Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2020-09-16 (WEDNESDAY) - TA551 (SHATHAK) WORD DOCS WITH MACROS FOR ICEDID:
- CHAIN OF EVENTS:
- - malspam --> password-protected zip attachment --> extracted Word doc --> enable macros --> installer DLL --> IcedID EXE
- 20 EXAMPLES OF TA551 WORD DOCS WITH MACROS FOR ICEDID:
- - 9af952156e641712cc7072ff0bf85f4d2b5fad5c322c590e8b951974ce946d42 adjure,09.16.2020.doc
- - 93c7c35535a1cd749025f7760096e5fce3e0b1502b06c636b055479f3f531ce2 adjure_09.16.2020.doc
- - e61c99806aaa9d32d527cb346ee4ea8175e51cb07a2f8e53aee905d05e1f6190 deed contract-09.20.doc
- - e24db3e7f085b87a1ef337da7501af54af171c7005f0c7da13af8a08ff4bafbf details-09.20.doc
- - 57d08413af6d9fc3664764e014167fd106ced8015c669fe27a1eadd6077529b4 documents-09.20.doc
- - 1b7fc60bf597b5384b24dd340a1cee14082a1ce62a1a3e583affd343b55e7214 file 09.16.20.doc
- - 3b460c06f60ddd9abd026267b6f4279ead330d3902ce13cb13b9b44e109156ad file_09.16.2020.doc
- - 1140ced6f1344c92140f61c482f1af02cb615837389e1ef7bcdd86db3c050365 inquiry,09.20.doc
- - f594fad1f819e0d9547fa5a391a6b79f9237b1748a06138c3ac205f5cfc05d4f intelligence,09.16.2020.doc
- - 8d3795163d8c5ea1d6578410692831e833dbfcd3fb9791fef4069c8fbe33de4d legal agreement-09.16.2020.doc
- - 4bf24278b4b75d6c7e9d1f143735ac3518ed659c9dcc3f7aa89d15304af7072e legislate 09.16.20.doc
- - 98f503a60b3b2638b4cb36ab7f320a311d990fe962c94b17ed2a094ee47b3845 ordain,09.20.doc
- - f095c392c2bb991383d489af3e4621cf03fc349fa3cfd80f4c5fb81e75242670 question 09.16.2020.doc
- - 917011fbe73effd994c7dd28db0b6d722a3136b97ebfdc964c0c72e7b244b65e question,09.20.doc
- - 046f37a5e93f87189cd7324585c7c2bbb1317de92fa8919d831fcbc522d491a6 question.09.20.doc
- - c4ee9a8ea3c86b40fac69b02540d38e1a0ea6b12efbe3aff98d6e5b90a2befcb report-09.16.2020.doc
- - 6426e2de29bcbe2f7d9d6588eee823b043b7ca524ed6a87f6484cd36d7c74869 require 09.16.2020.doc
- - 672590acdfe5c2c398d52433e1100edc07e866a9004e80a10a98da0e193983c0 require-09.16.2020.doc
- - 5c21e983912e6cdcfd3f588de112fbe36eb005d76242b099b23e74abe1506ddd specifics 09.20.doc
- - a7343e22ce3a595766cd600db45438efa674d8168ef0bba26bd5560b909c5709 tell 09.20.doc
- AT LEAST 10 DOMAINS HOSTING THE ICEDID DLL:
- - ab94z0[.]com 193.201.126[.]25
- - bl3cavy[.]com 185.98.87[.]54
- - c1c2l0i[.]com - 93.189.41[.]178
- - cztixxy[.]com 83.166.243[.]201
- - fffufk[.]com - 195.93.173[.]116
- - safj3ng[.]com 109.248.250[.]2
- - swf1fas[.]com 85.117.233[.]251
- - tq9kma[.]com 95.213.224[.]9
- - vdnu32a[.]com 194.36.189[.]133
- - vsav42a[.]com 194.61.2[.]43
- URLS FOR ICEDID DLL:
- - GET /vakos/nomyr.php?l=fyfy1.cab
- - GET /vakos/nomyr.php?l=fyfy2.cab
- - GET /vakos/nomyr.php?l=fyfy3.cab
- - GET /vakos/nomyr.php?l=fyfy4.cab
- - GET /vakos/nomyr.php?l=fyfy5.cab
- - GET /vakos/nomyr.php?l=fyfy6.cab
- - GET /vakos/nomyr.php?l=fyfy7.cab
- - GET /vakos/nomyr.php?l=fyfy8.cab
- - GET /vakos/nomyr.php?l=fyfy9.cab
- - GET /vakos/nomyr.php?l=fyfy10.cab
- - GET /vakos/nomyr.php?l=fyfy11.cab
- - GET /vakos/nomyr.php?l=fyfy12.cab
- - GET /vakos/nomyr.php?l=fyfy13.cab
- - GET /vakos/nomyr.php?l=fyfy14.cab
- - GET /vakos/nomyr.php?l=fyfy15.cab
- - GET /vakos/nomyr.php?l=fyfy16.cab
- - GET /vakos/nomyr.php?l=fyfy17.cab
- - GET /vakos/nomyr.php?l=fyfy18.cab
- 10 EXAMPLES OF ICEDID INSTALLER DLLS:
- - 02026f323eea8b841f056a23b376cc58ca54956dd3c8216f87564d71c6736e06
- - 0d3a18ae0018427bbf053669e07bcc3cd9bc248b04a6dd0c082694d20818b56c
- - 24e4d25395afc41a3e9b860ae7fca1485ecbd3e432387a62c893412978f9a525
- - 866aa2c9699ab1427f23c3754e7b94358366d2c55e2ff512f26f16a22fa443b8
- - 9d075b18bd7c1a71d298cbbac829ff9753f43caaf9e06681206adc78f45b68fa
- - c14f7ece9b6c84d7e81839663fdfcb3cd3eacd06503f02e1cd4ccd9bb90019ca
- - cae8b4d8837f9c91e253a2f12cc797247a3d92a81e2219eb291cf294c39653ee
- - d41dc7c994809fa657b8217c6be5ff4f42a7daa61a14f5e711ce4d822bdeba70
- - dba67ec7a7ce016c238893260e21737a6738f611e3bb7cef80d2bb47ddd7d140
- - f90a1824f690bcd5c333bd78de0164174fffb12160c26699d6cd17cc10b71a49
- EXAMPLES OF LOCATION for THE INSTALLER DLL FILES:
- - C:\Users\[username]\Documents\test.pdf
- - C:\[same location as Word document]\test.pdf
- DLL RUN METHOD:
- - regsvr32.exe [filename]
- AT LEAST 2 DIFFERENT URLS FOR HTTPS TRAFFIC GENERATED BY INSTALLER DLLS:
- - 134.122.55[.]164 port 443 - loadro3[.]casa - GET /background.png
- - 134.122.55[.]164 port 443 - loadwe4[.]casa - GET /background.png
- 2 EXAMPLES OF SHA256 HASHES FOR ICEDID EXE CREATED BY ICEDID INSTALLER:
- - badf5b6c2231f8b56f60d0e71cdadf4c0938626d39230776a6d5adb1f4c352f1 (initial)
- - 55b811ff83a8f8b574694151ba2f1d6e9b1b3902061e8973b24f1af32a90ddca (persistent)
- HTTPS TRAFFIC TO MALICIOUS DOMAINS CAUSED BY THE ABOVE 2 ICEDID EXE FILES:
- - 79.141.171[.]183 port 443 - allpikoloserdzwe[.]cyou
- - 79.141.171[.]183 port 443 - sipmptomsledy[.]top
- - 79.141.171[.]183 port 443 - obnaprimezert[.]cyou
- - 79.141.171[.]183 port 443 - sprbumazna[.]club
- - 79.141.171[.]183 port 443 - uragapediculez[.]top
- HTTPS TRAFFIC TO LEGITIMATE DOMAINS CAUSED BY INSTALLER DLL:
- - port 443 - www.intel.com
- - port 443 - support.oracle.com
- - port 443 - www.oracle.com
- - port 443 - support.apple.com
- - port 443 - support.microsoft.com
- - port 443 - help.twitter.com
Add Comment
Please, Sign In to add comment