mirror of
https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
synced 2024-06-30 19:01:40 +00:00
226 lines
5.9 KiB
Plaintext
Executable File
226 lines
5.9 KiB
Plaintext
Executable File
= GreyEnergy -- Indicators of Compromise
|
|
|
|
For a description of GreyEnergy, please see the article about
|
|
https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/[GreyEnergy]
|
|
on https://www.welivesecurity.com[WeLiveSecurity].
|
|
|
|
== ESET detection names
|
|
- VBA/TrojanDownloader.Agent.EYV
|
|
- Win32/Agent.SCT
|
|
- Win32/Agent.SCM
|
|
- Win32/Agent.SYN
|
|
- Win64/Agent.SYN
|
|
- Win32/Agent.WTD
|
|
- Win32/GreyEnergy
|
|
- Win64/GreyEnergy
|
|
- Win32/Diskcoder.MoonrakerPetya.A
|
|
- PHP/Agent.JS
|
|
- PHP/Agent.JX
|
|
- PHP/Agent.KJ
|
|
- PHP/Agent.KK
|
|
- PHP/Agent.KL
|
|
- PHP/Agent.KM
|
|
- PHP/Agent.KN
|
|
- PHP/Agent.KO
|
|
- PHP/Agent.KP
|
|
- PHP/Agent.KQ
|
|
- PHP/Agent.KR
|
|
- PHP/Agent.KS
|
|
- PHP/Agent.KT
|
|
- PHP/Agent.KU
|
|
- PHP/Agent.LC
|
|
- PHP/Agent.NBP
|
|
- PHP/Kryptik.AB
|
|
- PHP/TrojanProxy.Agent.B
|
|
- ASP/Agent.L
|
|
- Win64/HackTool.PortScanner.A
|
|
- Win32/HackTool.PortScanner.A
|
|
- Win64/Riskware.Mimikatz.A
|
|
- Win64/Riskware.Mimikatz.AE
|
|
- Win64/Riskware.Mimikatz.AH
|
|
- Win32/Winexe.A
|
|
- Win64/Winexe.A
|
|
- Win64/Winexe.B
|
|
|
|
== Samples
|
|
|
|
All hashes are SHA-1
|
|
|
|
=== GreyEnergy document
|
|
|
|
----
|
|
177AF8F6E8D6F4952D13F88CDF1887CB7220A645
|
|
----
|
|
|
|
=== GreyEnergy mini
|
|
|
|
----
|
|
455D9EB9E11AA9AF9717E0260A70611FF84EF900
|
|
51309371673ACD310F327A10476F707EB914E255
|
|
CB11F36E271306354998BB8ABB6CA67C1D6A3E24
|
|
CC1CE3073937552459FB8ED0ADB5D56FA00BCD43
|
|
30AF51F1F7CB9A9A46DF3ABFFB6AE3E39935D82C
|
|
----
|
|
|
|
=== GreyEnergy droppers
|
|
|
|
----
|
|
04F75879132B0BFBA96CB7B210124BC3D396A7CE
|
|
69E2487EEE4637FE62E47891154D97DFDF8AAD57
|
|
716EFE17CD1563FFAD5E5E9A3E0CAC3CAB725F92
|
|
93EF4F47AC160721768A00E1A2121B45A9933A1D
|
|
94F445B65BF9A0AB134FAD2AAAD70779EAFD9288
|
|
A414F0A651F750EEA18F6D6C64627C4720548581
|
|
B3EF67F7881884A2E3493FE3D5F614DBBC51A79B
|
|
EBD5DC18C51B6FB0E9985A3A9E86FF66E22E813E
|
|
EC7E018BA36F07E6DADBE411E35B0B92E3AD8ABA
|
|
----
|
|
|
|
=== GreyEnergy dropped DLLs
|
|
|
|
----
|
|
0B5D24E6520B8D6547526FCBFC5768EC5AD19314
|
|
10D7687C44BECA4151BB07F78C6E605E8A552889
|
|
2A7EE7562A6A5BA7F192B3D6AED8627DFFDA4903
|
|
3CBDC146441E4858A1DE47DF0B4B795C4B0C2862
|
|
4E137F04A2C5FA64D5BF334EF78FE48CF7C7D626
|
|
62E00701F62971311EF8E57F33F6A3BA8ED28BF7
|
|
646060AC31FFDDFBD02967216BC71556A0C1AEDF
|
|
748FE84497423ED209357E923BE28083D42D69DE
|
|
B75D0379C5081958AF83A542901553E1710979C7
|
|
BFC164E5A28A3D56B8493B1FC1CA4A12FA1AC6AC
|
|
C1EB0150E2FCC099465C210B528BF508D2C64520
|
|
CBB7BA92CDF86FA260982399DAB8B416D905E89B
|
|
DF051C67EE633231E4C76EC247932C1A9868C14F
|
|
DFD8665D91C508FAF66E2BC2789B504670762EA2
|
|
E2436472B984F4505B4B938CEE6CAE26EF043FC7
|
|
E3E61DF9E0DD92C98223C750E13001CBB73A1E31
|
|
E496318E6644E47B07D6CAB00B93D27D0FE6B415
|
|
EDA505896FFF9A29BD7EAE67FD626D7FFA36C7B2
|
|
F00BEFDF08678B642B69D128F2AFAE32A1564A90
|
|
F36ECAC8696AA0862AD3779CA464B2CD399D8099
|
|
----
|
|
|
|
=== GreyEnergy in-memory-only DLLs
|
|
|
|
----
|
|
0BCECB797306D30D0BA5EAEA123B5BF69981EFF4
|
|
11159DB91B870E6728F1A7835B5D8BE9424914B9
|
|
6ABD4B82A133C4610E5779C876FCB7E066898380
|
|
848F0DBF50B582A87399428D093E5903FFAEEDCD
|
|
99A81305EF6E45F470EEE677C6491045E3B4D33A
|
|
A01036A8EFE5349920A656A422E959A2B9B76F02
|
|
C449294E57088E2E2B9766493E48C98B8C9180F8
|
|
C7FC689FE76361EF4FDC1F2A5BAB71C0E2E09746
|
|
D24FC871A721B2FD01F143EB6375784144365A84
|
|
DA617BC6DCD2083D93A9A83D4F15E3713D365960
|
|
E4FCAA1B6A27AA183C6A3A46B84B5EAE9772920B
|
|
----
|
|
|
|
=== Moonraker Petya
|
|
|
|
----
|
|
1AA1EF7470A8882CA81BB9894630433E5CCE4373
|
|
----
|
|
|
|
=== PHP and ASP scripts
|
|
|
|
----
|
|
10F4D12CF8EE15747BFB618F3731D81A905AAB04
|
|
13C5B14E19C9095ABA3F1DA56B1A76793C7144B9
|
|
1BA30B645E974DE86F24054B238FE77A331D0D2C
|
|
34F8323B3B6BCF4B47D0ABEFCF9E38E15ECD2858
|
|
438C8F9607E06E7AC1261F99F8311B004C23DEC3
|
|
4D1C282F9942EC87C5B4D9363187AFDC120F4DC7
|
|
4E0C5CCFFB7E2D17C26F82DB5564E47F141300B3
|
|
5377ADB779DE325A74838C0815EEA958B4822F82
|
|
58A69A8D1B94E751050DECF87F2572E09794F0F8
|
|
5DD34FB1C8E224C17DCE04E02A4409E9393BCE58
|
|
639BCE78F961C4B9ECD9FE1A8537733388B99857
|
|
7127B880C8E31FBEB1D376EB55A6F878BC77B21A
|
|
71BA8FE0C9C32A9B987E2BB827FE54DAE905D65E
|
|
78A7FBDD6ADF073EA6D835BE69084E071B4DA395
|
|
81332D2F96A354B1B8E11984918C43FB9B5CB9DB
|
|
8CC008B3189F8CE9A96C2C41F864D019319EB2EE
|
|
940DE46CD8C50C28A9C0EFC65AEE7D567117941B
|
|
A415E12591DD47289E235E7022A6896CB2BFDE96
|
|
D3AE97A99D826F49AD03ADDC9F0D5200BE46AB5E
|
|
E69F5FF2FCD18698BB584B6BC15136D61EB4F594
|
|
E83A090D325E4A9E30B88A181396D62FEF5D54D5
|
|
ECF21EFC09E4E2ACFEEB71FB78CB1F518E1F5724
|
|
----
|
|
|
|
=== Custom port scanner
|
|
|
|
----
|
|
B371A5D6465DC85C093A5FB84D7CDDEB1EFFCC56
|
|
B40BDE0341F52481AE1820022FA8376E53A20040
|
|
----
|
|
|
|
=== Mimikatz
|
|
|
|
----
|
|
89D7E0DA80C9973D945E6F62E843606B2E264F7E
|
|
8B295AB4789105F9910E4F3AF1B60CBBA8AD6FC0
|
|
AD6F835F239DA6683CAA54FCCBCFDD0DC40196BE
|
|
----
|
|
|
|
=== WinExe
|
|
|
|
----
|
|
0666B109B0128599D535904C1F7DDC02C1F704F2
|
|
2695FCFE83AB536D89147184589CCB44FC4A60F3
|
|
3608EC28A9AD7AF14325F764FB2F356731F1CA7A
|
|
37C837FB170164CBC88BEAE720DF128B786A71E0
|
|
594B809343FEB1D14F80F0902D764A9BF0A8C33C
|
|
7C1F7CE5E57CBDE9AC7755A7B755171E38ABD70D
|
|
90122C0DC5890F9A7B5774C6966EA694A590BD38
|
|
C59F66808EA8F07CBDE74116DDE60DAB4F9F3122
|
|
CEB96B364D6A8B65EA8FA43EB0A735176E409EB0
|
|
FCEAA83E7BD9BCAB5EFBA9D1811480B8CB0B8A3E
|
|
----
|
|
|
|
== Network indicators
|
|
|
|
=== GreyEnergy mini's C&C servers URLs
|
|
|
|
----
|
|
https://82.118.236[.]23:8443/27c00829d57988279f3ec61a05dee75a
|
|
http://82.118.236[.]23:8080/27c00829d57988279f3ec61a05dee75a
|
|
https://88.198.13[.]116:8443/xmlservice
|
|
http://88.198.13[.]116:8080/xmlservice
|
|
https://217.12.204[.]100/news/
|
|
http://217.12.204[.]100/news/
|
|
http://pbank.co[.]ua/favicon.ico (IP: 185.128.40.90)
|
|
----
|
|
|
|
=== GreyEnergy's C&C servers IP addresses
|
|
|
|
[options="header"]
|
|
|=====
|
|
| Active period | IP address
|
|
| 2015 - 2016 | `109.200.202.7`
|
|
| 2015 - 2015 | `193.105.134.68`
|
|
| 2015 - 2016 | `163.172.7.195`
|
|
| 2015 - 2016 | `163.172.7.196`
|
|
| 2016 - 2016 | `5.149.248.77`
|
|
| 2016 - 2016 | `31.148.220.112`
|
|
| 2016 - 2016 | `62.210.77.169`
|
|
| 2016 - 2016 | `85.25.211.10`
|
|
| 2016 - 2016 | `138.201.198.164`
|
|
| 2016 - 2017 | `124.217.254.55`
|
|
| 2017 - 2017 | `46.249.49.231`
|
|
| 2017 - 2017 | `37.59.14.94`
|
|
| 2017 - 2017 | `213.239.202.149`
|
|
| 2017 - 2017 | `88.198.13.116`
|
|
| 2017 - 2017 | `217.12.202.111`
|
|
| 2017 - 2017 | `176.31.116.140`
|
|
| 2017 - 2018 | `185.217.0.121`
|
|
| 2017 - 2018 | `178.150.0.200`
|
|
| 2018 - 2018 | `176.121.10.137`
|
|
| 2018 - 2018 | `178.255.40.194`
|
|
| 2018 - 2018 | `193.105.134.56`
|
|
| 2018 - 2018 | `94.130.88.50`
|
|
| 2018 - 2018 | `185.216.33.126`
|
|
|=====
|