Data breachcritical
Sofacy APT hits high profile targets with updated toolset
- CVEs
- CVE-2015-2590
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2590 | Remote Code Execution Vulnerability in Oracle Java SE and Java SE Embedded | — | 25% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | drivres-update.info | he module contains the following hardcoded C2 server names: drivres-update[.]info softupdates[.]info The module uses a hardcoded URL (“ /ch |
| domain | intelnetservice.com | ardcoded in the configuration block of the main binary are: intelnetservice[.]com intelsupport[.]net The export called “ Applicate ” runs a |
| domain | intelsupport.net | uration block of the main binary are: intelnetservice[.]com intelsupport[.]net The export called “ Applicate ” runs a standard Windows a |
| domain | softupdates.info | following hardcoded C2 server names: drivres-update[.]info softupdates[.]info The module uses a hardcoded URL (“ /check/ “) for sending |
| md5 | 0369620eb139c3875a62e36bb7abdae8 | sources) File size: 50,176 bytes File format: PE32 EXE MD5: 0369620eb139c3875a62e36bb7abdae8 Linker version: 10.0, Microsoft Visual Studio Linker timest |
| md5 | 8b238931a7f64fddcad3057a96855f6c | ESET . One example of the new Sofacy USBSTEALER modules is 8b238931a7f64fddcad3057a96855f6c, which is named internally as msdetltemp.dll. This data the |
| md5 | 8c4d896957c36ec4abeb07b2802268b9 | . It has been modified to drop a separate C&C helper, (md5: 8C4D896957C36EC4ABEB07B2802268B9) as “ tf394kv.dll “. The dropped “ tf394kv.dll ” file is an |
| md5 | 8cb08140ddb00ac373d29d37657a03cc | directories on removable drives, i.e. the sample with md5: 8cb08140ddb00ac373d29d37657a03cc. The configuration file is loaded from the same directory a |
| md5 | 9d2f9e19db8c20dc0d20d50869c7a373 | had compiled and delivered another AZZY x64 backdoor (md5: 9D2F9E19DB8C20DC0D20D50869C7A373, compiled August 4th, 2015). This was no longer detectable |
| md5 | a96f4b8ac7aa9dbf4624424b7602d4f7 | of defense contractors. The sample used in this attack (md5 A96F4B8AC7AA9DBF4624424B7602D4F7, compiled July 29th, 2015) was a pretty standard Sofacy x64 |
| md5 | c3ae4a37094ecfe95c2badecf40bf5bb | nalysis File format: PE32 EXE File size: 142,336 bytes MD5: c3ae4a37094ecfe95c2badecf40bf5bb Linker version: 11.0, Microsoft Visual Studio Linker timest |
| md5 | ce151285e8f0e7b2b90162ba171a4b90 | size: 76,288 bytes MD5s: 8b238931a7f64fddcad3057a96855f6c, ce151285e8f0e7b2b90162ba171a4b90 Linker version: 11.0, Microsoft Visual Studio Linker timest |
| md5 | ce8b99df8642c065b6af43fde1f786a3 | as “ AppData\Local\Microsoft\Windows\msdeltemp.dll ” (md5: CE8B99DF8642C065B6AF43FDE1F786A3). The top level malware, CE8B99DF8642C065B6AF43FDE1F786A3 ( |
| md5 | f6f88caf49a3e32174387cacfa144a89 | “cmd /c DEL %path to self% “ The MD5 of the dropped file is f6f88caf49a3e32174387cacfa144a89 Dropper payload – downloader DLL Internal name: msdetltemp. |
From the original article
12 min read at securelist.com
Sofacy (also known as “Fancy Bear”, “Sednit”, “STRONTIUM” and “APT28”) is an advanced threat group that has been active since around 2008, targeting mostly military and government entities worldwide, with a focus on NATO countries. More recently, we have also seen an increase in activity targeting Ukraine.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.