Burping on MuddyWater

INTRODUCTION

In an earlier blog posts, I wrote about a campaign that was targeting the Middle East (Saudi Arabia, Iraq, UAE, etc). The adversary group behind this campaign was covered by PaloAlto's UNIT42 and others under the name MuddyWater.
In this blog I will be sharing new samples related to this adversary group and how they are continuing to evolve and how they shifted some of their delivery tactics.

IT ALL STARTS WITH A TWEET.

This all started when I saw a tweet from @x0rz referring to a blogpost where they reversed a BurpSuite Key Generator. 
I recommend everyone to go and read the above mentioned blogpost as it is really well done and goes into detail regarding the analysis of this malicious Key Generator. I will NOT be covering the analysis again since the folks at 0x00sec covered it amazingly.
I will be providing some additional IoCs related to this campaign, discuss the shift in the techniques used by MuddyWater and cast a few questions that are surrounding this actor.
But first lets explain couple of terms:
  • Key Generators or KeyGen are a piece of software that is used to generate product keys, which are unique alpha-numeric sequences that tell an installer program that the user that initiated the install owns a license of the software. Because of this, the keygen is often associated with software piracy, cracking and hacking. However, Key Generators have a legitimate valid use in big software companies and organizations. The topic of abusing such tools for badness has been covered a lot and Kaspersky's Securelist provides a good example of this.
  • BurpSuite or Burp as defined on Wikipedia is a graphical tool for testing Web application security. The tool is written in Java and developed by PortSwigger Security. The tool has two versions: a free version that can be downloaded free of charge (Free Edition) and a full version that can be purchased after a trial period (Professional Edition).
In this instance the attackers leveraged a Key Generator for the BurpSuite tool and trojanzied it so when a potential victim tries to run the Key Generator, they will also be running the attackers code which is in this case is a variant of POWERSTATS.

SO WHAT CHANGED OR DIDN'T?

  • The Delivery - MuddyWater in this campaign seem to have shifted their delivery mechanism from malicious weaponized documents to Java based trojanized key generators. Based on some open source research, the KeyGen was hosted on hacking site. The link to where the malicious was hosted is in the IoC section.
  • Installation - MuddyWater continue their heavy reliance on PowerShell. This is apparent from the use of PowerShell commands in the JAR file to drop further scripts on the target machine to their multiple layers of obfuscation using the Daniel Bohannon's Invoke-Obfuscation. Interesting thing to note that they decided to change the extension of the main PowerShell script from "ps1" to "ini".
  • Proxy List - The list of Proxy sites used by MuddyWater has grown to over 760 sites. I am including the list in the IoCs. Please keep in mind that most of these are probably compromised sites and they could have been cleaned by now.
  • False Flags?? - In the final decoded script which is a variant of POWERSTATS, you can easily notice that there are few strings in Chinese that have been inserted in the code as shown below.
    • '无法连接到网址，请等待龙...' whcih google translate to 'Can not connect to website, please wait for dragon ...' - Interestingly enough, the varaible that holds the different proxy sites is called "{dRaGoN_MIddLe}"
    • "无法访问本地计算机寄存器" which google translate to "Can not access local computer register"
    • "任务计划程序访问被拒绝" which google translate to "Task Scheduler Access Denied" - As you can see the last two are related to the persistance of the malware in the victim's machine.
  • Timeline - I was able to find another earlier sample "dfd796b35260de18bd1ed9e31c33520e" using the same type of delivery as in Trojanzied KeyGen. This could mean that this campaign has been ongoing since at least end of December. Additionally, quick look at the domains where the initial scripts where hosted, it seems like the malicious scripts have been removed as of the writing of this blog since the domains had open directories showing last modified dates as below

FINAL THOUGHTS

This shows that MuddyWater group is continuing activity and might be looking to change some of their techniques. However, this just creates more questions than answers and add to the great reason behind naming them MuddyWater.
  1. Why the Change in delivery mechanism? This can be easily to evade existing detection and looking at other ways rather than just weaponized documents.
  2. Are they changing their targeting? BurpSuite is mainly used by either Web Application Security researchers or other attackers and hackers. Is MuddyWater trying to compromise other attacker groups or are they after security researchers?
  3. How deep does the Rabbit Hole goes?? I was able to just come across the two samples mentioned. There are probably more. They even might have also trojanized other tools. Or even experimenting with other delivery mechanism.
Below you will find a list of IoCs from my analysis and I am sure other will be able to dig deeper into this an uncover further details. Hope this is of help and benefit.

INDICATORS OF COMPROMISE

HASHES

5db9cd9f1dd2bc0e183786f587c1e1ac93097a0ab6d258d0f3dc846e621c881f
81ea842f0579a1d55a31eca17f06f438f1e52d687ef2de4af97adbe9b6d29571
00a5fc1122b1a219ce92ea65c7c6d89f3133f60457e08546380a562b0ee7fbdf
3849d62dffb2745c6bc9cb6a128f9ede9136a3979ee3ff7b498057e51ddd25c9
1bf764e77a543def4c623e6e207b1b72999f6550cf49651b88d53f80ae10e4d7
ddc65d70b001baeea348c906e21219a49dda64f32c8f6732a56491620bdf7bf4
36754180d3d036fbea9c6f5cfec12a8fb7a90d10ef37d99c05c0782fbb49dcce
ffc0520d2f3651ed4e04c737d92d8398d680b468937765705c92e16ac41d5aa6
dc64abcefd9250c3db4b9de90d2b307aa2dc9e4b998c46899bd1a6e837fa5180
34147db3241ca1f7f14ae7efb44658dcc92c0e7822e949380165d906340a9158
a16645aa0f879a874605db8380c06e19ba68ddbdd2af8e54577a6334e0d2f3c2

DOMAINS & URLs

SAMPLE - hxxp://www[.]hackingcrunch.com/wp-content/uploads/Burp/burpsuite_pro_v1.7.30.zip

PROXY LIST

hxxp://aandacompany[.]com/connection[.]php
hxxp://ankara24saatacikcicekci[.]com/admin/connection[.]php
hxxp://ankara24saatcicek[.]com/admin/controller/common/connection[.]php
hxxp://ankara24saatcicek[.]net/admin/controller/play/connection[.]php
hxxp://ankaraikincielesyalar[.]com/admin/_sayfalar/connection[.]php
hxxp://ankarakiralikvinc[.]web[.]tr/wp-admin/connection[.]php
hxxp://ankaramehteri[.]com/admin/_islemler/connection[.]php
hxxp://ankaraotokurtarici[.]web[.]tr/wp-includes/connection[.]php
hxxp://aazbs[.]com/wp-admin/includes/connection[.]php
hxxp://ankaratemizlik[.]web[.]tr/include/connection[.]php
hxxp://ankaratemizliksirketleri[.]web[.]tr/wp-includes/connection[.]php
hxxp://www[.]aofdersleri[.]net/wp-admin/connection[.]php
hxxp://www[.]aofdersleri[.]net/wp-content/themes/hueman/connection[.]php
hxxp://apaktem[.]com/wp-admin/connection[.]php
hxxp://aquamasaj[.]com/ozzzpanel/documentation/connection[.]php
hxxp://aracexpress[.]com/wp-admin/connection[.]php
hxxp://arasbg[.]com/yonetimpaneli/connection[.]php
hxxp://ardatur[.]com/sayfalar/connection[.]php
hxxp://ardvessels[.]com/online-catalog/connection[.]php
hxxp://artikhazirsin[.]remingtonturkiye[.]com/erkek/wp-admin/sconnection[.]php
hxxp://artistanbul[.]tv/wp-admin/connection[.]php
hxxp://artistlogistics[.]net/wp-admin/connection[.]php
hxxp://artistlogistics[.]net/wp-includes/connection[.]php
hxxp://aslanmangalkomuru[.]com/panel/connection[.]php
hxxp://aslanorganizasyon[.]com//fonts/icomoon/connection[.]php
hxxp://aslimaj[.]com/wp-admin/connection[.]php
hxxp://astra[.]com[.]tr/master/sass/vendor/bourbon/helpers/connection[.]php
hxxp://asturkgrup[.]com/ar/cache/connection[.]php
hxxp://asturkgrup[.]com/ar/yonetimpaneli/connection[.]php
hxxp://asturkkimya[.]com/W3/fonksiyon/connection[.]php
hxxp://asturkmadencilik[.]com/inc/connection[.]php
hxxp://atakantarimci[.]com[.]tr/wp-admin/connection[.]php
hxxp://ataklojistik[.]com/administrator/modules/mod_toolbar/connection[.]php
hxxp://atamanelektronik[.]com/administrator/components/com_banners/connection[.]php
hxxp://atamanelektronik[.]com/components/com_content/models/connection[.]php
hxxp://atasehiryuzme[.]com/wp-admin/connection[.]php
hxxp://atasehiryuzme[.]com/wp-includes/Requests/connection[.]php
hxxps://www[.]atayuzme[.]com[.]tr/deneme1/connection[.]php
hxxp://atkiatkisi[.]net/panel/connection[.]php
hxxp://atkiatkisiimalat[.]com//blog/wp-admin/connection[.]php
hxxp://avrupabaski[.]com/yillik/cmsal2017/connection[.]php
hxxp://avsserradecor[.]com/katalog/mobile/styles/connection[.]php
hxxp://ayakkabisitesi[.]com/wp-admin/connection[.]php
hxxp://aycinteker[.]com/wp-admin/connection[.]php
hxxp://aydincaliskankanarya[.]com/wp-admin/connection[.]php
hxxp://aydincaliskankanarya[.]com/wp-content/themes/twentyseventeen/connection[.]php
hxxp://aydinsenturk[.]com/ozerkaya/connection[.]php
hxxp://aygunotomasyon[.]com/administrator/components/com_languages/connection[.]php
hxxp://aygunotomasyon[.]com/components/com_user/connection[.]php
hxxp://aymuhendislik[.]com/wp-admin/connection[.]php
hxxp://aymuhendislik[.]com/wp-includes/ID3/connection[.]php
hxxp://aysekaya[.]com[.]tr/wp-admin/connection[.]php
hxxp://azermaral[.]com/wp-admin/connection[.]php
hxxp://bahadirsahinoglu[.]com/wp-admin/connection[.]php
hxxp://bahadirsahinoglu[.]com/wp-includes/connection[.]php
hxxp://baharakgul[.]com/wp-admin/connection[.]php
hxxp://balcidede[.]com[.]tr/admin/inc/connection[.]php
hxxp://baldatca[.]com/admin/controller/extension/connection[.]php
hxxp://baldatca[.]com/system/config/connection[.]php
hxxp://baranakinturk[.]com[.]tr/wp-includes/ID3/connection[.]php
hxxp://baskale[.]bel[.]tr/admin/inc/connection[.]php
hxxp://baskoyluhasanefendi[.]com/administrator/includes/connection[.]php
hxxp://baspinarlartulumpeyniri[.]com/wp-admin/connection[.]php
hxxp://bayrampasabocekilaclama[.]net/wp-content/plugins/google-sitemap-generator/connection[.]php
hxxp://bebekyuzmekurslari[.]com/wp-admin/connection[.]php
hxxp://bebekyuzmekurslari[.]com/wp-admin/connection[.]php
hxxp://www[.]berkyilmaz[.]com[.]tr/wp-admin/connection[.]php
hxxp://bervin[.]com[.]tr/yonetimpaneli/fonksiyonlar/connection[.]php
hxxp://beyazavukatlik[.]com/wp-admin/connection[.]php
hxxp://beyzbolturk[.]com/wp-admin/includes/connection[.]php
hxxp://bienart[.]com/cagdas/panel/connection[.]php
hxxp://bifikirajans[.]com/hosting2/connection[.]php
hxxp://bihaliortusu[.]com/wp-content/plugins/js_composer/config/deprecated/connection[.]php
hxxp://bilenbizibilir[.]com/wp-includes/connection[.]php
hxxp://bilsem[.]club/forum/connection[.]php
hxxp://biodogacevre[.]com/admin/css/connection[.]php
hxxp://birfidanbirumut[.]org[.]tr/admin/ckeditor/connection[.]php
hxxp://bitekservis[.]com/adamsin/controller/sale/connection[.]php
hxxp://bitekservis[.]com/adamsin/model/sample/lexus_superstore/connection[.]php
hxxp://biyanyapi[.]com/deneme/connection[.]php
hxxp://bmenerji[.]com[.]tr/wp-admin/connection[.]php
hxxp://bmenerji[.]com[.]tr/wp-includes/connection[.]php
hxxp://bocekilaclama[.]gen[.]tr/admin/connection[.]php
hxxp://bocekilaclamahizmeti[.]com/wp-admin/connection[.]php
hxxp://bocekilaclamazeytinburnu[.]net/wp-includes/connection[.]php
hxxp://bolgemuhabirligi[.]com/wp-admin/connection[.]php
hxxp://booksandtoys[.]com[.]tr/admin/controller/design/connection[.]php
hxxp://bor[.]superyaz[.]com/admin/controller/catalog/connection[.]php
hxxp://brctsrm[.]com/wp-admin/connection[.]php
hxxp://bsmtrans[.]com/eskiindex-php/_modules/connection[.]php
hxxp://btafbearings[.]com/connection[.]php
hxxp://burakdoseme[.]com/admin/ckeditor/connection[.]php
hxxp://burkertparts[.]com/include/connection[.]php
hxxp://www[.]aalotv[.]com/wp-admin/connection[.]php
hxxp://acmecepl[.]com/connection[.]php
hxxps://aareezenterprises[.]com/php/connection[.]php
hxxp://laserswat[.]com/admin/language/english/payment/connection[.]php
hxxp://ksu[.]com[.]tr/admin53x/ckfinder/core/connector/php/lang/connection[.]php
hxxp://www[.]lamiademir[.]com/myadmin/connection[.]php
hxxp://admissions[.]ae/wp-content/upgrade/connection[.]php
hxxp://liladecor[.]com[.]tr/administrator/templates/system/connection[.]php
hxxp://agripal[.]ae/wp/wp-includes/IXR/connection[.]php
hxxp://kuzeyyeliinsaat[.]com[.]tr/admin/connection[.]php
hxxp://www[.]ajmansexymassagebodytobody[.]com/js/connection[.]php
hxxp://krediogren[.]net/wp-content/themes/TJG-magazine/connection[.]php
hxxp://alarabtents[.]com/connection[.]php
hxxp://aleter[.]ae/connection[.]php
hxxp://alfahadmedia[.]ae/wp1/connection[.]php
hxxp://limanyapidenetim[.]com[.]tr/admin/connection[.]php
hxxp://www[.]alothman-gt[.]com/wp-includes/pomo/connection[.]php
hxxp://azracateringme[.]ae/connection[.]php
hxxp://bakemartplus[.]ae/bakemart[.]ae/connection[.]php
hxxp://www[.]agrininmarkalari[.]com/wp-content/themes/tema/connection[.]php
hxxp://bhic-group[.]com/wp-includes/images/smilies/connection[.]php
hxxp://www[.]big-bang[.]ae/wp-content/themes/twentyfifteen/genericons/connection[.]php
hxxp://bloorco[.]com/vendor/jquery/connection[.]php
hxxp://aitech[.]com[.]tr/admin/connection[.]php
hxxp://bwtest1[.]apps[.]ae/wp-includes/pomo/connection[.]php
hxxp://capital[.]wistech[.]biz/wp-includes/customize/connection[.]php
hxxp://akademihastanesi[.]net/wp-content/themes/twentyseventeen/connection[.]php
hxxp://www[.]akkurtgida[.]com[.]tr/tr/templates/atomic/connection[.]php
hxxp://chat[.]honda[.]ae/support/html/connection[.]php
hxxp://www[.]clearviewuae[.]com/wp-includes/widgets/connection[.]php
hxxp://cmsolutions[.]ae/wp-includes/fonts/connection[.]php
hxxp://cool-group[.]net/pm/connection[.]php
hxxp://mistcool[.]ae/connection[.]php
hxxp://bigfans[.]ae/connection[.]php
hxxp://cool-group[.]net/support/connection[.]php
hxxp://cooldoctor[.]ae/less/connection[.]php
hxxp://akparplastik[.]com/connection[.]php
hxxp://coolingdubai[.]com/connection[.]php
hxxp://mistingdubai[.]net/connection[.]php
hxxp://aysamturizm[.]com[.]tr/wp-includes/connection[.]php
hxxp://azizinsaat[.]com/panelim/connection[.]php
hxxp://aypir[.]com/wp-admin/connection[.]php
hxxp://delinmeal[.]com/inventory/connection[.]php
hxxp://www[.]basoglucit[.]com/wp-includes/theme-compat/connection[.]php
hxxp://bckkaucuk[.]com/wp-admin/connection[.]php
hxxp://davetyaymak[.]com/sys/connection[.]php
hxxp://dikon[.]com[.]tr/connection[.]php
hxxp://drhalilciftci[.]com/cache/connection[.]php
hxxps://dubailegaleagle[.]com/wp-includes/customize/connection[.]php
hxxp://dubaistars[.]ae/engine1/connection[.]php
hxxp://elitecaptains[.]ae/wp-includes/ID3/connection[.]php
hxxp://egzotikshop[.]com/connection[.]php
hxxp://ekrembahcekapili[.]com/vendor/composer/connection[.]php
hxxp://erzincansrc[.]com/site/connection[.]php
hxxp://www[.]gokhanturizmvetemizlik[.]com/wp-includes/connection[.]php
hxxp://fitmentfurniture[.]com/wp-includes/certificates/connection[.]php
hxxp://ftu965[.]com/wp-includes/theme-compat/connection[.]php
hxxp://www[.]fullcircle-design[.]com/wp-includes/fonts/connection[.]php
hxxps://galinusphysio[.]ae/connection[.]php
hxxp://gulenapart[.]com/style/connection[.]php
hxxp://ilaydapromosyon[.]com/components/com_content/connection[.]php
hxxp://cittaslowturkiye[.]org/wp-admin/user/connection[.]php
hxxp://cuneytugur[.]com[.]tr/language/connection[.]php
hxxp://drhalilciftci[.]com/connection[.]php
hxxp://hitupfitness[.]com/wp-includes/Requests/connection[.]php
hxxp://homeofblinds[.]com/connection[.]php
hxxp://iconnectuae[.]com/css/connection[.]php
hxxp://ekerticaret[.]com/yonetim/connection[.]php
hxxp://indulogistics[.]com/connection[.]php
hxxp://elvantente[.]com/Elvan-Contact-Form-1/cfg-contactform-1/class/connection[.]php
hxxp://airsoft[.]net[.]tr/wp-includes/connection[.]php
hxxp://airsoft[.]net[.]tr/wp-includes/random_compat/connection[.]php
hxxp://airsoftpoligon[.]com[.]tr/admin/controller/localisation/connection[.]php
hxxp://airsoftpoligon[.]com[.]tr/wp/connection[.]php
hxxp://ajans362[.]com/admin/connection[.]php
hxxp://akarnakliye[.]com[.]tr/111111111111111/template/connection[.]php
hxxp://akgullerinsaat[.]com[.]tr/admin362ai/connection[.]php
hxxp://akoluklu[.]com/arayuz/connection[.]php
hxxp://aktivitedunyasi[.]com/assets/extras/owl/connection[.]php
hxxp://alaca[.]com[.]tr/admin362alaca/connection[.]php
hxxp://www[.]alcaninsaat[.]com[.]tr/_ajax/connection[.]php
hxxp://aliacan[.]com/wp-includes/connection[.]php
hxxp://alotur[.]com/bayi/mvc/connection[.]php
hxxp://www[.]altinfiyatlari[.]org/connection[.]php
hxxp://antsaninsaat[.]com[.]tr/admin362ai/connection[.]php
hxxp://www[.]arabaoyunlari[.]org/admin/connection[.]php
hxxp://www[.]enyenigelinlikmodelleri[.]net/connection[.]php
hxxp://arasotokiralama[.]net/admin/connection[.]php
hxxp://ariturkklima[.]com/wp-includes/connection[.]php
hxxp://armadakizyurdu[.]com/admin362ay/connection[.]php
hxxp://artibirinsaat[.]com[.]tr/admin362ai/ckeditor/_samples/connection[.]php
hxxp://arzumceyiz[.]com/admin362ac/unit_testing/templates/connection[.]php
hxxp://asaninsaat[.]com/administrator/components/com_templates/connection[.]php
hxxp://asaryapi[.]com[.]tr/administrator/components/com_installer/connection[.]php
hxxp://aseltech[.]com[.]tr/admin362at/connection[.]php
hxxp://aseltech[.]dental/admin362at/connection[.]php
hxxp://asinsaat[.]org/css/fonts/connection[.]php
hxxp://ataglobal[.]com[.]tr/admin362ag/connection[.]php
hxxp://www[.]atimuzik[.]com[.]tr/wp-includes/connection[.]php
hxxp://avsa-adasi[.]gen[.]tr/wp-includes/connection[.]php
hxxp://avcihukukburosu[.]com/admin362ah/ckfinder/connection[.]php
hxxp://ericouellettedev[.]com/css/connection[.]php
hxxp://21bitcoin[.]io/blackjack/css/connection[.]php
hxxp://alluhaybi[.]com[.]sa/wp-includes/widgets/connection[.]php
hxxp://sexex[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://mddesign[.]co[.]il/resources/views/layout/connection[.]php
hxxp://www[.]igo3[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://www[.]l-n[.]co[.]il/connection[.]php
hxxp://www[.]l-n[.]co[.]il/wp-includes/widgets/connection[.]php
hxxps://plush-toys[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://yosifiko[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://palmon-law[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://www[.]mcb-law[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://smart-sense[.]co[.]il/wp-includes/widgets/connection[.]php
hxxp://azim[.]co[.]il/wp-includes/widgets/connection[.]php
hxxps://dynamictours[.]co[.]il/components/connection[.]php
hxxps://zahraty[.]com[.]sa/up/pub/media/yourstore/css/connection[.]php
hxxps://www[.]wasa6h[.]com[.]sa/ws-admin/wy/skins/connection[.]php
hxxps://www[.]wasa6h[.]com[.]sa/livezilla/images/geo/connection[.]php
hxxps://jaras[.]sa/wp-includes/widgets/connection[.]php
hxxps://zahraty[.]com[.]sa/up/app/design/frontend/connection[.]php
hxxps://zahraty[.]com[.]sa/up/pub/media/yourstore/css/connection[.]php
hxxps://tge[.]sa/tgefs/includes/js/bootstrap/connection[.]php
hxxps://emobe[.]eu/wp-includes/widgets/connection[.]php
hxxp://vlgstal[.]ru/wp-includes/widgets/connection[.]php
hxxps://richmen[.]az/upgrades/connection[.]php
hxxp://bg[.]com[.]tr/j3/components/com_ajax/connection[.]php
hxxp://www[.]rjsoftware[.]com/wp-content/themes/twentyseventeen/assets/css/connection[.]php
hxxps://www[.]freesteamwalletcode[.]com/wp-content/languages/connection[.]php
hxxps://www[.]icycheats[.]com/wp-includes/widgets/connection[.]php
hxxp://mycar[.]ge/prava/jplot/docs/files/plugins/connection[.]php
hxxps://goyalsoftech[.]com/css/imports/shortcodes/connection[.]php
hxxps://pushconsole[.]com/assets/fonts/icomoon/connection[.]php
hxxps://www[.]easykeysoftware[.]com/media/image/00/0d/9a/connection[.]php
hxxp://mepure[.]com/connection[.]php
hxxps://www[.]1n2r[.]com//wp-content/connection[.]php
hxxps://www[.]1n2r[.]com//wp-content/themes/twentysixteen/inc/connection[.]php
hxxp://bek[.]ae/wp-includes//connection[.]php
hxxp://bek[.]ae/wp-includes//IXR/connection[.]php?lib=curl
hxxps://climateplus[.]ae/wp-content/themes/tyche/connection[.]php
hxxps://climateplus[.]ae/wp-content/themes/tyche/woocommerce/connection[.]php
hxxp://lohuis[.]ae/wp-includes/widgets/connection[.]php
hxxp://lohuis[.]ae//wp-includes/random_compat/connection[.]php
hxxps://mistingfan[.]ae/wp-content/themes/twentyfifteen/connection[.]php
hxxps://mistingfan[.]ae/wp-content/themes/mts_schema//connection[.]php
hxxps://outdoorac[.]ae/wp-includes/ID3/connection[.]php
hxxps://outdoorac[.]ae/wp-includes/customize/connection[.]php
hxxps://outdoorcooling[.]ae/wp-includes/ID3/connection[.]php
hxxps://outdoorcooling[.]ae/wp-includes/Text/connection[.]php
hxxp://patioheater[.]ae/wp-content/plugins/connection[.]php
hxxp://patioheater[.]ae/wp-includes/connection[.]php
hxxps://hvls[.]ae/wp-includes/SimplePie/connection[.]php
hxxps://hvls[.]ae/wp-includes/SimplePie/Parse/connection[.]php
hxxp://cool-group[.]ae/wp-includes/customize/connection[.]php
hxxp://cool-group[.]ae/wp-includes/certificates/connection[.]php
hxxp://adambaluch[.]ae/wp-includes/pomo/connection[.]php
hxxp://adambaluch[.]ae/wp-includes/customize/connection[.]php
hxxp://beachroad[.]ae/wp-includes/connection[.]php
hxxp://beachroad[.]ae/wp-includes/Requests/Utility/connection[.]php
hxxp://castaldiart[.]com/wp-includes/Requests/connection[.]php
hxxp://castaldiart[.]com/wp-includes/Requests/Transport/connection[.]php
hxxp://elevate[.]ae/wp-includes/IXR/connection[.]php
hxxp://elevate[.]ae/wp-includes/customize/connection[.]php
hxxp://koldpressjuice[.]com/wp-includes/IXR/connection[.]php
hxxp://koldpressjuice[.]com/wp-includes/SimplePie/XML/connection[.]php
hxxp://satwa[.]ae/wp-includes/images/connection[.]php
hxxp://satwa[.]ae/wp-includes/rest-api/connection[.]php
hxxp://soccertotsuae[.]com/wp-includes/Requests/Cookie/connection[.]php
hxxp://soccertotsuae[.]com/wp-includes/Requests/Exception/connection[.]php
hxxp://souqwalls[.]com/wp-includes/random_compat/connection[.]php
hxxp://souqwalls[.]com/wp-includes/theme-compat/connection[.]php
hxxp://vintage[.]ae/wp-includes/random_compat/connection[.]php
hxxp://vintage[.]ae/wp-includes/pomo/connection[.]php
hxxp://yogakidsuae[.]com/wp-includes/SimplePie/connection[.]php
hxxp://yogakidsuae[.]com/wp-includes/SimplePie/XML/connection[.]php
hxxp://binham[.]com/oxygen/connection[.]php
hxxp://binham[.]com/artesia/connection[.]php
hxxp://binhamgroup[.]com/Stopped/connection[.]php
hxxp://binhamgroup[.]com/press/connection[.]php
hxxp://mohamedbinham[.]com/wp-includes/connection[.]php
hxxp://mohamedbinham[.]com/wp-includes/IXR/connection[.]php
hxxp://thebedspace[.]com/wp-includes/Requests/connection[.]php
hxxp://thebedspace[.]com/wp-includes/Requests/Response/connection[.]php
hxxp://anythingispossible[.]world/wp-includes/IXR/connection[.]php
hxxp://anythingispossible[.]world/wp-includes/Text/connection[.]php
hxxp://ctteknik[.]com[.]tr/wp-content/themes/one-page/connection[.]php
hxxp://ctteknik[.]com[.]tr/wp-includes/connection[.]php
hxxp://acililan[.]net/libs/connection[.]php
hxxp://stmgage[.]com/system/engine/connection[.]php
hxxp://stmgage[.]com/system/config/connection[.]php
hxxp://papyonplus[.]tv/css/connection[.]php
hxxp://lavastandirustasi[.]com/includes/connection[.]php
hxxp://www[.]cigercihamza[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]cigercihamza[.]com/wp-includes/connection[.]php
hxxps://www[.]3bulut[.]net/wp-content/themes/arkahost/connection[.]php
hxxps://www[.]3bulut[.]net/hizmetler/lang/connection[.]php
hxxp://gocekdaloshotel[.]com/sayfalar/connection[.]php
hxxp://emrahucar[.]com[.]tr/wp-content/themes/rokophoto-lite/connection[.]php
hxxp://emrahucar[.]com[.]tr/wp-includes/connection[.]php
hxxp://www[.]fircasizaracyikama[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]fircasizaracyikama[.]com/wp-includes/connection[.]php
hxxps://www[.]filthymindsco[.]com/wp-content/themes/twentyfifteen/inc/connection[.]php
hxxps://www[.]filthymindsco[.]com/wp-includes/connection[.]php
hxxp://kedidirkedi[.]com/wp-includes/connection[.]php
hxxp://www[.]salonalara[.]com/wp-content/themes/twentyfifteen/inc/connection[.]php
hxxp://www[.]salonalara[.]com/wp-includes/connection[.]php
hxxp://www[.]ogreniver[.]com/wp-includes/connection[.]php
hxxp://turhantarim[.]com/lang/connection[.]php
hxxp://turhantarim[.]com/ik/inc/connection[.]php
hxxp://www[.]mersinyedirenk[.]org/wp-content/themes/oxygen/connection[.]php
hxxp://gayrimenkulvera[.]com/wp-content/themes/one-page/connection[.]php
hxxp://gayrimenkulvera[.]com/wp-includes/connection[.]php
hxxp://electrotoolbox[.]com/wp-content/themes/rowe/connection[.]php
hxxp://www[.]cesikacatisistemleri[.]com/wp-content/themes/safirkurumsal/connection[.]php
hxxp://www[.]cesikacatisistemleri[.]com/wp-includes/connection[.]php
hxxp://almirayapim[.]com/wp-includes/connection[.]php
hxxp://www[.]strancamagic[.]com/en/wp-includes/connection[.]php
hxxp://raptiye[.]co/wp-includes/connection[.]php
hxxp://safakahsap[.]com/fonksiyonlar/connection[.]php
hxxp://safakahsap[.]com/resimler/semboller/connection[.]php
hxxp://bursadanilan[.]com/iyzipay/samples/connection[.]php
hxxp://www[.]cavgun[.]com/wp-includes/connection[.]php
hxxp://ilanevim[.]com/kvitrin/connection[.]php
hxxp://yelpazeinsaat[.]com[.]tr/plugins/finder/content/connection[.]php
hxxp://kirkagac[.]bel[.]tr/sayfalar/connection[.]php
hxxp://kirkagac[.]bel[.]tr/assets/fonts/connection[.]php
hxxp://paybaskulu[.]com/fht/connection[.]php
hxxp://www[.]ozsezerler[.]com/_inc/connection[.]php
hxxp://www[.]ozsezerler[.]com/en/connection[.]php
hxxp://www[.]yapiborsasi[.]com/libs/connection[.]php
hxxp://www[.]yapiborsasi[.]com/kvitrin/connection[.]php
hxxps://boyaci-ustasi[.]com/wp-includes/connection[.]php
hxxps://boyaci-ustasi[.]com/wp-content/themes/misty-lake/connection[.]php
hxxp://www[.]altingunes[.]com/wp-includes/customize/connection[.]php
hxxp://tamamsin[.]com/libs/connection[.]php
hxxp://atlasins[.]com[.]tr/wp-includes/connection[.]php
hxxp://atlasins[.]com[.]tr/wp-includes/connection[.]php
hxxp://ilkerreklamcilik[.]com/Joomla_site/includes/connection[.]php
hxxp://luleburgazzob[.]org[.]tr/panel/plugins/ckeditor/plugins/link/dialogs/connection[.]php
hxxp://burakgozutok[.]com/wp-content/themes/twentyfourteen/connection[.]php
hxxp://burakgozutok[.]com/wp-includes/connection[.]php
hxxp://ekayapi[.]org/inc/connection[.]php
hxxp://ekayapi[.]org/upload/connection[.]php
hxxp://gdijital[.]com/libraries/connection[.]php
hxxp://rumelipeyzaj[.]com/panel/connection[.]php
hxxp://www[.]alpenfitil[.]com/wp-includes/connection[.]php
hxxp://www[.]alpenfitil[.]com/wp-includes/connection[.]php
hxxp://kindervilla[.]at/team/connection[.]php
hxxp://www[.]ranzamodellerim[.]com/wp-content/plugins/contact-form-7/connection[.]php
hxxp://www[.]metoikos-trade[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://tecnocoffee[.]com[.]tr/wp-content/themes/enlighten/connection[.]php
hxxp://tecnocoffee[.]com[.]tr/wp-includes/connection[.]php
hxxps://www[.]bedavasat[.]com/export/connection[.]php
hxxps://www[.]bedavasat[.]com/iyzipay/src/Iyzipay/connection[.]php
hxxps://www[.]bedavasat[.]com/fileserver/connection[.]php
hxxp://ustaariyorum[.]com[.]tr/wp-content/themes/wpfirma/connection[.]php
hxxp://ustaariyorum[.]com[.]tr/wp-includes/connection[.]php
hxxp://escapefromsofa[.]com/theme/efs/connection[.]php
hxxp://escapefromsofa[.]com/ajax/connection[.]php
hxxp://ozmetalpen[.]com/wp-includes/connection[.]php
hxxp://nevzatsolmazinsaat[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://nevzatsolmazinsaat[.]com/wp-includes/connection[.]php
hxxp://standartdogalgaz[.]com/wp-includes/connection[.]php
hxxp://startr[.]com/system/library/connection[.]php
hxxp://www[.]karavanseyahat[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://reklambasvurusu[.]com/sistem/connection[.]php
hxxp://reklambasvurusu[.]com/!ercer2001/sistem/connection[.]php
hxxp://www[.]emlakbizden[.]com/libs/connection[.]php
hxxp://rentacarline[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]pergolatentefiyatlari[.]com/wp-includes/connection[.]php
hxxp://www[.]oroazteca[.]net/wp-includes/connection[.]php
hxxp://markizorganizasyon[.]com/wp-includes/connection[.]php
hxxp://markizorganizasyon[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://akin[.]me/wp-includes/connection[.]php
hxxp://akin[.]me/wp-content/themes/founder/connection[.]php
hxxp://www[.]bogazturu[.]net/includes/connection[.]php
hxxp://onurlergayrimenkul[.]com/application/language/english/connection[.]php
hxxp://www[.]a-zgrup[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]a-zgrup[.]com/wp-includes/connection[.]php
hxxp://matmazel-gelinlik[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]gokkubbe[.]biz/wp-includes/connection[.]php
hxxp://eraslan[.]com[.]tr/en/about/connection[.]php
hxxp://eraslan[.]com[.]tr/en/history/assets/nokta/css/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_ajax/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_inc/connection[.]php
hxxp://yildizgokart[.]com/wp-content/plugins/contact-form-7/includes/connection[.]php
hxxp://cinarli[.]com/catering/img/connection[.]php
hxxp://cinarli[.]com/restaurant/captcha/connection[.]php
hxxp://alyanslife[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://alyanslife[.]com/wp-includes/connection[.]php
hxxp://www[.]hibedanis[.]com/admin/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_inc/connection[.]php
hxxp://yildizgokart[.]com/wp-content/languages/plugins/connection[.]php
hxxp://acililan[.]net/libs/connection[.]php
hxxp://stmgage[.]com/system/engine/connection[.]php
hxxp://novusglobal[.]us/templates/zoner/connection[.]php
hxxp://1111crm[.]com/3Party/ckeditor/plugins/bidi/lang/connection[.]php
hxxp://1111crm[.]com/ESKI/loginbox/system/connection[.]php
hxxp://rehberhds[.]com/wp-includes/connection[.]php
hxxp://ngvisco[.]com/wp-includes/connection[.]php
hxxp://ngvisco[.]com/wp-content/themes/betheme/connection[.]php
hxxp://kursunkalemhoca[.]com/wp-content/themes/twentyseventeen/connection[.]php
hxxps://www[.]asortie[.]com/blog/wp-content/themes/colormag/connection[.]php
hxxps://www[.]asortie[.]com/blog/wp-includes/connection[.]php
hxxps://bayanhobisi[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxps://bayanhobisi[.]com/wp-includes/connection[.]php
hxxp://3eyonetim[.]com/wp-includes/connection[.]php
hxxp://3eyonetim[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://derinbutikotel[.]com/templates/beez3/language/en-GB/connection[.]php
hxxp://minitalya[.]com/wp-content/languages/plugins/connection[.]php
hxxp://www[.]armateknolojimerkezi[.]com/wp-includes/pomo/connection[.]php
hxxp://www[.]armateknolojimerkezi[.]com/wp-content/languages/plugins/connection[.]php
hxxp://www[.]eogren[.]me/wp-includes/widgets/connection[.]php
hxxp://www[.]eogren[.]me/wp-content/languages/plugins/connection[.]php
hxxp://www[.]inalhukukburosu[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]inalhukukburosu[.]com/wp-content/languages/plugins/connection[.]php
hxxp://www[.]osmaniyesevgi[.]com[.]tr/wp-includes/pomo/connection[.]php
hxxp://www[.]osmaniyesevgi[.]com[.]tr/wp-content/languages/plugins/connection[.]php
hxxp://ercekagit[.]com/wp-includes/widgets/connection[.]php
hxxp://ercekagit[.]com/wp-content/languages/plugins/connection[.]php
hxxp://lubesoltr[.]com/images/connection[.]php
hxxp://watergreen[.]com[.]tr/pages/inc/connection[.]php
hxxp://watergreen[.]com[.]tr/lib/ckeditor/plugins/a11yhelp/dialogs/connection[.]php
hxxp://tamirdeyiz[.]com/plugins/extension/joomla/connection[.]php
hxxp://tamirdeyiz[.]com/language/tr-TR/connection[.]php
hxxp://www[.]finansalkredi[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]finansalkredi[.]com/wp-content/languages/plugins/connection[.]php
hxxps://dogruwebtasarim[.]com/ortak/editable/bootstrap3/1[.]5[.]1/bootstrap3-editable/css/connection[.]php
hxxps://dogruwebtasarim[.]com/ortak/seourl/1[.]7[.]1/connection[.]php
hxxp://er-emmakine[.]com[.]tr/admin/include/connection[.]php
hxxp://er-emmakine[.]com[.]tr/admin/chat/documentation/css/connection[.]php
hxxp://turanlarcitsistemleri[.]com/wp-includes/pomo/connection[.]php
hxxp://turanlarcitsistemleri[.]com/wp-content/languages/plugins/connection[.]php
hxxp://www[.]uzaktanogrenin[.]com/phpmailer/connection[.]php
hxxp://www[.]uzaktanogrenin[.]com/css/presets/connection[.]php
hxxp://e-learning[.]secilenlernetwork[.]com/phpmailer/connection[.]php
hxxp://e-learning[.]secilenlernetwork[.]com/yonetim/ckeditor/plugins/about/dialogs/connection[.]php
hxxp://luleburgazvinc[.]com/mail/connection[.]php
hxxp://luleburgazvinc[.]com/panel/plugins/ckeditor/connection[.]php
hxxp://www[.]karamesetarim[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]karamesetarim[.]com/wp-content/languages/plugins/connection[.]php
hxxp://teknodizayn[.]net/domain/js/connection[.]php
hxxp://teknodizayn[.]net/baglan/facebook/src/connection[.]php
hxxp://www[.]hankimya[.]com/wp-includes/pomo/connection[.]php
hxxp://www[.]hankimya[.]com/wp-content/languages/plugins/connection[.]php
hxxp://hasatvet[.]com[.]tr/ekatalog/lib/connection[.]php
hxxp://hasatvet[.]com[.]tr/insantr/language/connection[.]php
hxxp://emelcekici[.]com/engine/connection[.]php
hxxp://emelcekici[.]com/engine/ajax/connection[.]php
hxxp://tamer[.]info/dle/engine/ajax/connection[.]php
hxxp://tamer[.]info/dle/engine/connection[.]php
hxxp://seyekanakliyat[.]com/cgi-bin/connection[.]php
hxxp://www[.]sendogansevda[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]sendogansevda[.]com/wp-content/languages/plugins/connection[.]php
hxxp://viranlar[.]com/func/connection[.]php
hxxp://viranlar[.]com/fancybox/connection[.]php
hxxp://mimart1984[.]com/panel/plugins/chartjs/connection[.]php
hxxp://mimart1984[.]com/panel/dist/css/skins/connection[.]php
hxxp://nurbahcemakinalari[.]com/epiksel/epiksel_admin_shortcuts/css/connection[.]php
hxxp://nurbahcemakinalari[.]com/override/export/admin/controller/common/connection[.]php
hxxp://safacaliskan[.]com/wp-includes/widgets/connection[.]php
hxxp://safacaliskan[.]com/wp-content/languages/plugins/connection[.]php
hxxps://www[.]eimza[.]gen[.]tr/images/yedek/connection[.]php
hxxps://www[.]eimza[.]gen[.]tr/class/mail/connection[.]php
hxxp://organigiz[.]org/wp-includes/widgets/connection[.]php
hxxp://organigiz[.]org/wp-content/languages/plugins/connection[.]php
hxxp://www[.]tekirdagbulten[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]tekirdagbulten[.]com/wp-content/languages/plugins/connection[.]php
hxxp://arkadasariyoruz[.]com/reklamlar/connection[.]php
hxxp://arkadasariyoruz[.]com/mudur/connection[.]php
hxxp://mywishlistapp[.]com/sanal/fonts/codropsicons/connection[.]php
hxxp://mywishlistapp[.]com/kaynak/dist/stylesheets/connection[.]php
hxxp://tafitur[.]com/muhasebe/plugins/chart/connection[.]php
hxxp://tafitur[.]com/muhasebe/plugins/advanced-datatable/css/connection[.]php
hxxp://www[.]ddcreklam[.]com/wp-content/languages/plugins/connection[.]php
hxxp://www[.]ddcreklam[.]com/wp-includes/widgets/connection[.]php
hxxp://gulucuk[.]com[.]tr/panel/assest/images/connection[.]php
hxxp://gulucuk[.]com[.]tr/rs-plugin/assets/connection[.]php
hxxp://fatihguvenmotor[.]com/wp-includes/widgets/connection[.]php
hxxp://fatihguvenmotor[.]com/wp-content/languages/plugins/connection[.]php
hxxp://banaherseylazim[.]com/catalog/view/javascript/jquery/connection[.]php
hxxp://banaherseylazim[.]com/system/config/connection[.]php
hxxp://nikahsepetim[.]com/catalog/view/javascript/jquery/connection[.]php
hxxp://nikahsepetim[.]com/blog/wp-includes/widgets/connection[.]php
hxxp://www[.]ozankaratas[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]ozankaratas[.]com/wp-content/languages/plugins/connection[.]php
hxxp://salonaltinmakas[.]com/cgi-bin/connection[.]php
hxxp://salonaltinmakas[.]com/assets/js/connection[.]php
hxxp://buldurgrup[.]com/plugins/captcha/recaptcha/connection[.]php
hxxp://buldurgrup[.]com/libraries/cms/application/connection[.]php
hxxp://gebekulubu[.]com/fonts/alice/connection[.]php
hxxp://gebekulubu[.]com/core/cpstyles/vBulletin_5_Default/connection[.]php
hxxp://isikpolyester[.]com/css/custom-theme/images/connection[.]php
hxxp://isikpolyester[.]com/graphics/iletisim/connection[.]php
hxxp://bayramturgutnakliyat[.]com[.]tr/components/com_ajax/connection[.]php
hxxp://bayramturgutnakliyat[.]com[.]tr/libraries/cms/component/router/rules/connection[.]php
hxxp://perdemis[.]com/panel/ckeditor/_samples/adobeair/connection[.]php
hxxp://perdemis[.]com/panel/ckeditor/plugins/forms/dialogs/connection[.]php
hxxp://ersagurunlerisatis[.]com/cgi-bin/connection[.]php
hxxp://ersagurunlerisatis[.]com/style/bakim/tools/socicon/font/connection[.]php
hxxp://naturagro[.]com[.]tr/calisma/assets/css/connection[.]php
hxxp://naturagro[.]com[.]tr/calisma/modules/images/prettyPhoto/dark_rounded/connection[.]php
hxxps://www[.]owletmedikal[.]com/manager/js/advanced-datatable/css/connection[.]php
hxxps://www[.]owletmedikal[.]com/manager/php-activerecord/examples/orders/models/connection[.]php
hxxps://yemekler[.]com[.]tr/wp-includes/Requests/Exception/hxxp/connection[.]php
hxxps://yemekler[.]com[.]tr/wp-content/languages/plugins/connection[.]php
hxxps://pentilon[.]com/wp-includes/widgets/connection[.]php
hxxps://pentilon[.]com/wp-content/languages/plugins/connection[.]php
hxxps://bestpa[.]com[.]tr/catalog/view/theme/default/stylesheet/connection[.]php
hxxps://bestpa[.]com[.]tr/catalog/view/theme/default/stylesheet/connection[.]php
hxxp://eylulprefabrik[.]com/images/connection[.]php
hxxp://eylulprefabrik[.]com/cgi-bin/connection[.]php
hxxp://kralicemmasaj[.]com/layouts/libraries/cms/html/bootstrap/connection[.]php
hxxp://www[.]nilgunakkok[.]com/wp-includes/widgets/connection[.]php
hxxp://www[.]orgutigisimodelleri[.]com/wp-includes/pomo/connection[.]php
hxxp://anadolutente[.]com[.]tr/js/connection[.]php
hxxp://anadolutente[.]com[.]tr/fonts/connection[.]php
hxxp://entpsoft[.]com/cgi-bin/connection[.]php
hxxp://entpsoft[.]com/LISP-SURELERI/connection[.]php
hxxp://besiktasgorselsanatlar[.]com/loginbox/app/connection[.]php
hxxp://besiktasgorselsanatlar[.]com/loginbox/3party/ckeditor/plugins/a11yhelp/dialogs/connection[.]php
hxxp://ilkadim[.]k12[.]tr/media/contacts/connection[.]php
hxxp://senollarturizm[.]com[.]tr/vendor/scripts/jquery/connection[.]php
hxxp://arabaemlak[.]com/magaza/cgi-bin/connection[.]php
hxxp://www[.]ankarahaliyikamafirmalari[.]web[.]tr/wp-includes/widgets/connection[.]php
hxxp://www[.]ankarahaliyikamafirmalari[.]web[.]tr/wp-includes/js/jquery/ui/connection[.]php
hxxp://en[.]nordiksimit[.]org/wp-includes/widgets/connection[.]php
hxxp://en[.]nordiksimit[.]org/wp-includes/js/jquery/ui/connection[.]php
hxxp://dyosanayiboyalari[.]com/cgi-bin/connection[.]php
hxxp://www[.]ufukdesign[.]com/wp-includes/js/jquery/ui/connection[.]php
hxxp://mehmetak[.]in/cgi-bin/connection[.]php
hxxp://teknobi[.]net/include/payu/CLASSES/connection[.]php
hxxp://www[.]ilanbas[.]com/panel/js/connection[.]php
hxxp://ilanbas[.]com//js/bxslider/images/connection[.]php
hxxp://gunluoglumobilya[.]com/system/config/connection[.]php
hxxp://gunluoglumobilya[.]com/catalog/view/javascript/jquery/ui/connection[.]php
hxxp://www[.]oyun16[.]com/libs/plugins/connection[.]php
hxxp://www[.]oyun16[.]com/den/css/connection[.]php
hxxp://papyonplus[.]tv/dummy/connection[.]php
hxxp://papyonplus[.]tv/css/connection[.]php
hxxp://lavastandirustasi[.]com/includes/connection[.]php
hxxp://lavastandirustasi[.]com/cli/connection[.]php
hxxp://www[.]cigercihamza[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]cigercihamza[.]com/wp-includes/connection[.]php
hxxps://www[.]3bulut[.]net/wp-content/themes/arkahost/connection[.]php
hxxps://www[.]3bulut[.]net/hizmetler/lang/connection[.]php
hxxp://akinbilgisayarumraniye[.]com/inc/connection[.]php
hxxp://akinbilgisayarumraniye[.]com/sistem/elfinder/connectors/php/connection[.]php
hxxp://gocekdaloshotel[.]com/dil/connection[.]php
hxxp://gocekdaloshotel[.]com/sayfalar/connection[.]php
hxxp://emrahucar[.]com[.]tr/wp-content/themes/rokophoto-lite/connection[.]php
hxxp://emrahucar[.]com[.]tr/wp-includes/connection[.]php
hxxp://www[.]fircasizaracyikama[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]fircasizaracyikama[.]com/wp-includes/connection[.]php
hxxps://www[.]filthymindsco[.]com/wp-content/themes/twentyfifteen/inc/connection[.]php
hxxps://www[.]filthymindsco[.]com/wp-includes/connection[.]php
hxxp://www[.]bulutuzer[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]bulutuzer[.]com/wp-includes/connection[.]php
hxxp://mavioksidan[.]net/admin/view/javascript/openbay/css/connection[.]php
hxxp://mavioksidan[.]net/catalog/model/affiliate/connection[.]php
hxxp://halilbalyapi[.]com/includes/connection[.]php
hxxp://halilbalyapi[.]com/language/en-GB/connection[.]php
hxxp://kedidirkedi[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://kedidirkedi[.]com/wp-includes/connection[.]php
hxxp://www[.]salonalara[.]com/wp-content/themes/twentyfifteen/inc/connection[.]php
hxxp://www[.]salonalara[.]com/wp-includes/connection[.]php
hxxp://dsmartbursa[.]net/_frame/connection[.]php
hxxp://dsmartbursa[.]net/_iserv/form2mail/connection[.]php
hxxp://www[.]ogreniver[.]com/wp-content/themes/metro-creativex/connection[.]php
hxxp://www[.]ogreniver[.]com/wp-includes/connection[.]php
hxxp://mangalaburada[.]com/wp-content/themes/idoneita/connection[.]php
hxxp://mangalaburada[.]com/wp-includes/connection[.]php
hxxp://www[.]ozeliletisim[.]com[.]tr/wp-includes/connection[.]php
hxxp://www[.]pastacikadin[.]com/wp-content/themes/bulan/connection[.]php
hxxp://www[.]pastacikadin[.]com/wp-includes/connection[.]php
hxxp://turhantarim[.]com/lang/connection[.]php
hxxp://turhantarim[.]com/ik/inc/connection[.]php
hxxp://www[.]mersinyedirenk[.]org/wp-content/themes/oxygen/connection[.]php
hxxp://www[.]mersinyedirenk[.]org/wp-includes/connection[.]php
hxxp://gayrimenkulvera[.]com/wp-content/themes/one-page/connection[.]php
hxxp://gayrimenkulvera[.]com/wp-includes/connection[.]php
hxxp://projemsoft[.]com/includes/twitter/connection[.]php
hxxp://projemsoft[.]com/js/connection[.]php
hxxp://electrotoolbox[.]com/wp-content/themes/rowe/connection[.]php
hxxp://electrotoolbox[.]com/wp-includes/connection[.]php
hxxp://www[.]cesikacatisistemleri[.]com/wp-content/themes/safirkurumsal/connection[.]php
hxxp://www[.]cesikacatisistemleri[.]com/wp-includes/connection[.]php
hxxp://almirayapim[.]com/wp-content/themes/minamaze/connection[.]php
hxxp://almirayapim[.]com/wp-includes/connection[.]php
hxxp://www[.]strancamagic[.]com/en/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]strancamagic[.]com/en/wp-includes/connection[.]php
hxxp://www[.]marufymm[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]marufymm[.]com/wp-includes/connection[.]php
hxxp://ayyildizmimari[.]com/ders/inc/connection[.]php
hxxp://ayyildizmimari[.]com/bakim/connection[.]php
hxxp://raptiye[.]co/wp-content/themes/illdy/connection[.]php
hxxp://raptiye[.]co/wp-includes/connection[.]php
hxxp://safakahsap[.]com/fonksiyonlar/connection[.]php
hxxp://safakahsap[.]com/resimler/semboller/connection[.]php
hxxp://bursadanilan[.]com/eski/libs/connection[.]php
hxxp://bursadanilan[.]com/iyzipay/samples/connection[.]php
hxxp://www[.]cavgun[.]com/wp-content/themes/tema/connection[.]php
hxxp://www[.]cavgun[.]com/wp-includes/connection[.]php
hxxp://www[.]ilanevim[.]com/mobil/connection[.]php
hxxp://ilanevim[.]com/kvitrin/connection[.]php
hxxp://yelpazeinsaat[.]com[.]tr/plugins/finder/content/connection[.]php
hxxp://yelpazeinsaat[.]com[.]tr/yeni/plugins/finder/content/connection[.]php
hxxp://safasengezer[.]com[.]tr/wp-includes/connection[.]php
hxxp://kirkagac[.]bel[.]tr/sayfalar/connection[.]php
hxxp://kirkagac[.]bel[.]tr/assets/fonts/connection[.]php
hxxp://7likurbanbaskulu[.]com/hassas/connection[.]php
hxxp://7likurbanbaskulu[.]com/tartim/connection[.]php
hxxp://paybaskulu[.]com/tartim/connection[.]php
hxxp://paybaskulu[.]com/fht/connection[.]php
hxxp://kurbanhissebaskulu[.]net/barkodlular/connection[.]php
hxxp://kurbanhissebaskulu[.]net/tartim/connection[.]php
hxxp://www[.]ozsezerler[.]com/_inc/connection[.]php
hxxp://www[.]ozsezerler[.]com/en/connection[.]php
hxxp://www[.]yapiborsasi[.]com/libs/connection[.]php
hxxp://www[.]yapiborsasi[.]com/kvitrin/connection[.]php
hxxps://boyaci-ustasi[.]com/wp-includes/connection[.]php
hxxps://boyaci-ustasi[.]com/wp-content/themes/misty-lake/connection[.]php
hxxp://www[.]altingunes[.]com/wp-includes/connection[.]php
hxxp://www[.]altingunes[.]com/wp-includes/customize/connection[.]php
hxxp://www[.]tamamsin[.]com/panel/connection[.]php
hxxp://tamamsin[.]com/libs/connection[.]php
hxxp://tamamsin[.]com/dil/connection[.]php
hxxp://atlasins[.]com[.]tr/wp-includes/connection[.]php
hxxp://atlasins[.]com[.]tr/wp-includes/connection[.]php
hxxp://ilkerreklamcilik[.]com/Joomla_site/cli/connection[.]php
hxxp://ilkerreklamcilik[.]com/Joomla_site/includes/connection[.]php
hxxp://viparkcenter[.]com/wp-includes/connection[.]php
hxxp://viparkcenter[.]com/wp-content/themes/twentyseventeen/connection[.]php
hxxp://www[.]klavyebende[.]com/wp-content/themes/spasalon/connection[.]php
hxxp://www[.]klavyebende[.]com/wp-includes/connection[.]php
hxxp://luleburgazzob[.]org[.]tr/panel/plugins/ckeditor/plugins/about/dialogs/hidpi/connection[.]php
hxxp://luleburgazzob[.]org[.]tr/panel/plugins/ckeditor/plugins/link/dialogs/connection[.]php
hxxp://burakgozutok[.]com/wp-content/themes/twentyfourteen/connection[.]php
hxxp://burakgozutok[.]com/wp-includes/connection[.]php
hxxp://gebzehavalandirmatr[.]com/admin/connection[.]php
hxxp://gebzehavalandirmatr[.]com/yedek/captcha/connection[.]php
hxxp://deltasolar[.]com[.]tr/admin/connection[.]php
hxxp://deltasolar[.]com[.]tr/catalog/controller/api/connection[.]php
hxxp://ekayapi[.]org/inc/connection[.]php
hxxp://ekayapi[.]org/upload/connection[.]php
hxxp://www[.]otocekicidenizli[.]com/wp-admin/connection[.]php
hxxp://www[.]otocekicidenizli[.]com/wp-content/themes/twentyfourteen/connection[.]php
hxxp://cevahirkardesler[.]com[.]tr/gazete/pages/connection[.]php
hxxp://cevahirkardesler[.]com[.]tr/themes/1/connection[.]php
hxxp://gdijital[.]com/administrator/connection[.]php
hxxp://gdijital[.]com/libraries/connection[.]php
hxxp://rumelipeyzaj[.]com/panel/connection[.]php
hxxp://rumelipeyzaj[.]com/sayfalar/connection[.]php
hxxp://www[.]alpenfitil[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]alpenfitil[.]com/wp-includes/connection[.]php
hxxp://www[.]alpenfitil[.]com/wp-includes/connection[.]php
hxxp://kindervilla[.]at/team/admin/connection[.]php
hxxp://mslvinc[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://kindervilla[.]at/team/connection[.]php
hxxp://mslvinc[.]com/wp-includes/connection[.]php
hxxp://www[.]ranzamodellerim[.]com/wp-content/plugins/contact-form-7/connection[.]php
hxxp://www[.]ranzamodellerim[.]com/wp-includes/connection[.]php
hxxp://www[.]metoikos-trade[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]metoikos-trade[.]com/wp-includes/connection[.]php
hxxp://tecnocoffee[.]com[.]tr/wp-content/themes/enlighten/connection[.]php
hxxp://tecnocoffee[.]com[.]tr/wp-includes/connection[.]php
hxxps://www[.]bedavasat[.]com/export/connection[.]php
hxxps://www[.]bedavasat[.]com/iyzipay/src/Iyzipay/connection[.]php
hxxps://www[.]bedavasat[.]com/fileserver/connection[.]php
hxxp://ustaariyorum[.]com[.]tr/wp-content/themes/wpfirma/connection[.]php
hxxp://ustaariyorum[.]com[.]tr/wp-includes/connection[.]php
hxxp://escapefromsofa[.]com/theme/efs/connection[.]php
hxxp://escapefromsofa[.]com/ajax/connection[.]php
hxxp://www[.]ozturkormancilik[.]com[.]tr/wp-content/themes/twentyfourteen/connection[.]php
hxxp://www[.]ozturkormancilik[.]com[.]tr/wp-includes/connection[.]php
hxxp://trakyacepteknik[.]com/tema/telefon/vendor/assets/connection[.]php
hxxp://trakyacepteknik[.]com/tema/telefon/fonts/font-awesome/css/connection[.]php
hxxp://asortiemobilya[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://asortiemobilya[.]com/wp-includes/Text/connection[.]php
hxxp://ozmetalpen[.]com/wp-content/themes/twentyfourteen/connection[.]php
hxxp://ozmetalpen[.]com/wp-includes/connection[.]php
hxxp://nevzatsolmazinsaat[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://nevzatsolmazinsaat[.]com/wp-includes/connection[.]php
hxxp://standartdogalgaz[.]com/wp-content/themes/themo/connection[.]php
hxxp://standartdogalgaz[.]com/wp-includes/connection[.]php
hxxp://startr[.]com/admin/connection[.]php
hxxp://startr[.]com/system/library/connection[.]php
hxxp://birtavsiyemvar[.]com/assets/css/connection[.]php
hxxp://birtavsiyemvar[.]com/assets/js/connection[.]php
hxxp://www[.]karavanseyahat[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]karavanseyahat[.]com/wp-includes/connection[.]php
hxxp://reklambasvurusu[.]com/sistem/connection[.]php
hxxp://reklambasvurusu[.]com/!ercer2001/sistem/connection[.]php
hxxp://www[.]ckumas[.]com/wp-admin/connection[.]php
hxxp://www[.]ckumas[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]ckumas[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]ilksahibinden[.]com/kvitrin/connection[.]php
hxxp://www[.]ilksahibinden[.]com/mobil/connection[.]php
hxxp://www[.]emlakbizden[.]com/libs/connection[.]php
hxxp://www[.]emlakbizden[.]com/templates/yedekparca/images/connection[.]php
hxxp://enerjiport[.]org/wp-includes/connection[.]php
hxxp://enerjiport[.]org/wp-content/themes/twentyseventeen/connection[.]php
hxxp://rentacarline[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://rentacarline[.]com/wp-includes/connection[.]php
hxxp://www[.]akillipati[.]com/wp-content/themes/colormag/connection[.]php
hxxp://www[.]akillipati[.]com/wp-includes/connection[.]php
hxxp://www[.]pergolatentefiyatlari[.]com/wp-content/themes/twentyseventeen/connection[.]php
hxxp://www[.]pergolatentefiyatlari[.]com/wp-includes/connection[.]php
hxxp://www[.]oroazteca[.]net/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]oroazteca[.]net/wp-includes/connection[.]php
hxxp://markizorganizasyon[.]com/wp-includes/connection[.]php
hxxp://markizorganizasyon[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://akin[.]me/wp-includes/connection[.]php
hxxp://akin[.]me/wp-content/themes/founder/connection[.]php
hxxp://www[.]bogazturu[.]net/includes/connection[.]php
hxxp://www[.]bogazturu[.]net/plugins/content/finder/connection[.]php
hxxp://onurlergayrimenkul[.]com/application/language/english/connection[.]php
hxxp://onurlergayrimenkul[.]com/themes/3d-blue-portal/library/connection[.]php
hxxp://stsiletisim[.]com/admin/connection[.]php
hxxp://stsiletisim[.]com/sistem/connection[.]php
hxxp://www[.]a-zgrup[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]a-zgrup[.]com/wp-includes/connection[.]php
hxxp://matmazel-gelinlik[.]com/wp-includes/connection[.]php
hxxp://matmazel-gelinlik[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://www[.]gokkubbe[.]biz/wp-includes/connection[.]php
hxxp://www[.]gokkubbe[.]biz/wp-content/themes/Extra/connection[.]php
hxxp://eraslan[.]com[.]tr/en/about/connection[.]php
hxxp://eraslan[.]com[.]tr/en/history/assets/nokta/css/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_ajax/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_inc/connection[.]php
hxxp://yildizgokart[.]com/wp-content/plugins/contact-form-7/includes/connection[.]php
hxxp://yildizgokart[.]com/wp-includes/connection[.]php
hxxp://cinarli[.]com/catering/img/connection[.]php
hxxp://cinarli[.]com/restaurant/captcha/connection[.]php
hxxp://sumder[.]org/wp-content/themes/sumder/connection[.]php
hxxp://sumder[.]org/wp-includes/connection[.]php
hxxp://alyanslife[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://alyanslife[.]com/wp-includes/connection[.]php
hxxp://www[.]hibedanis[.]com/admin/connection[.]php
hxxp://www[.]hibedanis[.]com/en/_inc/connection[.]php
hxxp://yildizgokart[.]com/wp-content/languages/plugins/connection[.]php
hxxp://yildizgokart[.]com/wp-includes/connection[.]php
hxxp://acililan[.]net/libs/connection[.]php
hxxp://www[.]goldenplus[.]com[.]tr/_inc/connection[.]php
hxxp://qrme[.]site/wp-content/themes/twentyseventeen/connection[.]php
hxxp://qrme[.]site/wp-includes/connection[.]php
hxxp://stmgage[.]com/system/engine/connection[.]php
hxxp://stmgage[.]com/system/config/connection[.]php
hxxp://novusglobal[.]us/templates/zoner/connection[.]php
hxxp://novusglobal[.]us/yonet/includes/connection[.]php
hxxp://1111crm[.]com/3Party/ckeditor/plugins/bidi/lang/connection[.]php
hxxp://1111crm[.]com/ESKI/loginbox/system/connection[.]php
hxxp://rehberhds[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://rehberhds[.]com/wp-includes/connection[.]php
hxxp://ctteknik[.]com[.]tr/wp-content/themes/one-page/connection[.]php
hxxp://ctteknik[.]com[.]tr/wp-includes/connection[.]php
hxxp://ngvisco[.]com/wp-includes/connection[.]php
hxxp://ngvisco[.]com/wp-content/themes/betheme/connection[.]php
hxxp://kursunkalemhoca[.]com/wp-content/themes/twentyseventeen/connection[.]php
hxxp://kursunkalemhoca[.]com/wp-includes/connection[.]php
hxxps://www[.]asortie[.]com/blog/wp-content/themes/colormag/connection[.]php
hxxps://www[.]asortie[.]com/blog/wp-includes/connection[.]php
hxxp://www[.]tulayalpayegitim[.]com/wp-content/themes/einsteiniumist/connection[.]php
hxxp://www[.]tulayalpayegitim[.]com/wp-includes/customize/connection[.]php
hxxps://bayanhobisi[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxps://bayanhobisi[.]com/wp-includes/connection[.]php
hxxp://3eyonetim[.]com/wp-includes/connection[.]php
hxxp://3eyonetim[.]com/wp-content/themes/twentyfifteen/connection[.]php
hxxp://derinbutikotel[.]com/templates/beez3/language/en-GB/connection[.]php
hxxp://derinbutikotel[.]com/includes/connection[.]php

Comments

Post a Comment

Popular posts from this blog

A Quick Dip into MuddyWater's Recent Activity

Image
INTRODUCTION Since my last blog-post  on MuddyWater operations, they seem to have been continuing their activities and as expected developing/changing some of their tactics and techniques. It is still apparent their heavy focus on layered obfuscation and preference for PowerShell. However, I will highlight what changed based on the sample that I will be analyzing. This started with the sample "idrbt.doc " -  009cc0f34f60467552ef79c3892c501043c972be55fe936efb30584975d45ec0  uploaded to VT on February 27, 2017. IDRBT stands for Institute for Development and Research in Banking Technology which according to Wikipedia is an institution exclusively focused on Banking Technology. Established by the Reserve Bank of India (RBI) in 1996, the Institution works at the intersection of Banking and Technology. It is located in Hyderabad, India. Right from carrying out cutting-edge Development and Research, enabling creation of technology infrastructure to moulding the ...
Read more

POWERSING - FROM LNK FILES TO JANICAB THROUGH YOUTUBE & TWITTER

Image
INTRODUCTION This post will discuss an ongoing campaign that have been operational since at least August 2017 . The post will look into the delivery of the malware, some analysis on the payload, and some additional insights in relation to the campaign. It is by no means a full in depth analysis of the malware and all it's functionality.  LAWYER UP!! This all started with a tweet by the AWESOME Jacob Soo ( @_jsoo_ ) whom I recommend you go and follow if you are interested in analyzing malware and tracking different threat actors. The sample is a ZIP file titled "Dubai_Lawyers_update_2018.zip" and the archive contains two LNK files that are perpetrating to be PDF files. The actors in this case borrowed couple of files from the British Embassy site and used them as decoy documents to lure victims into believing that these files are in fact legitimate. https://assets.publishing.service[.]gov.uk/government/uploads/system/uploads/attachment_da...
Read more

PRB-Backdoor - A Fully Loaded PowerShell Backdoor with Evil Intentions

Image
INTRODUCTION The great people at ClearSky  reached out to me a couple of days ago regarding a sample that they suspected could be related to MuddyWater.  They suspected so because the sample had some similarities with the way MuddyWater lures look like and some similarities in some PowerShell obfuscation, in specific the character substitution routine. MuddyWater Sample New Sample However, after analyzing the sample and investigating it more, I was able to showcase that this is indeed something different but nonetheless interesting. This blog is a walk through my analysis and will highlight initial insights into this potential attack. THE SAMPLE - FROM AIRMILES TO MACRO CODE TO POWERSHELL The sample that was shared with me is a macro laced word document called "Egyptairplus.doc " with an MD5 hash of  fdb4b4520034be269a65cfaee555c52e .  The macro code contains a function called Worker() which calls multiple other functions embed...
Read more