360 Threat Intelligence Center

#APT-C-61 #Sanuwa MD5：54f8ac92afeb71cf53fe5c10a71fb880 https://op9.herokuapp[.]com

#Evilnum MD5: 984a7a5f67eddd64dfd538797018feb2 FileName: SelfiePassport2505.jpg.lnk C2: http[:]//apintoative[.]com/get.php

#APT #Kimsuky Template injection file: BIOStyle.dotm MD5: 863fd86868014b5cc008764816c422c5 URL： http://vnskwl[.]mypressonline[.]com/relationship/BIOStyle[.]dotm http://outwd[.]myartsonline[.]com/yu/ls[.]txt

#APT #Kimsuky Malicious PDF document Name: 인터뷰질문지-최은율(한국어).pdf MD5:6d6399e5e98164e365029a9b141e1646 C&C: http:// rhwkdlaktm[.]atwebpages[.]com/download.php?filename=acom2

An XML file uploaded from India, which contains base64-encoded JS, may have started an HTA file MD5: 5d665d6401cc6ea544881db8ad02c6fa

#APT #KONNI It might be a lure document targeting Russia. MD5: ce866ae254de4cabd60a95abcc52c315 http://romanovawillkillyou[.]c1[.]biz/index[.]php?user_id=417

#APT #Gamaredon File Stealer This sample can bypass AV, latest detection result shows that only 6/65 AV on VT detected it. More related samples can be found if you check the communicating files with this C&C. MD5: 6ee61b9935b8483af73ddbe407c6bb46 C2:krashand[.]ru

This code and digital signature are the same as the old sample of #Patchwork: 18363437744197efdfb779bad31b32ca f5f147661da458e39d413ef9b62c7d3c

Our researcher found a malicious document about COVID-19, uploaded from Turkey. MD5: ad7ac4c241bfce6f4cc5b5d1c420acbf

#APT #Kimsuky #GoldDragon is stealing information through mailbox. The attacker's mailbox is flower9801@hanmail.net.

#APT #Lazarus #Andariel Suspected samples of Andariel, a sub-organization of Lazarus MD5: in the pic below C&C: 185[.]208.158.204 193[.]56.28.251

#APT The backdoor from #Kimsuky Group is being updated from time to time. MD5: a213a2bdfb76bcb4957568f08f753b85

#APT #Kimsuky new samples File name: 대장암 케이스.hwp.exe MD5: e8da7fcdf0ca67b76f9a7967e240d223 C&C: hxxp:// pollor[.]p-e[.]kr/?query=5

#APT #Lazarus new docs File name: airbus_job_opportunity_confidential.doc MD5: 4fb3bd661331b10fbd01e5f3e72f476c B7DBB3BEF80D04E4B8981AB4011F4BFE C&C: hxxps:// shopweblive[.]com/image_slider[.]png

#APT #Kimsuky Samples: 27[.]102.127.240 d4da4660836d61db95dd91936e7cfa4a 815c690bfc097b82a8f1d171cd00e775 7f4624a8eb740653e2242993ee9e0997 6e8406d6680899937f23c788a7008a11

#APT #Kimsuky Suspected new samples File: 사례비지급 의뢰서(양식).doc MD5: 95c92bcfc39ceafc1735f190a575c60c C2: hxxps://smyun0272[.]blogspot[.]com/2021/06/dootakim[.]html http://alyssalove[.]getenjoyment[.]net/0423/v[.]php?ki87ujhy=

New IOCs (MD5, domain and URLs) of #DONOT Group (#APT-C-35). Comparing pic 3 with pic 4 (it's from the old samples), we can see similar data format when they communicate with the C&C server