Malware Phone Back C&Cs (Command and Control) Domains for Media Land Bulletproof Hosting Provider Themed Malicious Software - An Analysis
Dear blog readers,In this post I'll provide actionable intelligence on some of the malware phone ba 2026-7-24 18:50:31 Author: ddanchev.blogspot.com(查看原文) 阅读量:2 收藏

Dear blog readers,

In this post I'll provide actionable intelligence on some of the malware phone back C&C (Command and Control) domains for Media Land bulletproof hosting provider themed malicious software.

Sample phone back C&C (Command and Control) domains include:

hxxp://2no.co

hxxp://4kyoutubedonwloader.xyz

hxxp://activehostnet.com

hxxp://adsapomg.space

hxxp://airsarald.com

hxxp://anorelier.hk

hxxp://apps.identrust.com

hxxp://archessee.com

hxxp://artatighab.com

hxxp://asc6.kozow.com

hxxp://asianspades.com

hxxp://badlandsparks.com

hxxp://baminamum.com

hxxp://barddistocor.com

hxxp://bariomowel.com

hxxp://barjamanis.com

hxxp://bbenttexas.com

hxxp://besfdooorkoora.com

hxxp://biderkomoso.com

hxxp://bigbrozz.com

hxxp://bilaneped.com

hxxp://biscayneinn.com

hxxp://bonesta223s.com

hxxp://brazzb.top

hxxp://bristleconepin.com

hxxp://brucewayneint.com

hxxp://byperholl.com

hxxp://bystinkasjhpop.com

hxxp://carlsbadmx.com

hxxp://centos10.com

hxxp://chumashpeople.com

hxxp://clockdoplannow.hopto.org

hxxp://cobroserfinansa.com

hxxp://confirmssystems.com

hxxp://congareesc.com

hxxp://crarepo.com

hxxp://cuyahogarave.com

hxxp://cuyahogav.com

hxxp://cyberpunkstories.com

hxxp://dasgamih.space

hxxp://escadrenalcortex.com

hxxp://espwwopypmlt.com

hxxp://eymfequeuunj.su

hxxp://freedns.afraid.org

hxxp://futboolspaceesk.com

hxxp://gakserol.site

hxxp://gcleaner-partners.us

hxxp://germsguide.com

hxxp://gg-clean.hk

hxxp://ghjhk45y4.xyz

hxxp://gineuter.info

hxxp://gnuwin32.sourceforge.net

hxxp://gomisacar.com

hxxp://greatsmokym.com

hxxp://greenlandsurround.com

hxxp://grelkafestivales.com

hxxp://gunnisonandco.com

hxxp://gyeonggidoo.com

hxxp://hkhktccdemju.it

hxxp://hublids.com

hxxp://idcwddfedtum.com

hxxp://idcwddfedtum.it

hxxp://interludeeurope.com

hxxp://islacangrejo.fun

hxxp://j2888hennene.site

hxxp://japanweterans.com

hxxp://jewelnetspacecon2.com

hxxp://jload05.xyz

hxxp://jload06.xyz

hxxp://jload07.xyz

hxxp://jload08.xyz

hxxp://jolietamandatenasta.com

hxxp://katananestwate.com

hxxp://kiribatirepublic.com

hxxp://kitemimbe.com

hxxp://kuskokwimca.com

hxxp://lawrencemaths.com

hxxp://maineacadia.com

hxxp://mangroveforests.com

hxxp://marinechil.com

hxxp://maudqueen.com

hxxp://mildibsilgip.com

hxxp://molothunsen.com

hxxp://msprotect.icu

hxxp://msquirms.com

hxxp://myloveworld.space

hxxp://natiapropoint.com

hxxp://naukluftp.com

hxxp://naumokukea.com

hxxp://paunsaugunt.com

hxxp://piedmontteem.com

hxxp://precambrianera.com

hxxp://prohomedevs.com

hxxp://prometai.com

hxxp://radagohs.space

hxxp://rattlesnakespr.com

hxxp://restofoodquid.com

hxxp://rineialav.com

hxxp://sastabiak.com

hxxp://skolkovolkanekormionseravnovlessmotrit.ru

hxxp://sourceforge.net

hxxp://sumliomicna.com

hxxp://swiloodex.com

hxxp://termscenter.com

hxxp://thekavango.com

hxxp://thepleasurelive.com

hxxp://thoughtlibrary.top

hxxp://tonitrus.pw

hxxp://toptrendclub.com

hxxp://torinboo.com

hxxp://tuckong.com

hxxp://turedneez.com

hxxp://uppan.site

hxxp://viio.top

hxxp://vitya01.xyz

hxxp://waterpocketfold.com

hxxp://winstatic.host

hxxp://winstatic.top

hxxp://www.google.com

hxxp://xred.mooo.com

hxxp://xrussianhitman.xyz

hxxp://youlifemylife.wang

Sample phone back C&C (Command and Control) URLs include:

hxxp://geeto.space/80.exe

hxxp://gcleaner-partners.us/do.php?pub=pux

hxxp://byperholl.com/ir.php

hxxp://resilchird.com/313

hxxp://loaadkkkk01.top/file.exe

hxxp://maineacadia.com/540

hxxp://5.45.179.183/

hxxp://vitya01.xyz/index.php

hxxp://gineuter.info/index.php

hxxp://xrussianhitman.xyz/gate.php?prf=1

hxxp://xrussianhitman.xyz/gate.php

hxxp://activehostnet.com/gate.php

hxxp://xrussianhitman.xyz/gate.php?p=3

hxxp://xrussianhitman.xyz/gate.php?gpp=1

hxxp://xrussianhitman.xyz/gate.php?p=4

hxxp://barddistocor.com/623

hxxp://precambrianera.com/560

hxxp://naukluftp.com/517

hxxp://piedmontteem.com/237

hxxp://hublids.com/598

hxxp://sumliomicna.com/408

hxxp://tonitrus.pw/conf.php

hxxp://rineialav.com/softokn3.dll

hxxp://prometai.com/index.php

hxxp://rineialav.com/nss3.dll

hxxp://rineialav.com/693

hxxp://rineialav.com/vcruntime140.dll

hxxp://mildibsilgip.com/index.php

hxxp://rineialav.com/msvcp140.dll

hxxp://futboolspaceesk.com/237

hxxp://kiribatirepublic.com/563

hxxp://gg-clean.hk/amixlow

hxxp://myloveworld.space/install.exe

hxxp://tuckong.com/237

hxxp://brazzb.top/index.php

hxxp://bystinkasjhpop.com/237

hxxp://jload06.xyz/3.exe

hxxp://paunsaugunt.com/581

hxxp://anorelier.hk/index.php

hxxp://viio.top/dillinger.php

hxxp://gunnisonandco.com/560

hxxp://bristleconepin.com/237

hxxp://msquirms.com/543

hxxp://msprotect.icu/gate.php

Related MD5s known to have been involved in the campaign include:

b23d69f0e6c5d3e052feb3d7f2755464

f0ae686efc2dc92f747032c0d32fa2d1

5cb839d05007ed68f33c5a2fe5b063cd

8e1f89c74db9b9b919bfb8ed31aea833

56ec2eee9040813f1e505f476b1412f8

b6acb3c13244515ec078ff24ea523713

163a79fe07ad55433db4c41746d88383

f905e13e4173b729e04e4890cb4e43e6

055b65ee5d713552507fad6961239ac3

ef38c638ea2d98b8ed94a8f1dff7115e

bda236614e7a2d166210f34eb8a9b279

4d875c0a6a4380f04ebcb7d2322e83f8

d395f31ef5c5b3b3131667d2a491c09e

107a1da4ec63ee1e07f8bdd642620cbf

2fd3d8eb0cbae77c212534dbdee4cf8e

e12023a8cedd4437e040d4f1bab1e173

791447f627a95f43f18120c2db4517dc

bbbf580a4763341480392ed6c3f8b38d

1b4312449cd9da34e947b924deec6ca0

160d19acc06811596b43fcb10aa59e06

6f75b0c405d5088c5c9ad0bfd296438d

d2b83bc55d05dc8392b9e3f01b2a1d6e

7a707e4381ccac0ab105545e42896a3e

95b3dfa13121169342923988edfaf518

42022c3b6b78c4ce91120c58a303ae89

f7aaa317f34067232e0dc72cf2d4f8c1

2b0870abcd44b08dfc8daf9e3feb4efc

85fb8229a2462c5e11db1adc5bcc6033

1f0847c144b90e59ffd6b15ce577f2c1

4037fc5e3474f5c800ea9f72d28713d9

8fda0f476fe5b5a6fadcc0d48c7aa723

6800f5ba56ab885f44b683eb7459f879

9f0cc56747c3fe8e92c319165fa7fa7a

843e34240b8b0867f2004282480120f8

7da88c6a76233073392eda3c0e194945

f9f125970d8449535f134e5640a0fb67

e7547d95cdd234c76ffc3886c5686f7a

4a6be0ce4aa70578bdee550acbbf7414

cd0c4e86c41d7fd573c7b1b7eafb605d

c3798777ed4ca35bc1cdf5e285e7646a

1487873262ad3552538209464dcfa324

4d68507752275a8607502b0ae14ef9a1

448e6a189eb3f4a66509d62050fa8bb0

9819d3fbecc5ccec8d6b9158757ab638

057954ec20ab94f8e18e040df502ff4c

ec22c88764914db7f97065d451b0275d

e9d8e4e7a9e04ed6de75d6595d76ef7f

45840b3e1bf86ba35bcc0db2b106bcdf

5978022f030730c9a389d845db54c921

9f00149b9fe09dc6c6410dae0e0b4669

5ea7c46049ff52d21f9ce6e620b59d3f

418e9a5f23ec8b712b7715ba4ea552be

1037905e13b8bb3d78211ac1e67b0d48

1986ee20286d3cc2ba9ed14b938ff45b

3d1c3b77016a6f05d5a5b6ec2d6d8782

30bc60c3d5560f8e90b5b2ec101a181d

f81a70f458e8fc6316290b5864dc7660

f0020156620316643e224e8c94486c95

46abce9cc2659d69fb22013cb50c179d

d2fce61d6af3591f2b4c325977618c34

f3f03372adee0f44615e5a5e494990b3

1c7be79dbeeaa081fee6eba01960cf2b

d660d625f66c694687458e1fbe875f2f

1fa11bb4b773f35d9e0b2bfdf9e30f15

69e5ed9aec279294e34997335ee6f993

a4f8b7616f811325402ea3728ac4f79b

9de9b352e83fdf73a702d60cd0d65134

d002c8eecdacbdc160e622164db556fa

73ce2417b1e546613fd64cf38760465c

81382f6d6c9920734f7c9c45df0b8c33

35a5ec11e1e2ac1e4ed4c8e3fa5fa361

c09ef8f4abe67bca93c589b57099cda0

55264f1e9967979aab361c514023879f

1c88d29b72754e0153753a8d8e992bd5

e1a015a2bd60566a4a5085226db3a0a5

c3af9a48bfd978fbf9d16174dacd3f99

13712db9c1f4f8a736b6a13bb7b88750

5d8be44d69df95d76a493604dab21a34

4c812b2bce523ff5dd4d9da391b43d4a

a2324b8460b4188552c8138f8bcdcd0a

ccc4e1584d834bf3e818d31e28ea3342

7de09a43c2da8bf92755b257e3b49f83

8d1b328e45b2a733bcb82ecdd11019e6

be6c2e2b475adfaeb6a26d9599e37a4e

8e4322eb184956e2eff2ec83bd99a3ae

f38976adccf4b95be1efdcc37806d480

8f0eb1e9493c9045be2113bd86860351

0be8650868f66537132973b52922d941

2f800547483ae821dd249eec67ba7c42

1ea8237bbab1f0c9ca95960beaf5d929

f4a19577b59b1f1026a508187676aa9b

4a3161191f24f0c0270c68f34de4ed33

913c88696fead888c7c40462e86e3598

d64e64da562f363fb58d08844315ac46

bd2045f4252677409cfde6fc0e2ce24b

5119183d6bb07255ac37f66030af2356

e6836dee08b31a59b7f5f9b45ae8a137

5c8f58f5e2933affaba12f1f9b61a757

eb2a513ebdb0682f955cf3d3d694f53f

4808b9126edafa5d884a3584e231367a

1727cbefa3df65dd6f1912dcc2b88c41

6a9a6949348ec70db1108453871e38ec

7a19996385152ac711085a6bcb7fb0f9

6aadf463b910a91a015b872b48366c48

a42611d494e8eaa2acf53c6b20fde7a9

849e74f7360db975c6913665278225dc

744df50b8d795c50a220006b289e2672

59c15a0ea49a509b2f1b6f042959a9bc

2662d1c38c4e9ce6c25f728a2759aade

db47e70f12e2dd8992cd96bf45134a6b

6fb1d944c5808a77716649ab3efa1a7c

fe82e6c9502e469dbdea451625d895cb

8df279ff2a32ea877b745dae7e0f813c

Related malicious software phone back C&C (Command and Control) URLs include:

hxxp://2no.co/17y7e7

hxxp://2no.co/6vAGP

hxxp://4kyoutubedonwloader.xyz/getFile.php?source=USA1h1

hxxp://4kyoutubedonwloader.xyz/getFile.php?source=USA1h3

hxxp://4kyoutubedonwloader.xyz/getSoftware.php

hxxp://activehostnet.com/gate.php

hxxp://anorelier.hk/index.php

hxxp://archessee.com/408

hxxp://archessee.com/517

hxxp://barddistocor.com/237

hxxp://barddistocor.com/408

hxxp://barddistocor.com/517

hxxp://barddistocor.com/623

hxxp://bariomowel.com/517

hxxp://bariomowel.com/556

hxxp://bariomowel.com/560

hxxp://bigbrozz.com/237

hxxp://bigbrozz.com/420

hxxp://bilaneped.com/237

hxxp://bilaneped.com/328

hxxp://brazzb.top/index.php

hxxp://bristleconepin.com/237

hxxp://bristleconepin.com/623

hxxp://byperholl.com/ir.php

hxxp://byperholl.com/te.php?command=dl&id=1494527369

hxxp://byperholl.com/te.php?command=getid

hxxp://byperholl.com/te.php?command=ghl&id=

hxxp://byperholl.com/te.php?command=version&id=1494527369&soft_ver=byp1.0&win_ver=V2luZG93cyBYUCBTUCAz

hxxp://bystinkasjhpop.com/237

hxxp://centos10.com/408

hxxp://centos10.com/517

hxxp://centos10.com/618

hxxp://congareesc.com/517

hxxp://congareesc.com/590

hxxp://futboolspaceesk.com/237

hxxp://futboolspaceesk.com/560

hxxp://gcleaner-partners.us/cyucud.php?pub=

hxxp://gcleaner-partners.us/started.php?name=artifact.exe&pub=

hxxp://geeto.space/80.exe

hxxp://gg-clean.hk/afdop

hxxp://gg-clean.hk/amixlow

hxxp://gineuter.info/index.php

hxxp://gomisacar.com/237

hxxp://gomisacar.com/freebl3.dll

hxxp://gomisacar.com/mozglue.dll

hxxp://gomisacar.com/msvcp140.dll

hxxp://gomisacar.com/nss3.dll

hxxp://greenlandsurround.com/523

hxxp://gunnisonandco.com/517

hxxp://gunnisonandco.com/560

hxxp://gunnisonandco.com/581

hxxp://gunnisonandco.com/83

hxxp://hublids.com/237

hxxp://hublids.com/598

hxxp://interludeeurope.com/237

hxxp://interludeeurope.com/328

hxxp://interludeeurope.com/517

hxxp://jewelnetspacecon2.com/523

hxxp://jload05.xyz/2.exe

hxxp://jload05.xyz/3.exe

hxxp://jload05.xyz/download.php?file=4.exe

hxxp://jload06.xyz/3.exe

hxxp://jload06.xyz/5.exe

hxxp://jload06.xyz/download.php?file=5.exe

hxxp://jolietamandatenasta.com/642

hxxp://katananestwate.com/517

hxxp://katananestwate.com/523

hxxp://kiribatirepublic.com/517

hxxp://kiribatirepublic.com/523

hxxp://kiribatirepublic.com/563

hxxp://kitemimbe.com/237

hxxp://kitemimbe.com/msvcp140.dll

hxxp://kitemimbe.com/nss3.dll

hxxp://kitemimbe.com/softokn3.dll

hxxp://kitemimbe.com/vcruntime140.dll

hxxp://lawrencemaths.com/598

hxxp://loaadkkkk01.top/file.exe

hxxp://maineacadia.com/302

hxxp://maineacadia.com/408

hxxp://mildibsilgip.com/index.php

hxxp://molothunsen.com/523

hxxp://molothunsen.com/534

hxxp://molothunsen.com/560

hxxp://msprotect.icu/gate.php

hxxp://msquirms.com/543

hxxp://myloveworld.space/install.exe

hxxp://naukluftp.com/237

hxxp://naukluftp.com/517

hxxp://naukluftp.com/560

hxxp://naumokukea.com/523

hxxp://paunsaugunt.com/581

hxxp://piedmontteem.com/237

hxxp://piedmontteem.com/517

hxxp://precambrianera.com/324

hxxp://precambrianera.com/328

hxxp://precambrianera.com/560

hxxp://precambrianera.com/581

hxxp://prometai.com/index.php

hxxp://resilchird.com/313

hxxp://restofoodquid.com/des.php?command=dl&id=1494552903

hxxp://restofoodquid.com/des.php?command=getbackconnect&id=1494552903

hxxp://restofoodquid.com/des.php?command=getip

hxxp://restofoodquid.com/des.php?command=update2&id=1494552903&ip=45.32.173.83&port=36901

hxxp://restofoodquid.com/rest.php

hxxp://rineialav.com/693

hxxp://rineialav.com/freebl3.dll

hxxp://rineialav.com/mozglue.dll

hxxp://rineialav.com/nss3.dll

hxxp://rineialav.com/softokn3.dll

hxxp://sastabiak.com/237

hxxp://sumliomicna.com/408

hxxp://sumliomicna.com/517

hxxp://swiloodex.com/237

hxxp://swiloodex.com/mozglue.dll

hxxp://swiloodex.com/msvcp140.dll

hxxp://swiloodex.com/nss3.dll

hxxp://swiloodex.com/vcruntime140.dll

hxxp://termscenter.com/543

hxxp://thekavango.com/523

hxxp://thekavango.com/566

hxxp://tonitrus.pw/conf.php

hxxp://tonitrus.pw/main.php

hxxp://tonitrus.pw/nss3.dll

hxxp://tonitrus.pw/softokn3.dll

hxxp://toptrendclub.com/348

hxxp://torinboo.com/237

hxxp://torinboo.com/408

hxxp://torinboo.com/517

hxxp://tuckong.com/237

hxxp://turedneez.com/237

hxxp://turedneez.com/freebl3.dll

hxxp://turedneez.com/msvcp140.dll

hxxp://turedneez.com/nss3.dll

hxxp://turedneez.com/softokn3.dll

hxxp://viio.top/dillinger.php

hxxp://vitya01.xyz/index.php

hxxp://xrussianhitman.xyz/gate.php?gpp=1

hxxp://xrussianhitman.xyz/gate.php?lp=1

hxxp://xrussianhitman.xyz/gate.php?p=3

hxxp://xrussianhitman.xyz/gate.php?p=4

hxxp://xrussianhitman.xyz/gate.php?pl=1


文章来源: https://ddanchev.blogspot.com/2026/07/malware-phone-back-c-command-and.html
如有侵权请联系:admin#unsafe.sh