New malicious web shell from the Tropic Trooper group is found in the Middle East
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE | 6.6 | 100% | KEVRansomwarePoC | KEV |
CVE-2021-34473+1 related CVE | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-26360 | Unauthenticated RCE via Improper Access Control in Adobe ColdFusion | 8.6 | 97% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | techmersion.com | t is hardcoded in the payload using its configuration (blog.techmersion[.]com on port 443). We compared the collected samples with the |
| md5 | 0b9ae998423a207f021f8e61b93bc849 | ows\branding\data 2024.04.28 Tue Jun 10 10:39:52 2025 (UTC) 0b9ae998423a207f021f8e61b93bc849 (variant 2) VERSION.dll c:\Windows\branding\data 2024.05.15 |
| md5 | 1dd03936baf0fe95b7e5b54a9dd4a577 | 6d584da56c182c datastate.dll Clear – Server 2024-02-23 81KB 1dd03936baf0fe95b7e5b54a9dd4a577 datast.dll Ldf/rcd 2024-02-23 80KB 8a900f742d0e3cd3898f37db |
| md5 | 2c7ebd103514018bad223f25026d4db3 | 958b9bbbf2838 datastate.dll Clear – Server 2023-03-22 178KB 2c7ebd103514018bad223f25026d4db3 datastate.dll Clear – Server 2023-03-10 81KB Recent variant |
| md5 | 3f15c4431ad4573344ad56e8384ebd62 | 4.05.15 5 Technical details Webshells — Umbraco modules MD5 3f15c4431ad4573344ad56e8384ebd62 Sha-1 311d1d50673fbfc40b84d94239cd4fa784269465 Sha256 8df9f |
| md5 | 475aa86ae60c640eec4fdea93b5ed04d | ows\branding\data 2024.05.15 Thu Oct 24 10:23:24 2024 (UTC) 475aa86ae60c640eec4fdea93b5ed04d (legitimate executable) inst.exe c:\Windows\branding\data 2 |
| md5 | 8a900f742d0e3cd3898f37dbc3d6e054 | baf0fe95b7e5b54a9dd4a577 datast.dll Ldf/rcd 2024-02-23 80KB 8a900f742d0e3cd3898f37dbc3d6e054 NA Clear – Server 2023-10-30 80kB a213873eb55dc092ddf3adbeb |
| md5 | a213873eb55dc092ddf3adbeb242bd44 | th as the legitimate executable. The datast.dll library MD5 a213873eb55dc092ddf3adbeb242bd44 Sha-1 3650899c669986e5f4363fdbd6cf5b78a6fcd484 Sha256 23dea |
| md5 | c10643b3fb304972c650e593b69faaa1 | b7e5b54a9dd4a577 Utility DLL used by datastate.dll WinStore c10643b3fb304972c650e593b69faaa1 Encrypted shellcode payload file These files are also invol |
| md5 | dd7593e9ba80502505c958b9bbbf2838 | 5dc092ddf3adbeb242bd44 datast.dll InitCore 2023-07-21 178KB dd7593e9ba80502505c958b9bbbf2838 datastate.dll Clear – Server 2023-03-22 178KB 2c7ebd1035140 |
| md5 | e845563ba35e8d227152165b0c3e769f | le name File path File creation date Compilation timestamps e845563ba35e8d227152165b0c3e769f (variant 1) VERSION.dll c:\Windows\branding\data 2024.04.28 |
| md5 | fca94b8b718357143c53620c6b360470 | lled using the rundll32 command from the a . bat file (MD5: fca94b8b718357143c53620c6b360470), which we were unable to obtain. A second assumption is th |
| md5 | fd8382efb0a16225896d584da56c182c | hashes File name Exported functions File creation date Size fd8382efb0a16225896d584da56c182c datastate.dll Clear – Server 2024-02-23 81KB 1dd03936baf0fe |
| sha1 | 311d1d50673fbfc40b84d94239cd4fa784269465 | Umbraco modules MD5 3f15c4431ad4573344ad56e8384ebd62 Sha-1 311d1d50673fbfc40b84d94239cd4fa784269465 Sha256 8df9fa495892fc3d183917162746ef8fd9e438ff0d639264236d |
| sha1 | 3650899c669986e5f4363fdbd6cf5b78a6fcd484 | tast.dll library MD5 a213873eb55dc092ddf3adbeb242bd44 Sha-1 3650899c669986e5f4363fdbd6cf5b78a6fcd484 Sha256 23dea3a74e3ff6a367754d02466db4c86ffda47efe09529d3aad |
| sha256 | 23dea3a74e3ff6a367754d02466db4c86ffda47efe09529d3aad52b0d5694b30 | 2bd44 Sha-1 3650899c669986e5f4363fdbd6cf5b78a6fcd484 Sha256 23dea3a74e3ff6a367754d02466db4c86ffda47efe09529d3aad52b0d5694b30 Link-Time Thu Jul 27 16:21:38 2023 (UTC) File Type dynamic- |
| sha256 | 8df9fa495892fc3d183917162746ef8fd9e438ff0d639264236db553b09629dc | ebd62 Sha-1 311d1d50673fbfc40b84d94239cd4fa784269465 Sha256 8df9fa495892fc3d183917162746ef8fd9e438ff0d639264236db553b09629dc Link-Time 2024-05-06 10:19:28 File Type dynamic-link-librar |
From the original article
13 min read at securelist.com
Tropic Trooper (also known as KeyBoy and Pirate Panda) is an APT group active since 2011. This group has traditionally targeted sectors such as government, healthcare, transportation and high-tech industries in Taiwan, the Philippines and Hong Kong. Our recent investigation has revealed that in 2024 they conducted persistent campaigns targeting a government entity in the Middle East, starting in June 2023.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.