INDICATORS APPENDIX

Proliferation of Mining Malware Signals a Shift in Cybercriminal Operations By Andrei Barysevich, Priscilla Moriuchi,

Daniel Hatheway

Last Updated on October 11, 2017

List of Public Mining Pools:

● https://nanopool.org ● https://moneroexplorer.com ● https://coinhive.com ● https://www.nicehash.com ● https://www.multipool.us ● https://www.antpool.com ● https://btc.com ● https://www.f2pool.com ● https://www.btcc.com ● https://slushpool.com ● https://www.viabtc.com ● https://bixin.com ● http://bitfury.com ● http://bcmonster.com ● https://www.bw.com ● http://www.bravo-mining.com ● https://www.blocktrail.com ● http://eligius.st

IP Tracking Service: https://iplogger.ru

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 1

INDICATORS APPENDIX

Control Panel Domains:

● http://a0149298.xsph.ru ● http://cb18017.tmweb.ru ● http://advtv2k2.beget.tech ● http://asterfox.beget.tech ● http://moringb6.beget.tech ● http://iplaymobporn.com ● http://vilitus.beget.tech ● http://lehanet8.beget.tech ● http://panzarland.ru ● http://miner.itsarov.tech ● http://a0152338.xsph.ru ● http://adevizvw.beget.tech ● http://baradve0.beget.tech ● http://penapen.ml ● http://samoillq.beget.tech ● http://bk-ratings.ru ● http://a0154347.xsph.ru ● http://h96088t4.beget.tech ● http://rabbitsj.beget.tech ● http://a0153383.xsph.ru ● http://piktukfd.beget.tech ● http://ih595601.myihor.ru ● http://karlikvm.beget.tech ● http://sitnik4h.beget.tech ● http://ogmapoibgsbnud.biz ● http://osglukxp.beget.tech ● http://mineelhr.beget.tech ● http://kristied.beget.tech ● http://wuntedj2.beget.tech ● http://www.zlives.ru ● http://wetik.beget.tech ● http://a0153933.xsph.ru ● http://etojosns.beget.tech ● http://top1chqu.beget.tech

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 2

INDICATORS APPENDIX

● http://ih649100.myihor.ru ● http://maxnem8g.beget.tech ● http://darksmtf.beget.tech ● http://weed10i6.beget.tech ● http://carraq7r.beget.tech ● http://cn49157.tmweb.ru ● http://std2.000webhostapp.com ● http://viphatg9.beget.tech ● http://vovochgi.beget.tech ● http://a0153884.xsph.ru ● http://lehanet8.bget.ru ● http://a0154980.xsph.ru ● http://betmakyy.beget.tech ● http://great.protectad.space ● http://meereskn.beget.tech ● http://killer5x.beget.tech ● http://blackrwd.beget.tech ● http://x96436po.beget.tech ● http://dgozefr8.beget.tech ● http://suicid2h.beget.tech ● http://gnv0niuc.beget.tech ● http://cy99381.tmweb.ru ● http://cb63970.tmweb.ru ● http://eblomai1.beget.tech ● http://landst4o.beget.tech ● http://idababsp.beget.tech ● http://gapifef4.beget.tech ● http://185.181.10.173. ● http://beelinx5.beget.tech ● http://hostint2.beget.tech ● http://btcminws.beget.tech ● http://dianes7w.beget.tech ● http://a0154466.xsph.ru ● http://dimas2nx.beget.tech ● http://noiseees.beget.tech

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 3

INDICATORS APPENDIX

● http://bit.hostenko.com ● http://cf85889.tmweb.ru ● http://otvjvudj.beget.tech ● http://p98503hr.beget.tech ● http://pharao0j.beget.tech ● http://w90461oa.beget.tech ● http://pcash.ru ● http://wunted6j.beget.tech ● http://sadating.xyz ● http://koskiahg.beget.tech ● http://host.com ● http://barinoik.beget.tech ● http://ih603163.myihor.ru ● http://hello-jesus.ru ● http://a0156274.xsph.ru ● http://pavlov2k.beget.tech ● http://landrpw5.beget.tech ● http://rnicha9j.beget.tech ● http://sartmla4.beget.tech ● http://privatefile.biz ● http://woweblk4.beget.tech ● http://binnezxz.beget.tech ● http://cs2.gaming.sk ● http://p96275xc.beget.tech ● http://huskfi.beget.tech ● http://denisvup.beget.tech ● http://xxxapk1j.beget.tech ● http://bulletlx46purify.onion.link ● http://omniviad.beget.tech ● http://jokerflr.beget.tech ● http://zlives.ru ● http://avast-free.zzz.com.ua ● http://prousb-lite.ws ● http://std3.000webhostapp.com ● http://shark2fh.beget.tech

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 4

INDICATORS APPENDIX

● http://a11t01t22t10.ru ● http://begggetr.beget.tech ● http://ih696740.myihor.ru ● http://mipanel.pe.hu ● http://paranoby.beget.tech ● http://asfsfwqt1.had.su ● http://maxvlod.top ● http://supermi6.beget.tech ● http://gabataiser.beget.tech ● http://cw68463.tmweb.ru

Sample Hashes:

● 00ce7f19486dfc9e578a85f69e3e9f1e2d47c50f703e1a6ce2840e3cb52acd89 ● 010f4e5498e63b918ebb3dd16b925baaa063afe181dd5941c183e281cf58e41b ● 013534dc3aa20a263e2848ae98b84bb2c0b62e02e745d366223c8d7ba290caeb ● 017929177f68cea8eae5d708de237171e13931fadf9f7779e55db259fdf795a6 ● 017e28efaa6dc64579bbf884bb601fd793c1281c5df47398ca5a2c8d80b126d0 ● 02b95e89e07b269f56ab66d56017a6f87c929951d9d2c5b971a5597f04d1badd ● 03430b47063e4e24f5aa683749602648d4f0afd4a5a0f6eeaed6e5e535c15e57 ● 034ad8c4b18eb73694ec9bdb361c8c901f2263961c871ca0af2d52d6e9a38a1e ● 03e15c75c983fe3b555d48a31c77d1c09574980d805daeedab614d87bcb2f79e ● 0422e8ec4f9ce52281cee6037d661ce21a69843462b2691eb14c4df1a69fdb8e ● 04c500c8de128df9b10a34b7bbd0329ddeb002a1d1eb6ed63a0945b1094ba6db ● 04e0b91e1f39a16f5b2814d473f5d5ba5945b26d5912ef99932e9093a52c5584 ● 04ff697707f70b35490ef035257332e9e628dfeeee6078b7dae76d6337154f05 ● 050830d7a8426f2ec523c9cedbca63f2756409deaa2cb00fb4a852968a7dd252 ● 0604906745bacb35f9a6c5780189734141e3e097ceabc6d8c2e52ac1f5b5d456 ● 070dc10788475314914812d055c3aa667d0fcd90efa08ea3833773b8eed370f3 ● 079195ec305e81c988588d1a38d317522c7643a6e6ee429b213fd39a08675068 ● 07fa7b32b5e62010d13eefb78c55adf0129a688769933b635ddc8d3c1b51ff6e ● 08d24c6797cb3c7e5cef44fcd115e26302751a2fb2a07c5b1a40b34ccf3c0cae ● 093b695239355e14d79d6deaaa0fd872dbda4dc55b7aa1a28f4b1f25164f4a7f ● 0992b3c989becd1f904e8caa16cdedc6306c2182e81bd0b63b2d7f0d72bb73a0

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 5

INDICATORS APPENDIX

● 09af12ebda7d5f245c1f90ae675d1ef7d5c1eea5410638d981da980dc235bccf ● 0b5f156a8f9001010b5b1b5e7a658a5a574eee3c4345ecd5081891559cd05169 ● 0cbf6190e0a381a0ec20a2b54156f06615453bb80ae2e1256242cb8af96b065d ● 0cc9265a1cf639d13df9b03af258cbe2f8ae01926101b6ccb2dacec674f9de9c ● 0ccd671c2ffca1d17a81065dda3b9769d0002c8045f6d8652687cde4c442aa24 ● 0e40c8b0a7aff554577d61efd463047ad9e3e6ac4831878738686b8822b0dedf ● 0e57f1b19d104c645437b40f634c97e0a3551674fcae691b40b821525afd09ec ● 0e5d043afb7116e74ef8e89baa034eb2ad705c440118579847119fdd38d1b813 ● 0fa17032dc63ccbcee2b3c55e0d28ce2146b1ed99461a9f18ba395f7fa85bfe5 ● 0fc9fe9f8fe5e1c36e2cfe19d1f72172673ed428c44aa8413337aff8d190c322 ● 11202697f50d096a38f7bb5e87aae2db8b4c496afa9b9e3a646f7cf5a59a6669 ● 11a66b88413ddf6b4a82e68afa568b3ffd241ef84c79c6d11f8f4421bb4d9f3a ● 1305cb01190bab0914fa1c37fa7a6c023daf976107433bd6da047388bbc283e9 ● 130d58f67b999250ee58dd23b3f13b976aa4fee30a528f66ca343bca1fd7e063 ● 1329d4901967a1799014029e340499af8c5ea559fcbd1dd4e31f63c5978d934e ● 132a5847a4583c283306c0861b21311b227952160ff595d5a073c2eeb4349ab2 ● 13817eaa6cab128ded4e1524f249279bd69746ced1e09893ad835fa4ce6f7233 ● 147eb559951df6fb2a8bb3284f0822a8bdd018ef4625cf6dcefda6f69dd1c452 ● 15a362274252790e2f258720d8c3ad2cfdfe5e848016920940fdcbb5f9152139 ● 161bd2d2effc8c54b6b9f1500da642770410cfc92a67ec8a156f37df67ed9a67 ● 163551a547ac90d684c041bcfebdcf376c7a322e1f82242ff60b5d3b12575b7e ● 16da8870df965e00046e473d6c3f674da3ff2428878f2670f86ed49e969290c9 ● 184b731aba6da70fbf48c29fa78228a2789cc9ef3f9c4cbccb66b302dff00708 ● 185e91c0e9e431aeb6adb4c74e9052ba078bafd89f8af40dda892356298c6ed0 ● 188159ff6f19ddb9001fca823f7d4222acb3c2782065aeb170b30bc7d6b26c64 ● 198806df4636e7e7af89f7e4fe3d74e8c519d95818b048cb18f1b7fbdf1da3ff ● 1bed210b4fe301ff25db01975c207038aed6e1526ed6011309d3cf37b449e1d0 ● 1cb1ad20156d535fea265e974d9864e1f896ca0858fa2dc7ca841c20c8190a9a ● 1ddf2734a5251b5eeefb2a1112f38a30a87f7c379cba4d697440c40d398c3f5f ● 1e3800f2b639a846f18bfe44d24dc5fb0f478b8d6cdc8256bd4015e2de7d64ff ● 1e7afbb206529792f27c643ce9848118fddb715ea3e5a8c9fe553b6c66636de6 ● 1f0cf06553b13faec81531e570b51e961cf7c583b0f23fa21d6993dd6a89d99f ● 1f1ccce3c32d466e7dd208031c7596e31edaf0d32166b2a241a6bec290c753ec ● 1f28214a7024e6a303e9dbd3326935eda532e0f43474ebfdcc18f7f42430d732 ● 1f5d165e6357fa695efca4a5d2a80050e64e7a257d9cd7a4bad150d51e605856

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 6

INDICATORS APPENDIX

● 1fc2c29eebd17810c17163e24f1476075cc7e1584dd6ff3b055b640b163fe6d9 ● 21db8ce74716048c9852186c443f82d7e0748134f382d2dbcdd4f774f0e2a786 ● 221d3c8a63b5cbd39c9793c6dfad5b417b1a00c0405021f02b9313f8e0f327e1 ● 22f3093f30beafcb1fa986906e2b3fd48c18d61b71bcf4a2e21e3ff834174aa4 ● 22f42e4ff2bc95c342de56168a6621ac13484163d676e7233ee828e0a58b1f30 ● 23013e0793f87d2bbf2ae9ac0a95445e29db25fe7a2c945002dd76193dc6aa98 ● 2322857e59b28e60f4dc62c346831a7f156568afa27d647358926434b089ac58 ● 235a6c5e82080edc7f706e53d546a86562f7bbc978057e87d643d2db5a1e63f2 ● 237bcc7808dcb2024af850b1d2da33d94e7a5350698a0f4844bea54990ee549f ● 23db5c73e5dec9fb45a08eb97ede8687699525e375bbda3db68a24aef77586d7 ● 248b1cbdb18d453c910f895a5f2b378318339288033dfa0d5273d46fad96e050 ● 24efcba5768256df948d836cc7b1ee61e29de14b5e400842f110acb5f33e747a ● 25012deed7a7e16cb7c12bb7b7d7f275068bc7dc4d32912355a83f4a47ac56bd ● 25992ccf47cdb1d0947659cecd151c78494523922eaa339153035cf4342d6eff ● 266af929e00a76c2a7d7245c3f2ef9b931726cd11e57ac93a5ef224fd5e73365 ● 26a1c57e68c54f3fae0f91db265da7e00ae36c018d7d26c0413c397f114a6eab ● 26b7eccf2ffe045e59b312e1e185b82ff6802a89cf86cece9af6e611e3fb4f6a ● 27e9d72241e271ba846a9f0b276bb02a5defeb8ec809d4df483254e8f76f64ab ● 287b37d24d7b2459884568ff899778da17dde621d9e1ea3438d4e1736f13c6a8 ● 289d152724cbd083543363d6fb3787f6bdf106d229d6120633c63173fd0d3f9d ● 29c23c35b5acd689de239a133a26e2dbc54ea87697777a712ba89da286fc2776 ● 2a6931e31a8ba9b78ead2042f7d11e294f2748c30539083a1ddfccc195f39836 ● 2a8b6819037e2391938670cede5e72eb9f718aab64aa507a479d71debdef6ec1 ● 2ac734066612fb86796aa34055a23d9fd82051b0501de56ea90b6dd3d2a86d6e ● 2c17199669d1bc240f3338c0b88f4054d6868531433873c91a651f808d84a51b ● 2c61c38f01feecbdf6d95e6f906eb2ba247e37e8fa1966fab6f9fb89972350f3 ● 2d0219b49cc9313d98da33c157286fba97c9555e5f8ed5082a87014c1e593524 ● 2d1048ce4355497ae67b7103cfe3a257612f17367379b462692d511f7313f015 ● 2e5a606b5fea6fd64a7d7c1bd46153666b3a4044b45ed4fbbe1cbc9f62e13037 ● 2eef58d44f7eb270a40d1bdee25843800aec3cc164057ff26500939ac048315d ● 2f32ec226d4cbc6c0e9586073a588f21ae05096616e8856ae504011072b11abf ● 2fc12bcd28a23ce4c82bd918cfab291ccc3f2ca4175979f0ea5eda1e7f844600 ● 306b14f3b9d376654d44683c0c1445814d5e5063ad05fba7526223115bda9ba6 ● 30c5ca0c20cdca915c20e8b454c5d08f83b60056abb6d6c42604a10d628bf113 ● 3127dd2d07f832963040000ee297c6b8fcca06a1bbd5f852816f376b3eaabab5

Recorded Future | www.recordedfuture.com | CTA-2017-1011 | 7

INDICATORS APPENDIX

● 318de9b4663566bcad2b9fd455d8dfa8a111a972222571d3c0191d620fa287b9 ● 3196d2535fadcbc7a5d97b4916e500ed92d49d837ed53710614c2bd586f3f450 ● 31faba4f27db60187feb3eb2b8f3fee548a7390a0b6eacbe02135f85ff652483 ● 32f2ff1ba3d4c5efa9bcef5771f68040a259fd2eb84d4980c87c43bcb78558d0 ● 3362d3417039092078ef4cc194e65708b7d7080ddef3606685d1969ddbae36c8 ● 3387f6574efb6455b276de375d11ca320b9d22e6c12d57b1e3ca667fdb56a91b ● 33ac016b7cabede8f900e78731383257491473837528c4387eb87d1f07c472c3 ● 33fb2fab3d50764cb0dd4949d848c083117de35b4f05acce1bd4b47b33806a3a ● 345dc95a2d9042a38497a6effa7e9125e59a0a475332a9d92124dc48062d7b03 ● 3533574115b0ed072c4e78b9f9cee0e1999f3c2e5e2fc9c7fcd2c61f7fee644a ● 35408719c744066f7f2a647b77985f5ebe28f5e9e8058097caebf258f8756523 ● 358e41a712490b23bf635f466dea0f4b44cef250b6c17cabe1bc634a2e7835df ● 35c64484af3ee8d1bb2f3e154e1b02365b08c379f79d25f5d64bc34246e80dfc ● 35df586d703551d4b64c1ca8c256834814c080d1a452b1f23a3f3584fc479d3c ● 360998313ce74cc146d5b6c0a3baa9e7942352a88821a06b3940cc9e344d2866 ● 3648a38a2c01f49a1d3f536c184c110665d32bc4cf33147