It’s been one month since I noticed an increase in number of malware communication to a certain IP: 185.6.242[.]251 and the trend has not slowed down in the last 30 days.

The total of web panel malware seen the last 30 days is totalling 97 as of this morning, as shown in this bar graph.

The distribution of malware C2 seen on this ip is uneven. Most are Lokibot and Pony instances, a few ISRStealer, LiteHTTP and Citadel have also been noticed.

A few stats:

  • 1 IP
  • 5 malware families
  • 30 Days
  • 47 Domains
  • 97 C2 Web panel instances
  • 222 MD5 hashes
malwarepanel_urldate
Citadelwww.dtron.gdn/testimony/cp.php?m=login20180420
Citadelnsdic.pp.ru/pilot/cp.php?m=login20180421
ISRStealersellychukwu.ru/PHP/20180412
LiteHTTPposalive.su/login/20180413
Lokibellegin.ru/don-cha11/pen.php20180412
Lokibellegin.ru/doncha10/pen.php20180412
Lokibellegin.ru/oshok/pen.php20180412
Lokigokuu.club/ckan/PvqDq929BSx_A_D_M1n_a.php20180412
Lokilidgeys.ru/buch-k/pen.php20180412
Lokilidgeys.ru/buch-m/pen.php20180412
Lokipapgon10.ru/davidm/pen.php20180412
Lokipapgon10.ru/don-12/pen.php20180412
Lokipapgon10.ru/kennyB-1/pen.php20180412
Lokipapgon10.ru/oshok-two/pen.php20180412
Lokigokuu.club/M/PvqDq929BSx_A_D_M1n_a.php20180414
Lokibraithwalte.co.uk/konvict/five/PvqDq929BSx_A_D_M1n_a.php20180418
Lokifinelets.ru/fankzu/pen.php20180418
Lokifinelets.ru/buch-x3/pen.php20180420
Lokifinelets.ru/buch-x4/pen.php20180420
Lokitopreadz.ru/willy-1/pen.php20180420
Lokilidgeys.ru/buch-x2/pen.php20180421
Lokidomainsender.info/moon/five/PvqDq929BSx_A_D_M1n_a.php20180422
Lokidunysaki.ru/buch-x5/pen.php20180423
Lokijoanread.ru/work-1/pen.php20180423
Lokidunysaki.ru/stephen/pen.php20180424
Lokitopreadz.ru/alexbe/pen.php20180424
Lokiunifarmex.net/Dstan/Panel/five/PvqDq929BSx_A_D_M1n_a.php20180424
Lokibraithwalte.co.uk/smith/five/PvqDq929BSx_A_D_M1n_a.php20180425
Lokidunysaki.ru/doncha-2/pen.php20180425
Lokilidgeys.ru/buch-l/pen.php20180425
Lokivopspyder.website/log/five/PvqDq929BSx_A_D_M1n_a.php20180425
Lokiannamadums.ml/jazzy/PvqDq929BSx_A_D_M1n_a.php20180426
Lokidomainsender.info/sun/five/PvqDq929BSx_A_D_M1n_a.php20180426
Lokipapgon10.ru/don-one/pen.php20180426
Lokivopspyder.website/home/five/PvqDq929BSx_A_D_M1n_a.php20180427
Lokijoanread.ru/decap/pen.php20180429
Lokivailablity.ml/vaila/PvqDq929BSx_A_D_M1n_a.php20180430
Lokibraithwalte.co.uk/blam/five/PvqDq929BSx_A_D_M1n_a.php20180502
Lokiunifarmex.net/hsp1/Panel/five/PvqDq929BSx_A_D_M1n_a.php20180502
Lokiunifarmex.net/nesto/Panel/five/PvqDq929BSx_A_D_M1n_a.php20180502
Lokiviettrust-vn.net/samii/PvqDq929BSx_A_D_M1n_a.php20180502
Lokibraithwalte.co.uk/block/five/PvqDq929BSx_A_D_M1n_a.php20180503
Lokiultrainstinct.ru/file/exe/five/PvqDq929BSx_A_D_M1n_a.php20180504
Lokilidgeys.ru/buchX-1/pen.php20180505
Lokitopreadz.ru/doncha-3/pen.php20180507
Lokibollingoes.ml/ngoes/PvqDq929BSx_A_D_M1n_a.php20180508
Lokicadjetbums.ml/tbums/PvqDq929BSx_A_D_M1n_a.php20180508
Lokierintoba.info/bbbb/Panel/five/PvqDq929BSx_A_D_M1n_a.php20180508
Lokieriousimen.ml/eriou/PvqDq929BSx_A_D_M1n_a.php20180508
Lokilidgeys.ru/eddy/pen.php20180508
Lokithousandan.ml/andan/PvqDq929BSx_A_D_M1n_a.php20180508
Lokiuy-akwaibom.ru/vinho/Panel/five/PvqDq929BSx_A_D_M1n_a.php20180510
Lokiwheelonexs.ml/wheel/PvqDq929BSx_A_D_M1n_a.php20180510
Ponyhypercosine.ml/cosi/hyper/admin.php20180412
Ponypreutainer.ml/aine/preut/admin.php20180412
Ponyrolexkings.ml/king/rolex/admin.php20180412
Ponytheonlygoodman.com/dort/admin.php20180412
Ponytheonlygoodman.com/sekiz/admin.php20180412
Ponytheonlygoodman.com/yedi/admin.php20180412
Ponyvinglosine.ml/osin/vingl/admin.php20180412
Ponytheonlygoodman.com/bes/admin.php20180413
Ponyerintoba.info/user/admin.php20180414
Ponytheonlygoodman.com/alti/admin.php20180414
Ponycuogargaming.com/sop/admin.php20180416
Ponyirishgrind.ml/irish/grind/admin.php20180417
Ponyhostelunke.ml/lunke/hoste/admin.php20180418
Ponyefficienci.ml/ienci/effic/admin.php20180419
Ponygrandmoney.ml/money/grand/admin.php20180419
Ponytheonlygoodman.com/on/admin.php20180419
Ponycentranets.ml/anets/centr/admin.php20180420
Ponydazzlelogs.ml/elogs/dazzl/admin.php20180422
Ponygokubid.review/chife/panelnew/admin.php20180423
Ponygokubid.review/indo/panelnew/admin.php20180423
Ponycarikapapa.ml/apapa/carik/admin.php20180424
Ponycuogargaming.com/klinsnip/admin.php20180424
Ponybraithwalte.co.uk/bass/admin.php20180425
Ponypharma–partners.com/bfayz/admin.php20180425
Ponytheonlygoodman.com/dokuz/admin.php20180425
Ponyuy-akwaibom.ru/wise/Panel/admin.php20180425
Ponypharma–partners.com/nonib/admin.php20180426
Ponytaineruder.ml/ruder/carik/admin.php20180427
Ponytotalguage.ml/guage/total/admin.php20180427
Ponypharma–partners.com/twst/admin.php20180428
Ponyviettrust-vn.net/juzz/admin.php20180502
Ponybraithwalte.co.uk/ajjuu/admin.php20180503
Ponycarikapapa.ml/carik/admin.php20180503
Ponyirishgrind.ml/grind/admin.php20180503
Ponystauniverseqp.com/roks2/admin.php20180503
Ponybundletops.ml/bundl/etops/admin.php20180504
Ponystauniverseqp.com/office1/admin.php20180504
Ponyviettrust-vn.net/adin/admin.php20180507
Ponyhostelunke.ml/lunke/admin.php20180510
Ponysuruperet.ml/eret/surup/admin.php20180510
Ponytaineruder.ml/ruder/admin.php20180510
Ponytheonlygoodman.com/aman/admin.php20180510
Ponydunysaki.ru/buch-A3/admin.php20180512
Ponythousandan.ml/lumin/sop/admin.php20180513