Vulnerabilitymedium
MATA: Multi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-3396 | Server-Side Template Injection RCE in Atlassian Confluence Server and Data Center | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.232.71.7 | dmg f05437d510287448325bac98a1378de1 SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:44 |
| ipv4 | 107.172.197.175 | 448325bac98a1378de1 SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 |
| ipv4 | 108.170.31.81 | ion number 3.1.1 (0x030101) Timeout 20 minutes C2 addresses 108.170.31[.]81:443 192.210.239[.]122:443 111.90.146[.]105:443 Disk path |
| ipv4 | 111.90.146.105 | utes C2 addresses 108.170.31[.]81:443 192.210.239[.]122:443 111.90.146[.]105:443 Disk path or URL of plugin (up to 15) to be loaded on |
| ipv4 | 111.90.148.132 | 43 107.172.197.175:443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 |
| ipv4 | 172.81.132.41 | 443 108.170.31.81:443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 |
| ipv4 | 172.93.184.62 | 443 111.90.146.105:443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:44 |
| ipv4 | 172.93.201.219 | :443 111.90.148.132:443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 |
| ipv4 | 185.62.58.207 | :443 172.81.132.41:443 172.93.184.62:443 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 |
| ipv4 | 192.210.239.122 | 030101) Timeout 20 minutes C2 addresses 108.170.31[.]81:443 192.210.239[.]122:443 111.90.146[.]105:443 Disk path or URL of plugin (up t |
| ipv4 | 198.180.198.6 | 43 172.93.201.219:443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 |
| ipv4 | 209.90.234.34 | 443 185.62.58.207:443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 |
| ipv4 | 216.244.71.233 | 443 192.210.239.122:443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 6 |
| ipv4 | 23.227.199.53 | :443 198.180.198.6:443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 6 |
| ipv4 | 23.227.199.69 | :443 209.90.234.34:443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 |
| ipv4 | 23.254.119.12 | :443 216.244.71.233:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 |
| ipv4 | 67.43.239.146 | 3:443 23.227.199.53:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 |
| ipv4 | 68.168.123.86 | 3:443 23.227.199.69:443 23.254.119.12:443 67.43.239.146:443 68.168.123.86:443 |
| md5 | 0137f688436c468d43b3e50878ec1a1f | seen in several Manuscrypt variants, including the samples (0137f688436c468d43b3e50878ec1a1f) mentioned in the US-CERT publication. Unique file name Mor |
| md5 | 1060702fe4e670eda8c0433c5966feee | 6d8aafff67271d350b8271505a 85dcea03016df4880cebee9a70de0c02 1060702fe4e670eda8c0433c5966feee 7b068dfbea310962361abf4723332b3a 8e665562b9e187585a3f32923c |
| md5 | 199b4c116ac14964e9646b2f27595156 | ence Server a99b7ef095f44cf35453465c64f0c70c check.vm, r.vm 199b4c116ac14964e9646b2f27595156 r.vm macOS MATA 81f8f0526740b55fe484c42126cd8396 TinkaOTP.d |
| md5 | 1e175231206cd7f80de4f6d86399c079 | 69a6e42a0bf6a8f7c12005636b 2b8ff2a971555390b37f75cb07ae84bd 1e175231206cd7f80de4f6d86399c079 65632998063ff116417b04b65fdebdfb ab2a98d3564c6bf656b8347681 |
| md5 | 228998f29864603fd4966cadd0be77fc | 9f60523d3a34f914 sdata.dat 6a066cf853fe51e3398ef773d016a4a8 228998f29864603fd4966cadd0be77fc da50a7a05abffb806f4a60c461521f41 ec05817e19039c2f6cc2c021e2 |
| md5 | 2b8ff2a971555390b37f75cb07ae84bd | faece7da5ed20d8eb2c9fa477c 6145fa69a6e42a0bf6a8f7c12005636b 2b8ff2a971555390b37f75cb07ae84bd 1e175231206cd7f80de4f6d86399c079 65632998063ff116417b04b65f |
| md5 | 2cd1f7f17153880fd80eba65b827d344 | d65512b99a362a1dbf6726ba9c fea3a39f97c00a6c8a589ff48bcc5a8c 2cd1f7f17153880fd80eba65b827d344 582b9801698c0c1614dbbae73c409efb a64b3278cc8f8b75e3c86b6a1f |
| md5 | 455997e42e20c8256a494fa5556f7333 | d74b59cc9cc1471e33e50475d3 a93d1d5c2cb9c728fda3a5beaf0a0ffc 455997E42E20C8256A494FA5556F7333 7ead1fbba01a76467d63c4a216cf2902 7d80175ea344b1c849ead7ca5a |
| md5 | 582b9801698c0c1614dbbae73c409efb | 9f97c00a6c8a589ff48bcc5a8c 2cd1f7f17153880fd80eba65b827d344 582b9801698c0c1614dbbae73c409efb a64b3278cc8f8b75e3c86b6a1faa6686 ca250f3c7a3098964a89d87933 |
| md5 | 6145fa69a6e42a0bf6a8f7c12005636b | 175d6fce7069cdb164603bd7dc b5d85cfaece7da5ed20d8eb2c9fa477c 6145fa69a6e42a0bf6a8f7c12005636b 2b8ff2a971555390b37f75cb07ae84bd 1e175231206cd7f80de4f6d863 |
| md5 | 65632998063ff116417b04b65fdebdfb | a971555390b37f75cb07ae84bd 1e175231206cd7f80de4f6d86399c079 65632998063ff116417b04b65fdebdfb ab2a98d3564c6bf656b8347681ecc2be e3dee2d65512b99a362a1dbf67 |
| md5 | 6a066cf853fe51e3398ef773d016a4a8 | af897e rdata.dat 8910bdaaa6d3d40e9f60523d3a34f914 sdata.dat 6a066cf853fe51e3398ef773d016a4a8 228998f29864603fd4966cadd0be77fc da50a7a05abffb806f4a60c461 |
| md5 | 6cd06403f36ad20a3492060c9dc14d80 | fbea310962361abf4723332b3a 8e665562b9e187585a3f32923cc1f889 6cd06403f36ad20a3492060c9dc14d80 71d8b4c4411f7ffa89919a3251e6e5cb a7bda9b5c579254114fab05ec7 |
| md5 | 71d8b4c4411f7ffa89919a3251e6e5cb | 62b9e187585a3f32923cc1f889 6cd06403f36ad20a3492060c9dc14d80 71d8b4c4411f7ffa89919a3251e6e5cb a7bda9b5c579254114fab05ec751918c e58cfbc6e0602681ff1841afad |
| md5 | 7b068dfbea310962361abf4723332b3a | 03016df4880cebee9a70de0c02 1060702fe4e670eda8c0433c5966feee 7b068dfbea310962361abf4723332b3a 8e665562b9e187585a3f32923cc1f889 6cd06403f36ad20a3492060c9d |
| md5 | 7d80175ea344b1c849ead7ca5a82ac94 | E42E20C8256A494FA5556F7333 7ead1fbba01a76467d63c4a216cf2902 7d80175ea344b1c849ead7ca5a82ac94 bf2765175d6fce7069cdb164603bd7dc b5d85cfaece7da5ed20d8eb2c9 |
| md5 | 7e4e49d74b59cc9cc1471e33e50475d3 | b5c579254114fab05ec751918c e58cfbc6e0602681ff1841afadad4cc6 7e4e49d74b59cc9cc1471e33e50475d3 a93d1d5c2cb9c728fda3a5beaf0a0ffc 455997E42E20C8256A494FA555 |
| md5 | 7ead1fbba01a76467d63c4a216cf2902 | 5c2cb9c728fda3a5beaf0a0ffc 455997E42E20C8256A494FA5556F7333 7ead1fbba01a76467d63c4a216cf2902 7d80175ea344b1c849ead7ca5a82ac94 bf2765175d6fce7069cdb16460 |
| md5 | 80c0efb9e129f7f9b05a783df6959812 | mthjk Linux MATA 859e7e9a11b37d355955f85b9a305fec mdata.dat 80c0efb9e129f7f9b05a783df6959812 ldata.dat, mdata.dat d2f94e178c254669fb9656d5513356d2 mdata |
| md5 | 81f8f0526740b55fe484c42126cd8396 | k.vm, r.vm 199b4c116ac14964e9646b2f27595156 r.vm macOS MATA 81f8f0526740b55fe484c42126cd8396 TinkaOTP.dmg f05437d510287448325bac98a1378de1 SubMenu.nib C |
| md5 | 859e7e9a11b37d355955f85b9a305fec | LM\Software\Microsoft\HlqNet HKLM\Software\mthjk Linux MATA 859e7e9a11b37d355955f85b9a305fec mdata.dat 80c0efb9e129f7f9b05a783df6959812 ldata.dat, mdata |
| md5 | 85dcea03016df4880cebee9a70de0c02 | ls, decoys) Windows Loader f364b46d8aafff67271d350b8271505a 85dcea03016df4880cebee9a70de0c02 1060702fe4e670eda8c0433c5966feee 7b068dfbea310962361abf4723 |
| md5 | 8910bdaaa6d3d40e9f60523d3a34f914 | 147 Windows MATA bea49839390e4f1eb3cb38d0fcaf897e rdata.dat 8910bdaaa6d3d40e9f60523d3a34f914 sdata.dat 6a066cf853fe51e3398ef773d016a4a8 228998f29864603f |
| md5 | 8e665562b9e187585a3f32923cc1f889 | 2fe4e670eda8c0433c5966feee 7b068dfbea310962361abf4723332b3a 8e665562b9e187585a3f32923cc1f889 6cd06403f36ad20a3492060c9dc14d80 71d8b4c4411f7ffa89919a3251 |
| md5 | 982bf527b9fe16205fea606d1beed7fa | 94e178c254669fb9656d5513356d2 mdata.dat Linux log collector 982bf527b9fe16205fea606d1beed7fa hdata.dat Open-source Linux SoCat e883bf5fd22eb6237eb84d80b |
| md5 | a64b3278cc8f8b75e3c86b6a1faa6686 | f17153880fd80eba65b827d344 582b9801698c0c1614dbbae73c409efb a64b3278cc8f8b75e3c86b6a1faa6686 ca250f3c7a3098964a89d879333ac7c8 ed5458de272171feee479c355a |
| md5 | a7bda9b5c579254114fab05ec751918c | 03f36ad20a3492060c9dc14d80 71d8b4c4411f7ffa89919a3251e6e5cb a7bda9b5c579254114fab05ec751918c e58cfbc6e0602681ff1841afadad4cc6 7e4e49d74b59cc9cc1471e33e5 |
| md5 | a93d1d5c2cb9c728fda3a5beaf0a0ffc | c6e0602681ff1841afadad4cc6 7e4e49d74b59cc9cc1471e33e50475d3 a93d1d5c2cb9c728fda3a5beaf0a0ffc 455997E42E20C8256A494FA5556F7333 7ead1fbba01a76467d63c4a216 |
| md5 | a99b7ef095f44cf35453465c64f0c70c | sdata.dat Script for exploiting Atlassian Confluence Server a99b7ef095f44cf35453465c64f0c70c check.vm, r.vm 199b4c116ac14964e9646b2f27595156 r.vm macOS |
| md5 | ab09f6a249ca88d1a036eee7a02cdd16 | addresses. We’ve seen that one of the Manuscrypt variants (ab09f6a249ca88d1a036eee7a02cdd16) shares a similar configuration structure with the MATA fra |
| md5 | ab2a98d3564c6bf656b8347681ecc2be | 31206cd7f80de4f6d86399c079 65632998063ff116417b04b65fdebdfb ab2a98d3564c6bf656b8347681ecc2be e3dee2d65512b99a362a1dbf6726ba9c fea3a39f97c00a6c8a589ff48b |
| md5 | b5d85cfaece7da5ed20d8eb2c9fa477c | 5ea344b1c849ead7ca5a82ac94 bf2765175d6fce7069cdb164603bd7dc b5d85cfaece7da5ed20d8eb2c9fa477c 6145fa69a6e42a0bf6a8f7c12005636b 2b8ff2a971555390b37f75cb07 |
| md5 | bea49839390e4f1eb3cb38d0fcaf897e | 95d385bac77e7 f50a0cd229b7bf57fcbd67ccfa8a5147 Windows MATA bea49839390e4f1eb3cb38d0fcaf897e rdata.dat 8910bdaaa6d3d40e9f60523d3a34f914 sdata.dat 6a066c |
| md5 | bf2765175d6fce7069cdb164603bd7dc | bba01a76467d63c4a216cf2902 7d80175ea344b1c849ead7ca5a82ac94 bf2765175d6fce7069cdb164603bd7dc b5d85cfaece7da5ed20d8eb2c9fa477c 6145fa69a6e42a0bf6a8f7c120 |
| md5 | ca250f3c7a3098964a89d879333ac7c8 | 01698c0c1614dbbae73c409efb a64b3278cc8f8b75e3c86b6a1faa6686 ca250f3c7a3098964a89d879333ac7c8 ed5458de272171feee479c355ab4a9f3 f0e87707fd0462162e1aecb6b4 |
| md5 | d2f94e178c254669fb9656d5513356d2 | a.dat 80c0efb9e129f7f9b05a783df6959812 ldata.dat, mdata.dat d2f94e178c254669fb9656d5513356d2 mdata.dat Linux log collector 982bf527b9fe16205fea606d1beed |
| md5 | da50a7a05abffb806f4a60c461521f41 | f853fe51e3398ef773d016a4a8 228998f29864603fd4966cadd0be77fc da50a7a05abffb806f4a60c461521f41 ec05817e19039c2f6cc2c021e2ea0016 Registry path HKLM\Softwar |
| md5 | e3dee2d65512b99a362a1dbf6726ba9c | 98063ff116417b04b65fdebdfb ab2a98d3564c6bf656b8347681ecc2be e3dee2d65512b99a362a1dbf6726ba9c fea3a39f97c00a6c8a589ff48bcc5a8c 2cd1f7f17153880fd80eba65b8 |
| md5 | e58cfbc6e0602681ff1841afadad4cc6 | c4411f7ffa89919a3251e6e5cb a7bda9b5c579254114fab05ec751918c e58cfbc6e0602681ff1841afadad4cc6 7e4e49d74b59cc9cc1471e33e50475d3 a93d1d5c2cb9c728fda3a5beaf |
| md5 | e883bf5fd22eb6237eb84d80bbcf2ac9 | 7b9fe16205fea606d1beed7fa hdata.dat Open-source Linux SoCat e883bf5fd22eb6237eb84d80bbcf2ac9 sdata.dat Script for exploiting Atlassian Confluence Server |
| md5 | ec05817e19039c2f6cc2c021e2ea0016 | f29864603fd4966cadd0be77fc da50a7a05abffb806f4a60c461521f41 ec05817e19039c2f6cc2c021e2ea0016 Registry path HKLM\Software\Microsoft\KxtNet HKLM\Software\ |
| md5 | ed5458de272171feee479c355ab4a9f3 | 78cc8f8b75e3c86b6a1faa6686 ca250f3c7a3098964a89d879333ac7c8 ed5458de272171feee479c355ab4a9f3 f0e87707fd0462162e1aecb6b4a53a89 f1ca9c730c8b5169fe095d385b |
| md5 | f05437d510287448325bac98a1378de1 | vm macOS MATA 81f8f0526740b55fe484c42126cd8396 TinkaOTP.dmg f05437d510287448325bac98a1378de1 SubMenu.nib C2 address 104.232.71.7:443 107.172.197.175:443 |
| md5 | f0e87707fd0462162e1aecb6b4a53a89 | 3c7a3098964a89d879333ac7c8 ed5458de272171feee479c355ab4a9f3 f0e87707fd0462162e1aecb6b4a53a89 f1ca9c730c8b5169fe095d385bac77e7 f50a0cd229b7bf57fcbd67ccfa |
| md5 | f1ca9c730c8b5169fe095d385bac77e7 | de272171feee479c355ab4a9f3 f0e87707fd0462162e1aecb6b4a53a89 f1ca9c730c8b5169fe095d385bac77e7 f50a0cd229b7bf57fcbd67ccfa8a5147 Windows MATA bea49839390e4 |
| md5 | f364b46d8aafff67271d350b8271505a | alicious documents, Trojans, emails, decoys) Windows Loader f364b46d8aafff67271d350b8271505a 85dcea03016df4880cebee9a70de0c02 1060702fe4e670eda8c0433c59 |
| md5 | f50a0cd229b7bf57fcbd67ccfa8a5147 | 07fd0462162e1aecb6b4a53a89 f1ca9c730c8b5169fe095d385bac77e7 f50a0cd229b7bf57fcbd67ccfa8a5147 Windows MATA bea49839390e4f1eb3cb38d0fcaf897e rdata.dat 891 |
| md5 | fea3a39f97c00a6c8a589ff48bcc5a8c | d3564c6bf656b8347681ecc2be e3dee2d65512b99a362a1dbf6726ba9c fea3a39f97c00a6c8a589ff48bcc5a8c 2cd1f7f17153880fd80eba65b827d344 582b9801698c0c1614dbbae73c |
From the original article
8 min read at securelist.com
As the IT and OT environment becomes more complex, adversaries are quick to adapt their attack strategy. For example, as users’ work environments diversify, adversaries are busy acquiring the TTPs to infiltrate systems. Recently, we reported to our Threat Intelligence Portal customers a similar malware framework that internally we called MATA.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.