Vulnerabilityhigh
Mysterious Elephant APT: TTPs and tools
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ddns.net | pdfplugins[.]com file-share.officeweb[.]live fileshare-avp.ddns[.]net 91.132.95[.]148 62.106.66[.]80 158.255.215[.]45 |
| domain | fuzzy-network.tech | [.]online:4443 hxxp://cloud.qunetcentre[.]org:443 solutions.fuzzy-network[.]tech pdfplugins[.]com file-share.officeweb[.]live fileshare-av |
| domain | givensolutions.online | nference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://cloud.qunetcentre[.]org:443 solutions.fuzzy-n |
| domain | listofexoticplaces.com | hatsAppOB.exe Domains/IPs hxxps://storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]onlin |
| domain | mediumblog.online | ofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://clo |
| domain | monsoonconference.com | /storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutio |
| domain | officeweb.live | solutions.fuzzy-network[.]tech pdfplugins[.]com file-share.officeweb[.]live fileshare-avp.ddns[.]net 91.132.95[.]148 62.106.66[.]80 1 |
| domain | pdfplugins.com | /cloud.qunetcentre[.]org:443 solutions.fuzzy-network[.]tech pdfplugins[.]com file-share.officeweb[.]live fileshare-avp.ddns[.]net 91.1 |
| domain | qunetcentre.org | 4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://cloud.qunetcentre[.]org:443 solutions.fuzzy-network[.]tech pdfplugins[.]com file- |
| domain | storycentral.net | 107067ff0bab73307f5499b6 WhatsAppOB.exe Domains/IPs hxxps://storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference |
| ipv4 | 158.255.215.45 | ive fileshare-avp.ddns[.]net 91.132.95[.]148 62.106.66[.]80 158.255.215[.]45 |
| ipv4 | 62.106.66.80 | e.officeweb[.]live fileshare-avp.ddns[.]net 91.132.95[.]148 62.106.66[.]80 158.255.215[.]45 |
| ipv4 | 91.132.95.148 | [.]com file-share.officeweb[.]live fileshare-avp.ddns[.]net 91.132.95[.]148 62.106.66[.]80 158.255.215[.]45 |
| md5 | 037b2f6233ccc82f0c75bf56c47742bb | ically a sample of the commercial RAT called “Remcos” (MD5: 037b2f6233ccc82f0c75bf56c47742bb). Another recent loader malware used in the latest campaign |
| md5 | 3caaf05b2e173663f359f27802f10139 | dll 4c32e12e73be9979ede3f8fce4f41a3a STI.dll MemLoader Edge 3caaf05b2e173663f359f27802f10139 Edge.exe, debugger.exe, runtime.exe bc0fc851268afdf0f63c974 |
| md5 | 4c32e12e73be9979ede3f8fce4f41a3a | emLoader HidenDesk 658eed7fcb6794634bbdd7f272fcf9c6 STI.dll 4c32e12e73be9979ede3f8fce4f41a3a STI.dll MemLoader Edge 3caaf05b2e173663f359f27802f10139 Edg |
| md5 | 658eed7fcb6794634bbdd7f272fcf9c6 | -MoD-Invitation_the_UN_Peacekeeping.rar MemLoader HidenDesk 658eed7fcb6794634bbdd7f272fcf9c6 STI.dll 4c32e12e73be9979ede3f8fce4f41a3a STI.dll MemLoader |
| md5 | 78b59ea529a7bddb3d63fcbe0fe7af94 | a51389a623eb283b6 ping.exe e525da087466ef77385a06d969f06c81 78b59ea529a7bddb3d63fcbe0fe7af94 ChromeStealer Exfiltrator 9e50adb6107067ff0bab73307f5499b6 |
| md5 | 7ee45b465dcc1ac281378c973ae4c6a0 | HARED.dll Stom Exfiltrator ff1417e8e208cadd55bf066f28821d94 7ee45b465dcc1ac281378c973ae4c6a0 ping.exe b63316223e952a3a51389a623eb283b6 ping.exe e525da08 |
| md5 | 85c7f209a8fa47285f08b09b3868c2a1 | .exe, runtime.exe bc0fc851268afdf0f63c97473825ff75 BabShell 85c7f209a8fa47285f08b09b3868c2a1 f947ff7fb94fa35a532f8a7d99181cf1 Uplo Exfiltrator cf1d14e59 |
| md5 | 8650fff81d597e1a3406baf3bb87297f | licious documents c12ea05baf94ef6f0ea73470d70db3b2 M6XA.rar 8650fff81d597e1a3406baf3bb87297f 2025-013-PAK-MoD-Invitation_the_UN_Peacekeeping.rar MemLoad |
| md5 | 9e50adb6107067ff0bab73307f5499b6 | 78b59ea529a7bddb3d63fcbe0fe7af94 ChromeStealer Exfiltrator 9e50adb6107067ff0bab73307f5499b6 WhatsAppOB.exe Domains/IPs hxxps://storycentral[.]net hxxp: |
| md5 | b63316223e952a3a51389a623eb283b6 | d55bf066f28821d94 7ee45b465dcc1ac281378c973ae4c6a0 ping.exe b63316223e952a3a51389a623eb283b6 ping.exe e525da087466ef77385a06d969f06c81 78b59ea529a7bddb3 |
| md5 | bc0fc851268afdf0f63c97473825ff75 | e173663f359f27802f10139 Edge.exe, debugger.exe, runtime.exe bc0fc851268afdf0f63c97473825ff75 BabShell 85c7f209a8fa47285f08b09b3868c2a1 f947ff7fb94fa35a5 |
| md5 | c12ea05baf94ef6f0ea73470d70db3b2 | intelreports@kaspersky.com. File hashes Malicious documents c12ea05baf94ef6f0ea73470d70db3b2 M6XA.rar 8650fff81d597e1a3406baf3bb87297f 2025-013-PAK-MoD- |
| md5 | cf1d14e59c38695d87d85af76db9a861 | b3868c2a1 f947ff7fb94fa35a532f8a7d99181cf1 Uplo Exfiltrator cf1d14e59c38695d87d85af76db9a861 SXSHARED.dll Stom Exfiltrator ff1417e8e208cadd55bf066f28821 |
| md5 | e525da087466ef77385a06d969f06c81 | 3ae4c6a0 ping.exe b63316223e952a3a51389a623eb283b6 ping.exe e525da087466ef77385a06d969f06c81 78b59ea529a7bddb3d63fcbe0fe7af94 ChromeStealer Exfiltrator |
| md5 | f947ff7fb94fa35a532f8a7d99181cf1 | 0f63c97473825ff75 BabShell 85c7f209a8fa47285f08b09b3868c2a1 f947ff7fb94fa35a532f8a7d99181cf1 Uplo Exfiltrator cf1d14e59c38695d87d85af76db9a861 SXSHARED. |
| md5 | ff1417e8e208cadd55bf066f28821d94 | d14e59c38695d87d85af76db9a861 SXSHARED.dll Stom Exfiltrator ff1417e8e208cadd55bf066f28821d94 7ee45b465dcc1ac281378c973ae4c6a0 ping.exe b63316223e952a3a5 |
| url | http://cloud.givensolutions.online:4443 | s://monsoonconference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://cloud.qunetcentre[.]org:443 solutions.fuzzy-networ |
| url | http://cloud.qunetcentre.org:443 | log[.]online:4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://cloud.qunetcentre[.]org:443 solutions.fuzzy-network[.]tech pdfplugins[.]com file-shar |
| url | http://listofexoticplaces.com | 499b6 WhatsAppOB.exe Domains/IPs hxxps://storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]onlin |
| url | http://mediumblog.online:4443 | ://listofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutions[.]online:4443 hxxp://cloud.qu |
| url | https://monsoonconference.com | hxxps://storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference[.]com hxxp://mediumblog[.]online:4443 hxxp://cloud.givensolutio |
| url | https://storycentral.net | 9e50adb6107067ff0bab73307f5499b6 WhatsAppOB.exe Domains/IPs hxxps://storycentral[.]net hxxp://listofexoticplaces[.]com hxxps://monsoonconference |
From the original article
10 min read at securelist.com
Mysterious Elephant is a highly active advanced persistent threat (APT) group that we at Kaspersky GReAT discovered in 2023. It has been consistently evolving and adapting its tactics, techniques, and procedures (TTPs) to stay under the radar.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.