Dancho Danchev's Blog - Mind Streams of Information Security Knowledge: A Compilation of Known Conti Ransomware Gang Malicious Executable Download Locations

I've decided to continue data mining the recently leaked Conti Ransomware Gang internal communications on my way to find and share more actionable intelligence in terms of their Internet-connected infrastructure and in this post I've decided to share a set of currently active malicious executable download locations courtesy of the Conti Ransomware gang which you can check out in terms of attribution and cyber attack campaign take down efforts.

Sample list of currently active Conti Ransomware gang malicious executable download locations:

hxxp://copyrightlive-ksa.com/Preview_Report.exe

hxxp://ebeautytrade.com/calc.exe

hxxp://37.1.209.181/2805/locker.exe

hxxp://omegasystemsuae.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/Preview_Document.exe

hxxp://www.alkanzalzahabi.com/Preview_Document.exe

hxxp://omegasystemsuae.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/Preview_Document.exe

hxxp://www.alkanzalzahabi.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/P32.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://globaluxrma.com/Preview_Document.exe

hxxp://shighil.com/Preview_Document.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://www.bsrdesigns.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://www.bsrdesigns.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://alexandersqualitycleaners.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://www.omegasystemsuae.com/Document_Aerlingus.exe

hxxp://www.omegasystemsuae.com/RalphLaurenDocument.exe

hxxp://copyrightlive-uae.com/calc.exe

hxxp://copyrightlive-uae.com/ld1n.exe

hxxp://copyrightlive-uae.com/DAFSDASD.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://www.almakaan.com/DocumentPreview.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://45.153.240.191/crypt/18554hs.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://copyrightlive-uae.com/PreviewDocument.exe

hxxp://194.5.249.13/p32.exe

hxxp://globaluxrma.com/ReviewDocument.exe

hxxp://shawigroup.com/ReviewDocument.exe

hxxp://bloomfieldholding.com/ReviewDocument.exe

hxxp://bloomfieldholding.com/wp-content/ReviewDocument.exe

hxxp://greenmountains.ae/YAS42.exe

hxxp://greenmountains.ae/YAS42.exehxxp://copyrightlive-ksa.com/Preview_Report.exe

hxxp://www.alkanzalzahabi.com/DocumentPreview.exe

hxxp://copyrightlive-ksa.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://allacestech.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://allacestech.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/Setup.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://bloomfieldholding.com/DocumentPreview.exe

hxxp://bloomfieldholding.com/PreviewDocument.exe

hxxp://shawigroup.com/DuplicateFinder.exe

hxxp://shawigroup.com/Doc-Print.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/Doc-Print.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/Doc-Print.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocPreview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocPreview.exe

hxxp://www.ottenbourg.com/Doc-Preview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://shighil.com/Doc-Preview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://gk24w3eumyv4fqajpbw6jbrd6eb4kwvcqcfg4po25cnxuqs7hhhan6yd.onion/npcap.exe

hxxp://www.ottenbourg.com/AcademiPreview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://ajeetsinghbaddan.com/Doc-Preview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://ajeetsinghbaddan.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc1.exe

hxxp://reefglobal.com/dl2a.exe

hxxp://paullesueurlegacyfoundation.com/9rhjdkjfh.exe

hxxp://www.ottenbourg.com/nagpsdo.exe

hxxp://www.namaskardunia.com/badtest2.exe

hxxp://www.namaskardunia.com/test1.exe

hxxp://45.148.120.192/service64.exe

hxxp://45.148.120.192/service111.exe

hxxp://45.148.120.192/service222.exe

hxxp://fdsfdsf.com/fdsfds/file.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://45.148.120.192/service64.exe

hxxp://45.148.120.192/service111.exe

hxxp://45.148.120.192/service222.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://dylanengineeringservices.com/3.exe

hxxp://www.ottenbourg.com/5.exe

hxxp://maintenance.com/autoupdate.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://shighil.com/dl2.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://emploimed.com/dl2m.exe

hxxp://copyrightlive-ksa.com/t1000.exe

hxxp://www.shighil.com/dl2.exe

hxxp://nutritionprofbob.com/teste.exe

hxxp://copyrightlive-ksa.com/t1000.exe

hxxp://www.shiningshadowllc.com/DocumentPreview.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://brankovucinec.blob.core.windows.net/downloads/mstsc.exe_.manifest.zip

hxxp://emploimed.com/scintillabc.exe

hxxp://www.coalminds.com/Document_Print.exe

hxxp://www.sonorambc.org/Document_Print.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://puccienterprises.com/Preview.exe

hxxp://e-tech.ie/PreviewDoc.exe

hxxp://puccienterprises.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://e-tech.ie/PreviewDoc.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/prw/Preview.exe

hxxp://violinstop.com/Preview.exe

hxxp://nutritionprofbob.com/prw/Preview.exe

hxxp://reefglobal.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://middletownfriedchickengyro.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://easychurchbooks.com/Preview.exe

hxxp://sonorambc.org/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe-

hxxp://aspiremedstaff.com/Print.exe

hxxp://emploimed.com/Print_Preview.exe

hxxp://www.namaskardunia.com/Preview.exe

hxxp://atlantisprojects.ca/Preview.exe

hxxp://gilchrist.fl.us/Preview.exe

hxxp://www.parkisolutions.com/Preview.exe

hxxp://unitedyfl.com/Print_Preview.exe

hxxp://www.parkisolutions.com/Preview.exe

hxxp://fancydes.webd.pl/Review.exe

hxxp://rayanat.com/Print_Preview.exe

hxxp://wholesalebosmereusa.com/Preview.exe

hxxp://kohlheatingandair.com/Review.exe

hxxp://fancydes.webd.pl/Review.exe

hxxp://rayanat.com/Preview_Print.exe

hxxp://calacatta.com/Preview.exe

hxxp://google.com/update.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://www.adventureworldindia.com/Preview.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://globaluxrma.com/Review.exe

hxxp://emploimed.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/ReviewPrint.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://shighil.com/ReviewPrint.exe

hxxp://shighil.com/TerminationRep.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://www.omegasystemsuae.com/Preview.exe

hxxp://www.omegasystemsuae.com/BKOFR.exe

hxxp://copyrightlive-uae.com/P64.exe

hxxp://copyrightlive-uae.com/Print.pdf.exe

hxxp://copyrightlive-uae.com/P64.exe

hxxp://coffschamber.com.au/Review.exe

hxxp://cdn-102.anonfiles.com/XdzdPbVfo8/a6501123-1600284832/Review.exe

hxxp://cdn-33.anonfiles.com/L3oeQ0Vbo2/d37ab69a-1600287659/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://cdn-33.anonfiles.com/L3oeQ0Vbo2/d37ab69a-1600287659/Preview.exe

hxxp://portableapps.com/downloading/?a=TeamViewerPortable&n=TeamViewer%20Portable&s=s&p=&d=pa&f=TeamViewerPortable_15.9.4.paf.exe

hxxp://www.omegasystemsuae.com/BKOFR.exe

hxxp://www.delwarren.com/backup/nowin.exe

hxxp://wikiapply.ir/Scrip.exe

hxxp://shighil.com/Scrit.exe

hxxp://shighil.com/Scrip.exe

hxxp://shighil.com/Print.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://cdn-114.anonfiles.com/ZfSf52X2oc/76279be8-1600685243/mor125.exe

hxxp://dubaidreamsadventure.com/Print_Review.exe

hxxp://107.155.137.21/https_x64.exe

hxxp://stahlworks.com/dev/unzip.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/htp_x64.exe

hxxp://94.140.115.219/doc/htp_x86.exe

hxxp://94.140.115.219/1/http64.exe

hxxp://94.140.115.219/1/P32.exe

hxxp://94.140.115.219/1/P64.exe

hxxp://94.140.115.219/1/run1.exe

hxxp://94.140.115.219/1/run2.exe

hxxp://94.140.115.219/1/service_http64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/htp_x64.exe

hxxp://94.140.115.219/doc/htp_x86.exe

hxxp://94.140.115.219/1/http64.exe

hxxp://94.140.115.219/1/P32.exe

hxxp://94.140.115.219/1/P64.exe

hxxp://94.140.115.219/1/run1.exe

hxxp://94.140.115.219/1/run2.exe

hxxp://94.140.115.219/1/service_http64.exe

hxxp://94.140.115.219/crypt/3/http_8080_x64.exe

hxxp://94.140.115.219/crypt/3/http64.exe

hxxp://94.140.115.219/crypt/3/https_8443_x64.exe

hxxp://94.140.115.219/crypt/3/P64.exe

hxxp://94.140.115.219/crypt/3/run2.exe

hxxp://94.140.115.219/crypt/3/run1.exe

hxxp://94.140.115.219/crypt/3/https_8443.exe

hxxp://94.140.115.219/crypt/3/http8080.exe

hxxp://94.140.115.219/crypt/3/http_8080_x64.exe

hxxp://94.140.115.219/crypt/3/http64.exe

hxxp://94.140.115.219/crypt/3/https_8443_x64.exe

hxxp://94.140.115.219/crypt/3/P64.exe

hxxp://94.140.115.219/crypt/3/run2.exe

hxxp://94.140.115.219/crypt/3/run1.exe

hxxp://94.140.115.219/crypt/3/https_8443.exe

hxxp://94.140.115.219/crypt/3/http8080.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

Stay tuned!

Dancho Danchev's Blog - Mind Streams of Information Security Knowledge

A Compilation of Known Conti Ransomware Gang Malicious Executable Download Locations - An OSINT Analysis

About Dancho Danchev

0 Comments:

RSS Feed

Search This Blog

About Me

Blog Archive

Tags

Popular Posts