added some DNS prefixes

DNS/deepmagic.com_top500prefixes.txt

@@ -0,0 +1,500 @@
+reserved-multicast-range-NOT-delegated
+nothing
+dynamic
+static
+dip
+pools
+rev
+dsl
+cable
+ip
+ipt
+res
+163data
+bb
+pool
+fios
+dyn
+vodacom
+staticIP
+east
+fbx
+adsl
+bigpond
+client
+HINET-IP
+customer
+home
+biz
+us
+dynamicIP
+ucom
+4k
+mc
+cust
+ocn
+cm
+deploy
+user
+dion
+ipcom
+dhcp
+telkomadsl
+plala
+www
+hfc
+reverse
+unknown
+brasiltelecom
+in-addr
+ca
+lsan03
+bchsia
+web
+optusnet
+mobileonline
+net
+telesp
+rcsntx
+tx
+pa
+hstntx
+il
+dialup
+vsnl
+resnet
+dial
+cpe
+dsl-w
+fl
+broadband
+unassigned
+tbcn
+internode
+chcgil
+mail
+yokohama
+irvnca
+pltn13
+genericrev
+hlrn
+jsc
+bol
+mtnl
+asm
+mesh
+med
+mi
+tm
+so-net
+phnx
+asianet
+tn
+mia
+sd
+mobile
+in
+infoweb
+amedd
+adslgp
+korea
+de
+tfn
+ph
+eonet
+wireless
+connect
+ga
+ppp
+emhril
+host
+mo
+wa
+nw
+da
+not-set-yet
+zaq
+ok
+sfldmi
+ma
+internet
+mpls
+socal
+ptr
+wi
+mid
+hkcable
+business
+seed
+tpgi
+tukw
+dublin
+odn
+isp
+sta
+wlfrct
+cidr
+cicril
+sol
+uio
+hr
+available
+dc
+ded
+abhsia
+rdns
+ipv4
+fwd
+oc
+bredband
+sasknet
+prima
+at
+lv
+prodigy
+ptld
+stlsmo
+tdatabrasil
+link
+fibertel
+md
+impsat
+slkc
+maxonline
+megared
+telecom
+bcvloh
+nat
+neo
+ri
+ks
+gordon
+ny
+se
+digitaltv
+216
+nb
+ns1
+hn
+mn
+mrt
+iprimus
+no-dns
+uk
+twcny
+milwwi
+giga
+buffalo
+livnmi
+br
+xr
+unused-space
+wakwak
+dti
+jp
+ipltin
+kbtelecom
+albq
+nl
+access
+veloxzone
+ns
+no
+highway
+advance
+public
+lnk
+pol
+tukrga
+hidden-host
+209
+compute-1
+student
+om
+miamfl
+or
+unspec207128
+gye
+int
+ne
+cc
+epm
+txr
+codetel
+gvt
+dip0
+d4
+nj
+internalhost
+co
+ig
+clt
+austtx
+rochester
+westnet
+columbus
+internal
+sntcca
+t-com
+no-dns-yet
+corp
+snfc21
+pac
+telemar
+xdsl
+embratel
+nycap
+eng
+mem
+blueyonder
+iplsin
+ccgg
+ut
+dhcp-bl
+dialuol
+clta
+maa
+arc
+netvision
+hrlntx
+snantx
+sea
+cs
+va
+intelignet
+208
+acessonet
+cae
+speedy
+tachikawa
+woh
+sdf
+gtcust
+lab
+eur
+ed
+bhm
+domolink
+savecom
+Unused
+ts
+clsp
+austin
+vpn
+tor
+ltrkar
+unspec207129
+yournet
+unspec207131
+maine
+nh
+labs
+167
+159
+lft
+59
+unspec207130
+hsia
+gprs
+spkn
+nc
+jax
+bgk
+inet
+237
+bois
+pppoe
+new
+ftas
+jan
+reserved
+sc
+tcso
+244
+msy
+k12
+dt
+scrm01
+wood
+nam
+omah
+vc
+al
+klmzmi
+az
+com
+service
+siw
+okc
+zz
+61
+pcs
+bna
+mw
+global
+conference
+sndgca
+as
+ip215
+speed
+chi
+prod-empresarial
+ts31
+bpb
+cust-adsl
+upc-i
+upc-h
+range86-187
+range86-186
+range86-185
+range86-184
+range86-183
+range86-182
+range86-181
+range86-180
+range86-179
+range86-178
+range86-177
+range86-176
+range86-174
+range86-173
+range86-172
+range86-171
+range86-170
+range86-169
+range86-168
+range86-167
+range86-166
+range86-165
+range86-164
+range86-163
+range86-162
+range86-161
+range86-160
+range86-159
+range86-158
+range86-157
+range86-156
+range86-155
+range86-154
+range86-153
+range86-152
+range86-151
+range86-150
+range86-149
+range86-148
+range86-147
+range86-146
+range86-145
+range86-143
+range86-142
+range86-141
+range86-140
+range86-139
+range86-138
+range86-137
+range86-136
+range86-135
+range86-133
+range86-132
+range86-131
+range86-130
+range86-129
+range86-128
+range217-44
+range217-43
+range217-42
+megaegg
+range86-144
+ftd
+segment-119-226
+mweb
+ramstein
+est
+98-62
+upc-a
+segment-119-227
+validip
+telefonia
+segment-124-7
+y12
+tsinghua
+nswc
+apg
+range86-188
+corp-eur
+dhcp4
+upc-j
+customers
+213
+water
+segment-124-30
+arpa
+gsp
+undefined
+wotnoh
+owb
+138-in-addr-arpa
+mco
+202
+ars
+range86-134
+sndg02
+alestra
+prod-infinitum
+demon
+hsv
+sdsl
+retail
+la
+ssd
+oilfield
+v4
+bliss
+lw
+ll
+shv
+eu
+unk
+galway
+bf
+cork
+chs
+ksc2mo
+homerun
+undefinedhost
+range86-189
+van
+uunet
+static-ip-92-71
+apol
+lib
+war
+etb
+lewis
+direct
+stat
+212
+cinci
+okcyok
+ad
+frokca
+avantel
+stl2mo
+vie
+unspec170108
+iern
+190
+mssnks
+applwi
+mob
+btas
+bootp
+dhcp-in
+uol
+tinp
+rtc5
+wimax-client
+uninet
+field
+spawar

IOCs/kaspersky_careto_files.txt

@@ -45,3 +45,4 @@ cdlluninstallsgh64.dll
 %appdata%\microsoft\c_27803.nls
 %appdata%\microsoft\objframe.dll
 %appdata%\microsoft\shmgr.dll
+%systemdrive%\boot.ini

IOCs/kaspersky_careto_files_no-env-vars.txt

@@ -0,0 +1,48 @@
+windows\objframe.dll
+windows\shlink32.dll
+windows\shlink64.dll
+cdllait32.dll
+cdllait64.dll
+cdlluninstallws32.dll
+cdlluninstallws64.dll
+cdlluninstallsgh32.dll
+cdlluninstallsgh64.dll
+windows\c_50225.nls
+windows\c_50227.nls
+windows\c_50229.nls
+windows\c_51932.nls
+windows\c_51936.nls
+windows\c_51949.nls
+windows\c_51950.nls
+windows\c_57002.nls
+windows\c_57006.nls
+windows\c_57008.nls
+windows\c_57010.nls
+windows\cdgext32.dll
+windows\cfgbkmgrs.dll
+windows\cfgmgr64.dll
+windows\comsvrpcs.dll
+windows\d3dx8_20.dll
+windows\dllcomm.dll
+windows\drivers\wmimgr.sys
+windows\drvinfo.bin
+windows\FCache.bin
+windows\FFExtendedCommand.dll
+windows\gpktcsp32.dll
+windows\HPQueue.bin
+windows\LPQueue.bin
+windows\mdwmnsp.dll
+windows\rpcdist.dll
+windows\scsvrft.dll
+windows\sdptbw.dll
+windows\slbkbw.dll
+windows\skypeie6plugin.dll
+windows\wmspdmgr.dll
+%temp%\~DF01AC74D8BE15EE01.tmp
+%temp%\~DF23BF45A473C42B56.tmp
+%temp%\~DFA0528CD81300F372.tmp
+%temp%\~DF8471938479DA49221.tmp
+%appdata%\microsoft\c_27803.nls
+%appdata%\microsoft\objframe.dll
+%appdata%\microsoft\shmgr.dll
+%systemdrive%\boot.ini