mirror of
https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
synced 2024-06-28 18:01:47 +00:00
148 lines
7.3 KiB
Plaintext
148 lines
7.3 KiB
Plaintext
Samples matching unique indicators, behaviors and C2 infrastructure from the payload extracted out of the malicious documents:
|
|
|
|
SHA256 hashes
|
|
Winsloader
|
|
c098235a43d9788661490d2c7b09b1b2b3544d22ee8d9ae6cd5d16a977fd1155
|
|
e81bc530075d6d31358aea5784d977d1ac2932a13a615cd1319d01d6e39c2995
|
|
cf32fb6371cc751b852c2e2e607c813e0de71cd7bcf3892a9a23b57dfd38d6fc
|
|
07663f8bca3c2118f3f77221c35873fd8dd61d9afa30e566fe4b51bcfb000834
|
|
92da05bae1d9694a1f63b854e86b5b17ef27d5fc2551318e49e17677c7c90042
|
|
e267ecfd37f3af55e8b02b081e7c9d8c0bf633e1d5acb0228be694eae4660eee
|
|
PCShare
|
|
d76d7d64c941713d4faaedd5c972558c5136cd1b7de237280faaae89143e7d94
|
|
66d672a94f21e86655f243877ee04d7e67a515a7153891563f1aeedb2edbe579
|
|
Yahoyah
|
|
85904e7b88b5049fb99b4b8456d9f01bdbf8f6fcf0f77943aed1ce7e6f7127c2
|
|
2fce75daea5fdaafba376a86c59d5bc3e32f7fe5e735ec1e1811971910bc4009
|
|
aa812b1c0b24435b8e01100760bc4fef44032b4b0d787a8cf9aef83abd9d5dbd
|
|
9623d6f3a3952280f3e83f8dbb29942694bb682296d36c4f4d1d7414a7493db0
|
|
f0aa64c1646d91b0decbe4d4e6a7cc53bfd770c86ded9a7408034fa14d2bad83
|
|
73bba13d1c7b6794be485a5eeb7b79a62f109c27c4c698601945702303dbcd6c
|
|
25809242472a9e1f08ff83c00fae943a630867604ff95c7a57313187287384d2
|
|
72d14f0a7ecb04eb2962bc9d8491194deb856ceebf30e7ecd644620932f3d4b0
|
|
2172cc228760d6e4fa297bc485637a2b17103ae88237b30df39babe548cefaa5
|
|
fdeb384ff68b99514f329eeffb05692c4c1580ca52e43e6dcbb5d760c2a78aa4
|
|
1432a8a6ae6faa5d9f441b918ddc3edddb9c133458853ad356756835fe7b3291
|
|
a4334a33e4a87cfa52e9e24f6b4d3da0b686f71b25e5cc9a6f144485ea63108a
|
|
7f8abefcc4598c643dff1ebf570677fd5c2a4f3d08bc8ddabbfbef1eed097fb3
|
|
8e1a0d93ae644ac80048e5c3485bc6282a69d52cf26f94d2be1ce634851ac3aa
|
|
c2ad0204ff90c113f7984a9db6006c9f09631c4983098803591170be62cdfaa7
|
|
8ccaade84c9c7d5955e8aa1a0d36542beeaed5b8f619aedf82f74e8fd5a5283b
|
|
03e9c25fe979f149f6dafb0398cdf3d2223b26f24009ef0f83825b60e961d111
|
|
bee4cc2c3c393953f9247eab45767e01cd26d40037fb00bd69441e026d860a63
|
|
626f65d4d638437aaa8352fe06589165d52a91e0963c988348b00734b0a3419f
|
|
5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596
|
|
72cc8c41008310024e9339b9e45bec7815b7fa8a0c3b6a56769d22bc4ced10ed
|
|
fefd9bfb0f984590b54908c6868b39ca587a3e0d8198b795ff58f67adee4b9e9
|
|
4ee115734733dae0705e5b2cb6789a1cdb877bc53e2fdb6e18ab845c0522d43b
|
|
6b6ec318ede71baf79004fe22c46a8d7a500dc6ba6dd40b2641fe9a1c2b3dbd5
|
|
78eda231bf494c7008a4ad49e982f2470597199829d46b166a75f654e3cb8d59
|
|
21857cdd794649d72ab1bf90acfa8a57767a2a176b46cdb930025cf9242303bb
|
|
bff5f2f84efc450b10f1a66064ed3afaf740c844c15af88a927c46a0b2146498
|
|
6597c49bedf3fb1964e7f6ccbb03db9e38a5903a671209ae4d3fb4f9f4db4c95
|
|
|
|
Poison Ivy
|
|
6966e511a45e42a9cfa32799dd3ecf9ec1c2cf62ed491f872210334a26e8a533
|
|
84f9d3c0895fbcc3148ec77b967eb9cdf33eb90915937b91a61664d36eed7464
|
|
c4b73d2102c25e31e3b73a8547a0120e1d3706eed96392acb174ecbf1218fa37
|
|
c9d0d7e3ba9a1369b670511966f2c3b5fa3618d3b8ac99cbc3a732bd13501b99
|
|
ee3f29d2a68217825666dae6a56ae7ee96297ea7f88ae4fd78819983ae67a3ce
|
|
edfedfad21bd37b890d0e21c3c832ff9493612f9959a32d6406750b2d4a93697
|
|
|
|
|
|
|
|
C2 domains
|
|
news[.]hpc[.]tw
|
|
www[.]dpponline[.]trickip[.]org
|
|
www[.]forensic[.]zyns[.]com
|
|
www[.]bannered[.]4dq[.]com
|
|
www[.]forensic611[.]3-a[.]net
|
|
bbs[.]zzbooks[.]net
|
|
bbs[.]ccdog[.]net
|
|
wallstreet[.]1dumb[.]com
|
|
www[.]cham[.]com[.]tw
|
|
pinkker[.]zzux[.]com
|
|
www[.]amberisic611[.]4dq[.]com
|
|
www[.]metacu[.]ygto[.]com
|
|
bbs[.]zzbook[.]net
|
|
www[.]myinfo[.]ocry[.]com
|
|
www[.]gmal1[.]com
|
|
news[.]hpc[.]tw
|
|
www[.]dpponline[.]trickip[.]org
|
|
pinkker[.]zzux[.]com
|
|
wallstreet[.]1dumb[.]com
|
|
redpeach[.]youdontcare[.]com
|
|
redapple[.]justdied[.]com
|
|
stone[.]mypop3[.]org
|
|
zeus[.]jkub[.]com
|
|
sniper[.]mynumber[.]org
|
|
unclesam[.]jungleheart[.]com
|
|
arora[.]x24hr[.]com
|
|
flanando[.]fartit[.]com
|
|
www[.]dpponline[.]trickip[.]org
|
|
www[.]myinfo[.]ocry[.]com
|
|
belindianlab[.]itemdb[.]com
|
|
kr[.]dns1[.]us
|
|
|
|
|
|
C2 HTTP requests
|
|
hxxp://www[.]dpponline[.]trickip[.]org/images/D2015_id[.]jpg
|
|
hxxp://223[.]27[.]35[.]244/images/D2015_id[.]jpg
|
|
hxxp://www[.]myinfo[.]ocry[.]com/images/D2015_id[.]jpg
|
|
hxxp://belindianlab[.]itemdb[.]com/1613986301|C7A5398FBD8214C92F6596CC39B8866B0121E53422D6B8378E5D1F5F63844D693810BDED362511ED3630DC4F6A2B1302354C31242753DACB331EF3CF808E4E107B12F103F0C040F87DAA6CAB0676A25EBC673D9DFA078915F93361308E10BB5BA7DF1A90FEB614F1A1F12C7A135B60926A5D49FCE025F577FE0DEE937C803BE27D
|
|
hxxp://202[.]153[.]193[.]73/images/kong[.]24[.]jpg
|
|
hxxp://113[.]10[.]221[.]89/images/kong[.]24[.]jpg
|
|
hxxp://61[.]221[.]169[.]31/images/kongj[.]24[.]jpg
|
|
hxxp://www[.]forensic611[.]3-a[.]net/monitor/images/Smarp140102[.]24[.]gif
|
|
hxxp://www[.]bannered[.]4dq[.]com/monitor/images/Smarp140102[.]24[.]gif
|
|
hxxp://www[.]forensic[.]zyns[.]com/monitor/images/Smarp140102[.]24[.]gif
|
|
hxxp://113[.]10[.]221[.]89/Pictures/sbsb_0620[.]24[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/sbsb_0620[.]24[.]jpg
|
|
hxxp://www[.]forensic611[.]3-a[.]net/monitor/images/Smartzh131225[.]24[.]gif
|
|
hxxp://www[.]bannered[.]4dq[.]com/monitor/images/Smartzh131225[.]24[.]gif
|
|
hxxp://www[.]forensic[.]zyns[.]com/monitor/images/Smartzh131225[.]24[.]gif
|
|
hxxp://bbs[.]zzbooks[.]net/Pictures/lclc_0523[.]24[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/lclc_0523[.]24[.]jpg
|
|
hxxp://113[.]10[.]221[.]89/Pictures/lclc_0523[.]24[.]jpg
|
|
hxxp://50[.]117[.]38[.]164/Pictures/dzh_0925[.]24[.]jpg
|
|
hxxp://www[.]cham[.]com[.]tw/images/dzh_0925[.]24[.]jpg
|
|
hxxp://113[.]10[.]221[.]89/Pictures/dzh_0925[.]24[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/jpg_140430[.]24[.]jpg
|
|
hxxp://198[.]100[.]122[.]66/Pictures/jpg_140430[.]24[.]jpg
|
|
hxxp://192[.]69[.]221[.]92/Pictures/jpg_140430[.]24[.]jpg
|
|
hxxp://www[.]bannered[.]4dq[.]com/monitor/images/SmartNav141216[.]64[.]gif
|
|
hxxp://www[.]amberisic611[.]4dq[.]com/monitor/images/SmartNav141216[.]64[.]gif
|
|
hxxp://www[.]metacu[.]ygto[.]com/monitor/images/SmartNav141216[.]64[.]gif
|
|
hxxp://www[.]metacu[.]ygto[.]com/monitor/images/SmartNav141216[.]32[.]gif
|
|
hxxp://www[.]amberisic611[.]4dq[.]com/monitor/images/SmartNav141216[.]32[.]gif
|
|
hxxp://www[.]bannered[.]4dq[.]com/monitor/images/SmartNav141216[.]32[.]gif
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/20150120-hex[.]64[.]jpg
|
|
hxxp://23[.]27[.]112[.]216/Pictures/20150120-hex[.]64[.]jpg
|
|
hxxp://bbs[.]zzbook[.]net/Pictures/20150120-hex[.]64[.]jpg
|
|
hxxp://bbs[.]zzbook[.]net/Pictures/20150120-hex[.]32[.]jpg
|
|
hxxp://23[.]27[.]112[.]216/Pictures/20150120-hex[.]32[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/20150120-hex[.]32[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/h20141212012[.]64[.]jpg
|
|
hxxp://23[.]27[.]112[.]216/Pictures/h20141212012[.]32[.]jpg
|
|
hxxp://113[.]10[.]221[.]89/Pictures/h20141212012[.]32[.]jpg
|
|
hxxp://bbs[.]ccdog[.]net/Pictures/h20141212012[.]32[.]jpg
|
|
hxxp://113[.]10[.]221[.]89/Pictures/ooba_0823[.]24[.]jpg
|
|
hxxp://198[.]100[.]122[.]66/Pictures/ooba_0823[.]24[.]jpg
|
|
hxxp://50[.]117[.]38[.]164/Pictures/ooba_0823[.]24[.]jpg
|
|
hxxp://www[.]metacu[.]ygto[.]com/monitor/images/SmartNav0120[.]64[.]gif
|
|
hxxp://www[.]amberisic611[.]4dq[.]com/monitor/images/SmartNav0120[.]64[.]gif
|
|
hxxp://www[.]bannered[.]4dq[.]com/moitor/images/SmartNav0120[.]64[.]gif
|
|
hxxp://www[.]bannered[.]4dq[.]com/moitor/images/SmartNav0120[.]32[.]gif
|
|
hxxp://www[.]metacu[.]ygto[.]com/monitor/images/SmartNav0120[.]32[.]gif
|
|
hxxp://www[.]amberisic611[.]4dq[.]com/monitor/images/SmartNav0120[.]32[.]gif
|
|
hxxp://www[.]dpponline[.]trickip[.]org/images/D2015_id[.]jpg
|
|
hxxp://223[.]27[.]35[.]244/images/D2015_id[.]jpg
|
|
hxxp://www[.]myinfo[.]ocry[.]com/images/D2015_id[.]jpg
|
|
hxxp://49[.]254[.]211[.]75//tedws/1[.]64[.]jpg
|
|
hxxp://107[.]183[.]183[.]235/public/1[.]64[.]jpg
|
|
hxxp://49[.]254[.]211[.]75//tedws/1[.]32[.]jpg
|
|
hxxp://107[.]183[.]183[.]235/public/1[.]32[.]jpg
|
|
hxxp://flanando[.]fartit[.]com/2015/p1[.]64[.]jpg
|
|
hxxp://flanando[.]fartit[.]com/2015/p1[.]32[.]jpg
|
|
|