SHA256: 4560c27d6656bcf5f5f4d101daab3ccdd5f0edd4f5b279b66464019a7cbe9aba
VT: https://www.virustotal.com/gui/file/4560c27d6656bcf5f5f4d101daab3ccdd5f0edd4f5b279b66464019a7cbe9aba/behavior
Updates: https://www.entdark.net/2022/09/zanubis-updates-their-list-of-targets.html

Websocket C2: 45.80.209.219:8000

Setup C2s:
http://hilineinternational[.]com/favicon.ico
http://hilineinternational[.]com/wp-content/informes/assets/css/animate.min.css
http://hilineinternational[.]com/wp-content/informes/imagenes/samsung/samsung_r_1.png
http://hilineinternational[.]com/wp-content/informes/imagenes/samsung/samsung_r_2.png

C2s:
http://001[.]safoodinc[.]com/005/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/006/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/001/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/004/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/002/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/010/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/003/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/008/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/007/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/009/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/011/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/015/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/017/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/012/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/014/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/013/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65
http://001[.]safoodinc[.]com/016/d2802ce8a9529fb351ebd500c918d44b/inicio?pvs=gt65

TARGETED BANKS:

pe.com.banBifBanking.icBanking.androidUI
com.bbva.nxt_peru
pe.com.interbank.mobilebanking
com.mibanco.bancamovil
pe.com.scotiabank.blpm.android.client
com.bcp.bank.bcp
pe.com.bn.app.bancodelanacion
per.bf.desa
com.bcp.innovacxion.yapeapp
com.pe.cajasullana.cajamovil
pe.pichincha.bm
com.ripley.banco.peru
com.cmac.cajamovilaqp
com.cajahuancayo.cajahuancayo.appcajahuancayo
com.cmacica.prd
pe.cajapiura.bancamovil
pe.solera.tarjetaoh
com.alfinbanco.appclientes
pe.com.bancomercio.mobilebanking
com.bm_gnb_pe
com.zoluxiones.officebanking
pe.com.cajametropolitana.homebankingcml.cmlhomebanking
com.pe.cajacusco.movil
com.caja.myapplication
com.cajamaynas.cajamaynas
com.cajatacna.droid
com.appcajatrujillo
pe.com.tarjetacencosud.canales.mitarjetacencosud
pe.com.cajacentro
pe.com.prymera.digital.app
pe.com.compartamos.bancamovil
pe.confianza.bancamovil
id=com.credinkamovil.pe
pe.com.scotiabank.blpm.android.client.csf
com.efectivadigital.appclientes
com.qapaq.banking
pe.com.tarjetasperuanasprepago.tppapp
maximo.peru.pe
air.PrexPeru
pe.com.tarjetaw.neobank
com.fif.fpay.android.pe
com.cencosud.pe.metro
com.cencosud.pe.wong
com.tottus
com.pichincha.cashmanagement
com.binance.dev
com.gateio.gateio
com.google.android.apps.authenticator2
com.bbva.GEMA.global
pe.com.scotiabank.businessbanking
com.bcp.bank.tlc
com.scotiabank.telebankingapp
com.bitkeep.wallet
com.bitmart.bitmarket
com.bitcoin.mwallet
com.bbva.bbvawalletpe
com.bbva.lukita
cash.klever.blockchain.wallet
org.theta.wallet
com.wallet.crypto.trustapp
com.myetherwallet.mewwallet

Edit
Pub: 11 Oct 2022 04:37 UTC
Views: 2553