2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2016-08-08" ,
"extends_uuid" : "" ,
"info" : "OSINT - Strider: Cyberespionage group turns eye of Sauron on targets" ,
"publish_timestamp" : "1470751041" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1470751030" ,
"uuid" : "57a88345-5254-4c97-954d-4ff8950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#004646" ,
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661458" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88352-7acc-4ad7-be40-453d950d210f" ,
"value" : "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661498" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "57a8837a-a450-4ced-b08e-4905950d210f" ,
"value" : "A previously unknown group called Strider has been conducting cyberespionage-style attacks against selected targets in Russia, China, Sweden, and Belgium. The group uses an advanced piece of malware known as Remsec (Backdoor.Remsec) to conduct its attacks. Remsec is a stealthy tool that appears to be primarily designed for spying purposes. Its code contains a reference to Sauron, the all-seeing antagonist in Lord of the Rings.\r\n\r\nStrider\u00e2\u20ac\u2122s attacks have tentative links with a previously uncovered group, Flamer. The use of Lua modules, which we\u00e2\u20ac\u2122ll discuss later, is a technique that has previously been used by Flamer. One of Strider\u00e2\u20ac\u2122s targets had also previously been infected by Regin."
} ,
{
"category" : "Antivirus detection" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661556" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "57a883b4-fabc-4936-8e65-41c8950d210f" ,
"value" : "Backdoor.Remsec"
} ,
{
"category" : "Targeting data" ,
"comment" : "Only a small number of organizations in four countries are impacted by Strider" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661657" ,
"to_ids" : false ,
"type" : "target-location" ,
"uuid" : "57a88419-1900-403e-845c-47da950d210f" ,
"value" : "Belgium"
} ,
{
"category" : "Targeting data" ,
"comment" : "Only a small number of organizations in four countries are impacted by Strider" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661658" ,
"to_ids" : false ,
"type" : "target-location" ,
"uuid" : "57a8841a-455c-4b87-96a5-4325950d210f" ,
"value" : "Sweden"
} ,
{
"category" : "Targeting data" ,
"comment" : "Only a small number of organizations in four countries are impacted by Strider" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661658" ,
"to_ids" : false ,
"type" : "target-location" ,
"uuid" : "57a8841a-a3cc-457b-9a54-4e8c950d210f" ,
"value" : "Russia"
} ,
{
"category" : "Targeting data" ,
"comment" : "Only a small number of organizations in four countries are impacted by Strider" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661658" ,
"to_ids" : false ,
"type" : "target-location" ,
"uuid" : "57a8841a-f964-41c4-81a5-43e4950d210f" ,
"value" : "China"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470661716" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a88454-b0c4-432b-ae28-4558950d210f" ,
"value" : "MSAOSSPC.DLL"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662076" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a885bc-1614-4e58-8e17-4457950d210f" ,
"value" : "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"
} ,
{
"category" : "Payload installation" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662141" ,
"to_ids" : true ,
"type" : "filename|md5" ,
"uuid" : "57a885fd-10f8-46fe-8f9d-44ca950d210f" ,
"value" : "MSAOSSPC.DLL|2a8785bf45f4f03c10cd929bb0685c2d"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "The loaded executable blobs may be retrieved from the following path" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662256" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a88670-859c-439a-bd1d-4e63950d210f" ,
"value" : "c:\\System Volume Information\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\RP0\\A0000002.dll"
} ,
{
"category" : "Payload installation" ,
"comment" : "is to receive executable modules from remote attackers and run them from memory on the local computer . (Network loader)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662346" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a886ca-69c8-45d6-80ed-41fb950d210f" ,
"value" : "90b4b5f0a475f3a028be2f71409e6d1a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Host loader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662419" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88713-13ec-49db-a8cf-4ccb950d210f" ,
"value" : "7261230a43a40bb29227a169c2c8e1be"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Host loader" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662419" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88713-03d0-4507-a60c-4d2f950d210f" ,
"value" : "48d0c8faaee08fc51346925090af89aa"
} ,
{
"category" : "Payload installation" ,
"comment" : "- Xchecked via VT: 2a8785bf45f4f03c10cd929bb0685c2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662438" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88726-e6ec-4913-926b-44f102de0b81" ,
"value" : "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
} ,
{
"category" : "Payload installation" ,
"comment" : "- Xchecked via VT: 2a8785bf45f4f03c10cd929bb0685c2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662439" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88727-5970-4226-a94e-412602de0b81" ,
"value" : "d18792a187d7567f3f31908c05a8b8a2647d365f"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: 2a8785bf45f4f03c10cd929bb0685c2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662439" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88727-6cfc-4135-9911-471d02de0b81" ,
"value" : "https://www.virustotal.com/file/6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd/analysis/1470296379/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Host loader - Xchecked via VT: 7261230a43a40bb29227a169c2c8e1be" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662440" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88728-93e0-497c-b71b-438402de0b81" ,
"value" : "d737644d612e5051f66fb97a34ec592b3508be06e33f743a2fdb31cdf6bd2718"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Host loader - Xchecked via VT: 7261230a43a40bb29227a169c2c8e1be" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662440" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88728-fd5c-4297-be69-470b02de0b81" ,
"value" : "1bb7614bb7c3042796c8dc7befdd8042197f222d"
} ,
{
"category" : "External analysis" ,
"comment" : "Host loader - Xchecked via VT: 7261230a43a40bb29227a169c2c8e1be" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662441" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88729-dd00-4f3f-8a83-4f6602de0b81" ,
"value" : "https://www.virustotal.com/file/d737644d612e5051f66fb97a34ec592b3508be06e33f743a2fdb31cdf6bd2718/analysis/1470649331/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "The keylogger logs data to the following location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662704" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a88830-f1b4-4a1e-b841-4c5c950d210f" ,
"value" : "%WINDIR%\\\\temp\\\\bka*.da"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "The keylogger logs data to the following location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662763" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a8886b-ba78-49a2-aadb-48cd950d210f" ,
"value" : "%WINDIR%\\\\temp\\\\bka*.dat"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "The keylogger logs data to the following location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662819" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a888a3-e1b0-4996-a918-4eca950d210f" ,
"value" : "C:\\\\System Volume Information\\\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\\\RP0\\\\change.log"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "The keylogger logs data to the following location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662896" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a888f0-ad44-4490-9f2f-4486950d210f" ,
"value" : "C:\\\\System Volume Information\\\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\\\RP1\\\\A*"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662936" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88918-641c-44a7-8ab9-453b950d210f" ,
"value" : "0a0948d871ef5a3006c0ab2997ad330e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662936" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88918-cf7c-4e27-8853-4557950d210f" ,
"value" : "113050c3e3140bf631d186d78d4b1dc0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662936" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88918-57d0-44b7-88a5-4a1b950d210f" ,
"value" : "1d9d7d05ab7c68bdc257afb1c086fb88"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662936" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88918-6ac0-43b5-a57a-485e950d210f" ,
"value" : "1f316e14e773ca0f468d0d160b5d0307"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662937" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88919-2298-4047-9466-4583950d210f" ,
"value" : "7b8a3bf6fd266593db96eddaa3fae6f9"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662937" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88919-8ba4-40f1-99fa-4e7b950d210f" ,
"value" : "cf6c049bd7cd9e04cc365b73f3f6098e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662937" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57a88919-a6bc-4fea-910b-4aad950d210f" ,
"value" : "7c3eecfb5174ca5cb1e03b8bf4b06f19"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 7c3eecfb5174ca5cb1e03b8bf4b06f19" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662958" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a8892e-d428-466b-b840-469c02de0b81" ,
"value" : "02a9b52c88199e5611871d634b6188c35a174944f75f6d8a2110b5b1c5e60a48"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 7c3eecfb5174ca5cb1e03b8bf4b06f19" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662958" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a8892e-7f90-4990-85ac-49ae02de0b81" ,
"value" : "b5fbba3182ef25b20fecfc537effeeede977a2fc"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 7c3eecfb5174ca5cb1e03b8bf4b06f19" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662958" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a8892e-ef88-415d-80e0-498e02de0b81" ,
"value" : "https://www.virustotal.com/file/02a9b52c88199e5611871d634b6188c35a174944f75f6d8a2110b5b1c5e60a48/analysis/1470649329/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: cf6c049bd7cd9e04cc365b73f3f6098e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662959" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a8892f-cc04-4152-9128-4b7302de0b81" ,
"value" : "6b06522f803437d51c15832dbd6b91d8d8b244440b4d2f09bd952f335351b06d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: cf6c049bd7cd9e04cc365b73f3f6098e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662959" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a8892f-711c-446a-80a1-497e02de0b81" ,
"value" : "90bead07f7c6c92c6ca2b34406c5ea516307ee4e"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: cf6c049bd7cd9e04cc365b73f3f6098e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662959" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a8892f-24c4-458c-bc44-45d802de0b81" ,
"value" : "https://www.virustotal.com/file/6b06522f803437d51c15832dbd6b91d8d8b244440b4d2f09bd952f335351b06d/analysis/1470649331/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 7b8a3bf6fd266593db96eddaa3fae6f9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662959" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a8892f-c620-4e9f-915d-4c2b02de0b81" ,
"value" : "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 7b8a3bf6fd266593db96eddaa3fae6f9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662959" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a8892f-3c50-45a8-a921-4c8102de0b81" ,
"value" : "d18df80316160535aa798303b6f02b6ae8e04388"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 7b8a3bf6fd266593db96eddaa3fae6f9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662960" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88930-d4d4-49f5-8125-433502de0b81" ,
"value" : "https://www.virustotal.com/file/3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8/analysis/1470653929/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 1f316e14e773ca0f468d0d160b5d0307" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662960" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88930-0918-4973-8a8e-454b02de0b81" ,
"value" : "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 1f316e14e773ca0f468d0d160b5d0307" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662960" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88930-cfa4-41f9-96bd-40e802de0b81" ,
"value" : "4bf1fd9c721d13b74a1aa18d4bf1981558697fc7"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 1f316e14e773ca0f468d0d160b5d0307" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662960" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88930-0520-41f5-adf5-4ba602de0b81" ,
"value" : "https://www.virustotal.com/file/9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9/analysis/1470653936/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 1d9d7d05ab7c68bdc257afb1c086fb88" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662961" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88931-8c58-4ed9-9396-471902de0b81" ,
"value" : "c8f95bf8a76ff124cc1d7a8439beff360d0eb9c0972d42a8684c3bd4e91c6600"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 1d9d7d05ab7c68bdc257afb1c086fb88" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662961" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88931-ad84-4ded-b269-4cc802de0b81" ,
"value" : "63b579b9671b45478b42a5f96110c9d4234f7c82"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 1d9d7d05ab7c68bdc257afb1c086fb88" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662961" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88931-d260-41f7-97d5-462202de0b81" ,
"value" : "https://www.virustotal.com/file/c8f95bf8a76ff124cc1d7a8439beff360d0eb9c0972d42a8684c3bd4e91c6600/analysis/1470653946/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 113050c3e3140bf631d186d78d4b1dc0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662961" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88931-c5f0-4ac8-8a8d-4dda02de0b81" ,
"value" : "bde264ceb211089f6a9c8cfbaf3974bf3d7bf4843d22186684464152c432f8a5"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 113050c3e3140bf631d186d78d4b1dc0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662961" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88931-6a54-4009-af93-4c9002de0b81" ,
"value" : "3ae2cafb053009c16dbec057184c6250b450b914"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 113050c3e3140bf631d186d78d4b1dc0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662962" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88932-3ecc-484f-ab05-472002de0b81" ,
"value" : "https://www.virustotal.com/file/bde264ceb211089f6a9c8cfbaf3974bf3d7bf4843d22186684464152c432f8a5/analysis/1470173246/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 0a0948d871ef5a3006c0ab2997ad330e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662962" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88932-98c0-474a-aaae-442002de0b81" ,
"value" : "ab8181ae5cc205f1d3cae00d8b34011e47b735a553bd5a4f079f03052b74a06d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Network listeners - Xchecked via VT: 0a0948d871ef5a3006c0ab2997ad330e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662962" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57a88932-6780-42a7-8138-4d6402de0b81" ,
"value" : "ee9eccad334b3bd8874b7259555a93ccb23f7e59"
} ,
{
"category" : "External analysis" ,
"comment" : "Network listeners - Xchecked via VT: 0a0948d871ef5a3006c0ab2997ad330e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470662962" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57a88932-72cc-46fd-b6ec-4cae02de0b81" ,
"value" : "https://www.virustotal.com/file/ab8181ae5cc205f1d3cae00d8b34011e47b735a553bd5a4f079f03052b74a06d/analysis/1470649324/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Backdoor. Remsec" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470663912" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57a88ce8-5518-4f78-880b-4338950d210f" ,
"value" : "6189b94c9f3982ce15015d68f280f5d7a87074b829edb87825cadab6ec1c7ec2"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664006" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d46-5be8-43a8-a8f5-4214950d210f" ,
"value" : "http://flowershop22.110mb.com/flowers.php"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664007" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d47-6e64-4001-8edd-42cf950d210f" ,
"value" : "http://flowershop22.110mb.com/shop.php"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664007" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d47-85a0-4b82-aa20-4c86950d210f" ,
"value" : "http://wildhorses.awardspace.info/hindex.php"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664007" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d47-4ed8-406d-9b7a-4a15950d210f" ,
"value" : "http://wildhorses.awardspace.info/horses.php"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664007" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d47-781c-4701-b87b-4227950d210f" ,
"value" : "http://www.myhomemusic.com/music.php"
} ,
{
"category" : "Network activity" ,
"comment" : "Imported via the Freetext Import Tool" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664007" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "57a88d47-8d90-4087-a16e-4007950d210f" ,
"value" : "http://www.myhomemusic.com/mymusic.php"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664161" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "57a88de1-7928-481d-8410-492e950d210f" ,
"value" : "rule remsec_encrypted_api\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$open_process =\r\n/*\r\n\"OpenProcess\\x00\" in encrypted form\r\n*/\r\n{ 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }\r\ncondition:\r\nall of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664197" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "57a88e05-98f4-47fc-8b65-4444950d210f" ,
"value" : "rule remsec_packer_A\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n/*\r\n69 ?? AB 00 00 00\r\nimul\r\nr0, 0ABh\r\n81 C? CD 2B 00 00\r\nadd\r\nr0, 2BCDh\r\nF7 E?\r\nmul\r\nr0\r\nC1 E? 0D\r\nshr\r\nr1, 0Dh\r\n69 ?? 85 CF 00 00\r\nimul\r\nr1, 0CF85h\r\n2B\r\nsub\r\nr0, r1\r\n*/\r\n{\r\n69 ( C? | D? | E? | F? ) AB 00 00 00\r\n( 81 | 41 81 ) C? CD 2B 00 00\r\n( F7 | 41 F7 ) E?\r\n( C1 | 41 C1 ) E? 0D\r\n( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00\r\n( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B )\r\n}\r\ncondition:\r\nall of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664325" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "57a88e85-d6e8-46eb-9415-4da0950d210f" ,
"value" : "rule remsec_packer_B\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n{\r\n48 8B 05 ?? ?? ?? ??\r\n48 89 44 24 ??\r\n48 8B 05 ?? ?? ?? ??\r\n48 8D 4C 24 ??\r\n48 89 44 24 ??\r\n48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )\r\n( 44 88 6? 24 ?? | C6 44 24 ?? 00 )\r\n48 89 44 24 ??\r\n48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )\r\nC7 44 24 ?? 0? 00 00 00\r\n2B ?8\r\n48 89 ?C 24 ??\r\n44 89 6? 24 ??\r\n83 C? 08\r\n89 ?C 24 ??\r\n( FF | 41 FF ) D?\r\n( 05 | 8D 88 ) 00 00 00 3A\r\n}\r\ncondition:\r\nall of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470664392" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "57a88ec8-3460-42bf-adf3-4cb8950d210f" ,
"value" : "rule remsec_executable_blob_32\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n{\r\n31 06\r\n83 C6 04\r\nD1 E8\r\n73 05\r\n35 01 00 00 D0\r\nE2 F0\r\n}\r\ncondition:\r\nall of them\r\n}"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470665034" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57a8914a-a938-4f12-a6d0-48e0950d210f" ,
"value" : "flowershop22.110mb.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470665034" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57a8914a-dde8-4147-a826-4cea950d210f" ,
"value" : "wildhorses.awardspace.info"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470665053" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "57a8915d-b784-457f-9ad3-45b7950d210f" ,
"value" : "myhomemusic.com"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Configuration data for host loader (version with MD5: 7261230a43a40bb29227a169c2c8e1be)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470665114" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a8919a-b2a4-4d94-be0d-4e42950d210f" ,
"value" : "c:\\\\System Volume Information\\\\{aa112c99-f343-4107-8ba1-22951714a641}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Configuration data for host loader (version with MD5: 7261230a43a40bb29227a169c2c8e1be)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470665194" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "57a891ea-2728-4d10-bb9d-4a80950d210f" ,
"value" : "c:\\\\System Volume Information\\\\{951841cb-d1a4-4d7c-b44e-2c3d25996e37}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1470751030" ,
"to_ids" : true ,
"type" : "mutex" ,
"uuid" : "57a89eb7-8f40-4ab7-a7a4-4fe6950d210f" ,
"value" : "Global\\\\{b3898039-f3d8-4965-b618-a8a0d031cc5a}"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
