30ef252ea2774d0100

a72089566a711ed0781d5a36e3c289de0de13e2d

25d096b74ab643ed1669c5d942f93677d7fdfdd30def6e0dfac4f8062b4a0af0

b7620d95bed4cff8ab8dc779f2295badb8009a2b5aa59cee7f971c1abc33d16b

bd50868665605df7332702b7d70942cf63f273a88c99c4a7384deb72d31611aa

ca90a2f7ee0e0aaa15f1fac214a71c616a10d3f96428b0c1afa975d2f3f43cb6

60294bf6be02361fa989de9d504f1e11563a34d45db5be5b74868e80fdb2a41f

3b98169f7d9f8a25f466c64a63074f5c09901ad568be89b8dba28018898a0f8b

17f8231dcfdeee8ff3aa14b97375ba6a55e1fee500833e2d6191713a2ddc0a90

1c2da449573b8355c68d7fb16b6fda3c010ba224952374bd02b6d8e0a3b5a03b

3f0eea6c320e0d5c1ad83a00c02d3ac20dc4ef9e6204d7866211cb315436e0b2

43410e4d540d83fb46a9e745950217073464fa79b74601b8542fa98127c5f36f

4b51b11b4f3548f5c69ceacbe6e8ea89dfea0ee74ae373e5f02616b53caaf9cf

53831b969f257da4fd13966fbebbd793e052e71b901a748405f7560ba1c117ff

5a0c716f0264ece8fa7a90b498886cb34eb8785da34724d4001c2b67abacb4e1

66e4174630c8ff3d2f7236b6b3bb3201a82655cc6a9d39702b8ab243cabea2dc

6aefddd5825d27b2f5c3c3ef339d0731fda0757f50fd843d9909728622f174ec

e9f0a03dff09df07f830877ad49109ed47bbaaea184c4c9f046202d73f0932e1

ee91767b80e5b1545777672f3596d6960281bdc3f27abe66c563370ab6dc9125

22f01c554cdbb22afe10a12c55a446efc5fed2a4309196a4a298147b6655b121

653201819cb651d397c8c01f36036cd317e53dd1eb61a337051f246a3008a11f

85c1e56dcd1f6228915262b55ac29c9d5ec83542b0e7ac66fedee6be5f689be1

ab91a5d6365a21b89a0cee76148abb4fe98b05b4a0c8cea99f3934a12b9bd432

e5701b3ec6b8d1132295098f1544a5ac98617eb9d188db7f625627cb57c1895d

Detection Query 1 :

dstipaddress IN ("185.100.87.116","88.86.124.114","185.100.87.223","213.218.160.48") or srcipaddress IN ("185.100.87.116","88.86.124.114","185.100.87.223","213.218.160.48")

Detection Query 2 :

sha1hash IN ("850680506df7892d43b3382f0f89a06ef18837c7","56b819cb285dbdbc307268b4fadbddaa61319bb8","6feeba25748996d3928f11ef774122e02b4b8850","50cf07b97ef999e9fc5c7efae19d0e5f39db39fa","294ecf0550308dff9df0eea86ca127c064b3bfb8","8e665c12b7d8e80c72d86ed4425663ecd74e453c","217ab41d543278d0ecce797a71ef38a6bc1493fe","91e66d640b2a570bd83b408b51ebbf21e95e7469","1eac0c636edf181eec0315ffe3b5b1e310b1a352","65ca7e9363539282c2670dfab100b75c9bfb6253","11f9fb29f2cc142e81c804f53599ae36282c95b3","1371b2b2da10ed178d26a7aad191634553f865ae","67e2a1e8ab963086bb768b28307cf58dadb0acc7","e2e836d16a1b50d4d091f7ae507b82c0a8e05376","ec730da64f9feae4259ebc88113c5cebdf2b1ad7","852322e063872a025b711d5adf08531eac36a265","48d011117eacf57128c7e473bb5d4d69e3d41ef6","a1574476a616599a202cc731a6d5dbf9b3a635f0","39060c673aefa0902cb5fc787fa53364cad9ed6f","ea2be784b2c08cd6f116e14079d6583ba606c556","82a35dd0ec20791bc3161a87fdb6caa68fd3d4a6","dfd19ee8b550f21b99d63ce87d039d1e8e1e111b","e05575afe5a01d150daa8b4bb935213cc0e538f6","193078cda795dc2f12983e9b66821f7e67c6495d","38ca1bc31ccdc1c650720abd76bcc619532c0166","22fa5c967b0775c3f3398dcf5dbb46ff80e1708b","bce3d9b06a3fc2312fe5be213f3d98b9350c9b22","bc2bce53d71533c2eb1ccc30ef252ea2774d0100","a72089566a711ed0781d5a36e3c289de0de13e2d")

Detection Query 3 :

sha256hash IN ("22f01c554cdbb22afe10a12c55a446efc5fed2a4309196a4a298147b6655b121","1c2da449573b8355c68d7fb16b6fda3c010ba224952374bd02b6d8e0a3b5a03b","6aefddd5825d27b2f5c3c3ef339d0731fda0757f50fd843d9909728622f174ec","3b98169f7d9f8a25f466c64a63074f5c09901ad568be89b8dba28018898a0f8b","53831b969f257da4fd13966fbebbd793e052e71b901a748405f7560ba1c117ff","25d096b74ab643ed1669c5d942f93677d7fdfdd30def6e0dfac4f8062b4a0af0","e5701b3ec6b8d1132295098f1544a5ac98617eb9d188db7f625627cb57c1895d","bd50868665605df7332702b7d70942cf63f273a88c99c4a7384deb72d31611aa","b7620d95bed4cff8ab8dc779f2295badb8009a2b5aa59cee7f971c1abc33d16b","4b51b11b4f3548f5c69ceacbe6e8ea89dfea0ee74ae373e5f02616b53caaf9cf","66e4174630c8ff3d2f7236b6b3bb3201a82655cc6a9d39702b8ab243cabea2dc","60294bf6be02361fa989de9d504f1e11563a34d45db5be5b74868e80fdb2a41f","85c1e56dcd1f6228915262b55ac29c9d5ec83542b0e7ac66fedee6be5f689be1","43410e4d540d83fb46a9e745950217073464fa79b74601b8542fa98127c5f36f","653201819cb651d397c8c01f36036cd317e53dd1eb61a337051f246a3008a11f","ab91a5d6365a21b89a0cee76148abb4fe98b05b4a0c8cea99f3934a12b9bd432","ca90a2f7ee0e0aaa15f1fac214a71c616a10d3f96428b0c1afa975d2f3f43cb6","5a0c716f0264ece8fa7a90b498886cb34eb8785da34724d4001c2b67abacb4e1","17f8231dcfdeee8ff3aa14b97375ba6a55e1fee500833e2d6191713a2ddc0a90","ee91767b80e5b1545777672f3596d6960281bdc3f27abe66c563370ab6dc9125","3f0eea6c320e0d5c1ad83a00c02d3ac20dc4ef9e6204d7866211cb315436e0b2","e9f0a03dff09df07f830877ad49109ed47bbaaea184c4c9f046202d73f0932e1")