16.0.5.10:135 16.0.5.10:49 10.132.0.38:80 1.127.169.36:445 1.34.170.174:445 74.192.131.209:445 72.251.38.86:445 154.52.114.185:445 52.119.18.119:445 203.232.172.210:445 95.133.114.179:445 111.21.235.164:445 199.168.188.178:445 102.51.52.149:445 183.221.171.193:445 92.131.160.60:445 139.200.111.109:445 158.7.250.29:445 81.189.128.43:445 143.71.213.16:445 71.191.195.91:445 34.132.112.54:445 189.191.100.197:445 117.85.163.204:445 165.137.211.151:445 3.193.1.89:445 173.41.236.121:445 217.62.147.116:445 16.124.247.16:445 187.248.193.14:445 42.51.104.34:445 76.222.191.53:445 197.231.221.221:9001 128.31.0.39:9191 149.202.160.69:9001 46.101.166.19:9090 91.121.65.179:9001 2.3.69.209:9001 146.0.32.144:9001 50.7.161.218:9001 217.79.179.177:9001 213.61.66.116:9003 212.47.232.237:9001 81.30.158.223:9001 79.172.193.32:443 38.229.72.16:443
Domains: • iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com • Rphjmrpwmfv6v2e[dot]onion • Gx7ekbenv2riucmf[dot]onion • 57g7spgrzlojinas[dot]onion • xxlvbrloxvriy2c5[dot]onion • 76jdd2ir2embyv47[dot]onion • cwwnhwhlz52maqm7[dot]onion File Names: • @Please_Read_Me@.txt • @WanaDecryptor@.exe • @WanaDecryptor@.exe.lnk • Please Read Me!.txt (Older variant) • C:\WINDOWS\tasksche.exe • C:\WINDOWS\qeriuwjhrf • 131181494299235.bat • 176641494574290.bat • 217201494590800.bat • [0-9]{15}.bat #regex • !WannaDecryptor!.exe.lnk • 00000000.pky • 00000000.eky • 00000000.res • C:\WINDOWS\system32\taskdl.exe