IcedID Botnet Actors Abuse Google PPC to Distribute Malware

IcedID loader DLLs
tcl86.dll 		5555cbff358f0ff3f0fe79951f9c67fcc14369777159925f7322549952d18c51
sqlite3.dll 		8d5385fe63487a8852a14786a5626c58e7b2f3eb0011089ced22b2a6784ac301
ConEmuTh.x64.dll 	7405c72fac4b0184e96209bbc9dd54bce1aa119b83b4842c18b2f34805995f76
libcurl.dll 		4ce1f31bca21063147a84956b4391a85b78db30f3d973447f138c6e5154fb7a4

IcedID loader C&C servers
estrabornhot[.]com 	143.198.92[.]88
klepdrafooip[.]com 	143.198.92[.]88
trbiriumpa[.]com 	143.198.92[.]88
lilsakainrot[.]com 	143.198.92[.]88

IcedID malware distribution websites
cryptobrowser[.]top
dlscordcom[.]top
fortlnet[.]top
irs-forms[.]top
irsform[.]top
irsforms[.]top
irsgov[.]top
llbreoffice[.]top
llbreofflce[.]top
microsoft-teams[.]top
postbox-inc[.]top
sandboxie-plus[.]top
sandboxieplus[.]top
thunderbird[.]top
thunderblrd[.]top
webeex[.]top
www-adobe[.]top
www-anydesk[.]top
www-basecamp[.]top
www-brave[.]top
www-chase[.]top
www-citrix[.]top
www-discord[.]top
www-discordcom[.]top
www-dlscord[.]top
www-docker[.]top
www-fortinet[.]top
www-fortlnet[.]top
www-goto[.]top
www-irs-forms[.]top
www-irs[.]top
www-libreofflce[.]top
www-obsproject[.]top
www-realvnc[.]top
www-ringcentral[.]top
www-slack[.]top
www-teamviewer[.]top
www-teamvlewer[.]top
www-thunderblrd[.]top
www-torproject[.]top
www-vmware[.]top
www-webex[.]top
www-whatsapp[.]top
wwwadobe[.]top
wwwanydesk[.]top
wwwchase[.]top
wwwdiscordcom[.]top
wwwebex[.]top
wwwfortinet[.]top
wwwfortlnet[.]top
wwwslack[.]top
wwwteamviewer[.]top
wwwvmware[.]top
wwww-adobe[.]top
wwww-anydesk[.]top
wwww-discord[.]top
wwww-discordcom[.]top
wwww-dlscord[.]top
wwww-dlscordcom[.]top
wwww-irs-forms[.]top
wwwwadobe[.]top
wwwwanydesk[.]top
wwwwebex[.]top
wwwwslack[.]top