mirror of
https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
synced 2024-06-29 18:31:36 +00:00
271 lines
8.0 KiB
Plaintext
Executable File
271 lines
8.0 KiB
Plaintext
Executable File
Appendix A – C2 Addresses
|
||
|
||
148.251.204[.]131
|
||
|
||
144.76.109[.]88
|
||
|
||
138.201.75[.]227
|
||
|
||
|
||
Compromised Legitimate Sites
|
||
|
||
106[.]187[.]38[.]21
|
||
|
||
arbiogaz[.]com
|
||
|
||
azmwn[.]suliparwarda[.]com
|
||
|
||
bangortalk[.]org[.]uk
|
||
|
||
best2[.]thebestconference[.]org
|
||
|
||
camco[.]com[.]pk
|
||
|
||
cbpexbrasilia[.]com[.]br
|
||
|
||
cgss[.]com[.]pk
|
||
|
||
diplomat[.]com[.]sa
|
||
|
||
feribschat[.]eu
|
||
|
||
ghanaconsulate[.]com[.]pk
|
||
|
||
magical-energy[.]com
|
||
|
||
mainandstrand[.]com
|
||
|
||
riyadhfoods[.]com
|
||
|
||
school[.]suliparwarda[.]com
|
||
|
||
suliparwarda[.]com
|
||
|
||
tmclub[.]eu
|
||
|
||
watyanagr[.]nfe[.]go[.]th
|
||
|
||
whiver[.]in
|
||
|
||
www[.]4seasonrentacar[.]com
|
||
|
||
www[.]akhtaredanesh[.]com
|
||
|
||
www[.]arcadecreative[.]com
|
||
|
||
www[.]armaholic[.]com
|
||
|
||
www[.]asan-max[.]com
|
||
|
||
www[.]autotrans[.]hr
|
||
|
||
www[.]dafc[.]co[.]uk
|
||
|
||
www[.]eapa[.]org
|
||
|
||
www[.]elev8tor[.]com
|
||
|
||
www[.]jdarchs[.]com
|
||
|
||
www[.]kunkrooann[.]com
|
||
|
||
www[.]mackellarscreenworks[.]com
|
||
|
||
www[.]mitegen[.]com
|
||
|
||
www[.]nigelwhitfield[.]com
|
||
|
||
www[.]pomegranates[.]org
|
||
|
||
www[.]ridefox[.]com
|
||
|
||
www[.]shapingtomorrowsworld[.]org
|
||
|
||
www[.]vanessajackson[.]co[.]uk
|
||
|
||
www[.]yaran[.]co
|
||
|
||
www[.]ztm[.]waw[.]pl
|
||
|
||
coa[.]inducks[.]org
|
||
|
||
mhtevents[.]com
|
||
|
||
skepticalscience[.]com
|
||
|
||
wallpapercase[.]com
|
||
|
||
www[.]spearhead-training[.]com
|
||
|
||
|
||
Appendix B – Related files
|
||
|
||
sha256 Overall Description
|
||
d2a0eec18d755d456a34865ff2ffc14e3969ea77f7235ef5dfc3928972d7960f Loader script from 144.76.109[.]88
|
||
1421a5cd0566f4a69e7ca9cdefa380507144d7ed59cd22e53bfd25263c201a6f MuddyWater Macro
|
||
4e3c7defd6f3061b0303e687a4b5b3cc2a4ae84cdc48706c65a7b1e53402efc0 MuddyWater Macro
|
||
8b96804d861ea690fcb61224ec27b84476cf3117222cca05e6eba955d9395deb Lazagne
|
||
16985600c959f6267476da614243a585b1b222213ec938351ef6a26560c992db PS2EXE PowerStats (GitHub)
|
||
cf87a2ac51503d645e827913dd69f3d80b66a58195e5a0044af23ea6ba46b823 PS2EXE PowerStats (GitHub)
|
||
3030d80cfe1ee6986657a2d9b76b626ea05e2c289dee05bd7b9553b10d14e4a1 Decoded PowerStats payload
|
||
99077dcb37395603db0f99823a190f50313dc4e9819462c7da29c4bc983f42fd Lazagne Runner Script
|
||
1b60b7f9b0faf25288f1057b154413921a6cb373dcee43e831b9263c5b3077ce MuddyWater Macro
|
||
2c8d18f03b6624fa38cae0141b91932ba9dc1221ec5cf7f841a2f7e31685e6a1 MuddyWater Macro
|
||
367021beedb3ad415c69c9a0e657dc3ed82b1b24a41a71537d889f5e2b7ca433 MuddyWater Macro
|
||
58282917a024ac252966650361ac4cbbbed48a0df7cab7b9a6329d4a04551c0d MuddyWater Macro
|
||
58898648a68f0639c06bedc8242ca48bc6ec56f11ed40d00aa5fdda4e5553482 MuddyWater Macro
|
||
81523e0199ae1dc9e87d2b952642785bfbda6326f22e4c0794a19afdf001a9a3 MuddyWater Macro
|
||
90b66b3fef77962fbfda364a4f8799bfcc9ab73772026d7a8922a7cf5556a024 MuddyWater Macro
|
||
96101de2386e35bc5e38d32524a02c6c5ca7cc6624e656a629b2e0f1693a76fd MuddyWater Macro
|
||
964aaf5d9b1c749df0a2df1f1b4193e5a643893f251e2d74b47663f895da9b13 MuddyWater Macro
|
||
97f9a83bc6bb1b3f5cb7ac9401f95265597bff796bb4901631d6fa2c79a48bdc MuddyWater Macro
|
||
a3c1fd46177a078c4b95c744a24103df7d0a58cee1a3be92bc4cdd7dec1b1aa5 MuddyWater Macro
|
||
fcfbdffbcad731e0a5aad349215c87ed919865d66c287a6723fd8e2f896c5834 MuddyWater Macro
|
||
2bb1637c80f0a7df7260a8583beb033f4afbdd5c321ff5642bc8e1868194e009 MuddyWater Macro
|
||
58aec38e98aba66f9f01ca53442d160a2da7b137efbc940672982a4d8415a186 MuddyWater Macro
|
||
605fefc7829cfa41710e0b844084eab1f180fe513adc1d8f0f82501a154db0f4 MuddyWater Macro
|
||
e8a832b04dbdc413b71076754c3a0bf07cb7b9b61927248c482ddca32e1dab89 MuddyWater Macro
|
||
5d049bd7f478ea5d978b3c78f7f0afdf294a94f526fc20ffd6e33022d40d15ae MuddyWater Macro
|
||
12a7898fe5c75e0b57519f1e7019b5d09f5c5cbe49c48ab91daf6fcc09ee8a30 MuddyWater Macro
|
||
2602e817a67949860733b3548b37792616d52ffd305405ccab0409bcfedc5d63 MuddyWater Macro
|
||
42a4d9527063f73004b049a093a34a4fc3b6ea9505cb9b50b895486cb2dca94b MuddyWater Macro
|
||
5ed5fc6c6918ff6fa4eab7742c03d59155ca87e0fe12bac339f18928e2924a96 MuddyWater Macro
|
||
a2ad6bfc47c4f69a2170cc1a9fd620a68b1ebb474b7bdf601066e780e592222f MuddyWater Macro
|
||
c23ece07fc5432ca200f3de3e4c4b68430c6a22199d7fab11916a8c404fb63dc MuddyWater Macro
|
||
cb96cd26f36a3b1aacabfc79bbb5c1e0c9850b1c75c30aa498ad2d4131b02b98 MuddyWater Macro
|
||
ed2f9c9d5554d5248a7ad9ad1017af5f1bbadbd2275689a8b019a04c516eeec2 MuddyWater Macro
|
||
fe16543109f640ddbf3725e4d9f593de9f13ee9ae96c5e41e9cdccb7ab35b661 MuddyWater Macro
|
||
886e3a2f74bf8f46b23c78a6bad80c74fe33579f6fe866bc5075b034c4d5d432 MuddyWater Macro
|
||
8ec108b8f66567a8d84975728b2d5e6a2786c2ca368310cca55acad02bb00fa6 MuddyWater Macro
|
||
96d80ae577e9b899772a940b4941da39cf7399b5c852048f0d06926eb6c9868a MuddyWater Macro
|
||
bb1a5fb87d34c63ade0ed8a8b95412ba3795fd648a97836cb5117aff8ea08423 MuddyWater Macro
|
||
d65e2086aeab56a36896a56589e47773e9252747338c6b59c458155287363f28 MuddyWater Macro
|
||
588cd0fe3ae6fbd2fa4cf8de8db8ae2069ea62c9eaa6854caedf45045780661f MuddyWater Macro
|
||
917a6c816684f22934e2998f43633179e14dcc2e609c6931dd2fc36098c48028 MuddyWater Macro
|
||
db7bdd6c3ff7a27bd4aa9acc17dc35c38b527fb736a17d0927a0b3d7e94acb42 MuddyWater Macro
|
||
de6ce9b75f4523a5b235f90fa00027be5920c97a972ad6cb2311953446c81e1d MuddyWater Macro
|
||
a6673c6d52dd5361afd96f8143b88810812daa97004f69661da625aaaba9363b MuddyWater Macro
|
||
40a6b4c6746e37d0c5ecb801e7656c9941f4839f94d8f4cd61eaf2b812feaabe MuddyWater Macro
|
||
|
||
Appendix C – Proxy URLs found from POWERSTATS samples from October 2017 onwards
|
||
|
||
hxxp://106[.]187[.]38[.]21/short_qr/work[.]php?c=
|
||
|
||
hxxp://arbiogaz[.]com/upload/work[.]php?c=
|
||
|
||
hxxp://azmwn[.]suliparwarda[.]com/wp-content/plugins/wpdatatables/panda[.]php?c=
|
||
|
||
hxxp://azmwn[.]suliparwarda[.]com/wp-content/themes/twentyfifteen/logs[.]php?c=
|
||
|
||
hxxp://bangortalk[.]org[.]uk/speakers[.]php?c=
|
||
|
||
hxxp://best2[.]thebestconference[.]org/ccb/browse_cat[.]php?c=
|
||
|
||
hxxp://camco[.]com[.]pk/Controls/data[.]aspx?c=
|
||
|
||
hxxp://cbpexbrasilia[.]com[.]br/wp-content/plugins/wordpress-seo/power[.]php?c=
|
||
|
||
hxxp://cbpexbrasilia[.]com[.]br/wp-includes/widgets/work[.]php?c=
|
||
|
||
hxxp://cgss[.]com[.]pk/data[.]aspx?c=
|
||
|
||
hxxp://diplomat[.]com[.]sa/wp-content/plugins/wordpress-importer/cache[.]php?c=
|
||
|
||
hxxp://feribschat[.]eu/logs[.]php?c=
|
||
|
||
hxxp://ghanaconsulate[.]com[.]pk/data[.]aspx?c=
|
||
|
||
hxxp://magical-energy[.]com/css[.]aspx?c=
|
||
|
||
hxxp://magical-energy[.]com/css/css[.]aspx?c=
|
||
|
||
hxxp://mainandstrand[.]com/work[.]php?c=
|
||
|
||
hxxp://riyadhfoods[.]com/css/edu[.]aspx?c=
|
||
|
||
hxxp://riyadhfoods[.]com/jquery-ui/js/jquery[.]aspx?c=
|
||
|
||
hxxp://school[.]suliparwarda[.]com/components/com_akeeba/work[.]php?c=
|
||
|
||
hxxp://school[.]suliparwarda[.]com/plugins/editors/codemirror/work[.]php?c=
|
||
|
||
hxxp://suliparwarda[.]com/includes/panda[.]php?c=
|
||
|
||
hxxp://suliparwarda[.]com/layouts/joomla/logs[.]php?c=
|
||
|
||
hxxp://suliparwarda[.]com/wp-content/plugins/entry-views/work[.]php?c=
|
||
|
||
hxxp://suliparwarda[.]com/wp-content/themes/twentyfifteen/work[.]php?c=
|
||
|
||
hxxp://tmclub[.]eu/clubdata[.]php?c=
|
||
|
||
hxxp://watyanagr[.]nfe[.]go[.]th/e-office/lib/work[.]php?c=
|
||
|
||
hxxp://watyanagr[.]nfe[.]go[.]th/watyanagr/power[.]php?c=
|
||
|
||
hxxp://whiver[.]in/power[.]php?c=
|
||
|
||
hxxp://www[.]4seasonrentacar[.]com/viewsure/data[.]aspx?c=
|
||
|
||
hxxp://www[.]akhtaredanesh[.]com/d/file/sym/work[.]php?c=
|
||
|
||
hxxp://www[.]akhtaredanesh[.]com/d/oschool/power[.]php?c=
|
||
|
||
hxxp://www[.]arcadecreative[.]com/work[.]php?c=
|
||
|
||
hxxp://www[.]armaholic[.]com/list[.]php?c=
|
||
|
||
hxxp://www[.]asan-max[.]com/files/articles/css[.]aspx?c=
|
||
|
||
hxxp://www[.]asan-max[.]com/files/articles/large/css[.]aspx?c=
|
||
|
||
hxxp://www[.]autotrans[.]hr/index[.]php?c=
|
||
|
||
hxxp://www[.]dafc[.]co[.]uk/news[.]php?c=
|
||
|
||
hxxp://www[.]eapa[.]org/asphalt[.]php?c=
|
||
|
||
hxxp://www[.]elev8tor[.]com/show-work[.]php?c=
|
||
|
||
hxxp://www[.]jdarchs[.]com/work[.]php?c=
|
||
|
||
hxxp://www[.]kunkrooann[.]com/inc/work[.]php?c=
|
||
|
||
hxxp://www[.]mackellarscreenworks[.]com/work[.]php?c=
|
||
|
||
hxxp://www[.]mitegen[.]com/mic_catalog[.]php?c=
|
||
|
||
hxxp://www[.]nigelwhitfield[.]com/v2/work[.]php?c=
|
||
|
||
hxxp://www[.]pomegranates[.]org/index[.]php?c=
|
||
|
||
hxxp://www[.]ridefox[.]com/content[.]php?c=
|
||
|
||
hxxp://www[.]shapingtomorrowsworld[.]org/category[.]php?c=
|
||
|
||
hxxp://www[.]vanessajackson[.]co[.]uk/work[.]php?c=
|
||
|
||
hxxp://www[.]yaran[.]co//wp-content/plugins/so-masonry/logs[.]php?c=
|
||
|
||
hxxp://www[.]yaran[.]co/wp-includes/widgets/logs[.]php?c=
|
||
|
||
hxxp://www[.]ztm[.]waw[.]pl/pop[.]php?c=
|
||
|
||
hxxps://coa[.]inducks[.]org/publication[.]php?c=
|
||
|
||
hxxps://mhtevents[.]com/account[.]php?c=
|
||
|
||
hxxps://skepticalscience[.]com/graphics[.]php?c=
|
||
|
||
hxxps://wallpapercase[.]com/wp-content/themes/twentyfifteen/logs[.]php?c=
|
||
|
||
hxxps://wallpapercase[.]com/wp-includes/customize/logs[.]php?c=
|
||
|
||
hxxps://www[.]spearhead-training[.]com//html/power[.]php?c=
|
||
|
||
hxxps://www[.]spearhead-training[.]com/work[.]php?c=
|
||
|
||
|
||
|
||
|