Threat actorcritical
The Epic Turla Operation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-1723 | Remote Arbitrary Code Execution in Oracle Java SE (Hotspot Component) | — | 94% | KEVRansomware | — KEV |
| CVE-2013-3346 | Memory Corruption RCE in Adobe Reader and Acrobat | — | 79% | KEV | — KEV |
| CVE-2013-5065 | Local Privilege Escalation in Microsoft Windows Kernel (NDProxy.sys) | — | 35% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | arshinmalalan.com | e Java exploits has the following C&C hardcoded inside: www.arshinmalalan[.]com/themes/v6/templates/css/in.php This C&C is still online a |
| domain | hadilotfi.com | xxp://homaxcompany[.]com/components/com_sitemap/ hxxp://www.hadilotfi[.]com/wp-content/themes/profile/ A full list with all the C&C s |
| domain | homaxcompany.com | a generic internal ID of 1156fd22-3443-4344-c4ffff : hxxp://homaxcompany[.]com/components/com_sitemap/ hxxp://www.hadilotfi[.]com/wp-con |
| domain | losguayaberos.com | 0db018c320e80865f Note: the command and control servers www.losguayaberos[.]com and thebesttothbrushes[.]com have been sinkholed by Kaspe |
| domain | mfa.tj | try of Foreign Affairs of Tajikistan’s website, at “ hxxp://mfa[.]tj/upload/security.php “. The file is a .NET application tha |
| domain | servehttp.com | recovered from one of the mothership servers (at newsforum.servehttp[.]com/wordpress/wp-includes/css/img/upload.php , MD5: 4dc22c169 |
| domain | thebesttothbrushes.com | the command and control servers www.losguayaberos[.]com and thebesttothbrushes[.]com have been sinkholed by Kaspersky Lab. Other packages deli |
| md5 | 030f5fdb78bfc1ce7b459d3cc2cf1877 | ng to trick the user into running a fake Flash Player (MD5: 030f5fdb78bfc1ce7b459d3cc2cf1877): In at least one case, they tried to trick the user into d |
| md5 | 071d3b60ebec2095165b6879e41211f2 | 08 11:05:35 2012 another example: Size: 218,112 bytes MD5: 071d3b60ebec2095165b6879e41211f2 Compiled: Thu Nov 08 11:04:39 2012 This backdoor is more so |
| md5 | 0f76ef2e6572befdc2ca1ca2ab15e5a1 | victims include: MD5: c7617251d523f3bc4189d53df1985ca9 MD5: 0f76ef2e6572befdc2ca1ca2ab15e5a1 These top level packages deploy both updated Epic backdoors |
| md5 | 1369fee289fe7798a02cde100a5e91d8 | o the victim’s machine is “winrs.exe”: Name: winrs.exe MD5: 1369fee289fe7798a02cde100a5e91d8 This is an UPX packed binary, which contains the genuine “d |
| md5 | 15060a4b998d8e288589d31ccd230f86 | 03c79 allj.jar f41077c4734ef27dec41c89223136cf8 allj64.html 15060a4b998d8e288589d31ccd230f86 allj64.jar e481f5ea90d684e5986e70e6338539b4 lstj.jar 21cbc1 |
| md5 | 21cbc17b28126b88b954b3b123958b46 | 230f86 allj64.jar e481f5ea90d684e5986e70e6338539b4 lstj.jar 21cbc17b28126b88b954b3b123958b46 lstj.html acae4a875cd160c015adfdea57bd62c4 The Java files e |
| md5 | 244505129d96be57134cb00f27d4359c | 0b24d8744ad84d80e8 161 91a5594343b47462ebd6266a9c40abbe 162 244505129d96be57134cb00f27d4359c 164 4ae7e6011b550372d2a73ab3b4d67096 165 The Carbon system |
| md5 | 43e896ede6fe025ee90f7f27c6d376a4 | t: MD5 Resource number 4c1017de62ea4788c7c8058a8f825a2d 101 43e896ede6fe025ee90f7f27c6d376a4 102 e6d1dcc6c2601e592f2b03f35b06fa8f 104 554450c1ecb925693f |
| md5 | 4ae7e6011b550372d2a73ab3b4d67096 | 62ebd6266a9c40abbe 162 244505129d96be57134cb00f27d4359c 164 4ae7e6011b550372d2a73ab3b4d67096 165 The Carbon system is in essence an extensible platform, |
| md5 | 4c1017de62ea4788c7c8058a8f825a2d | following modules, both 32 and 64 bit: MD5 Resource number 4c1017de62ea4788c7c8058a8f825a2d 101 43e896ede6fe025ee90f7f27c6d376a4 102 e6d1dcc6c2601e592f |
| md5 | 4dc22c1695d1f275c3b6e503a1b171f5 | ehttp[.]com/wordpress/wp-includes/css/img/upload.php , MD5: 4dc22c1695d1f275c3b6e503a1b171f5 , Compiled: Thu Sep 06 14:09:55 2012) contains two modules, |
| md5 | 536eca0defc14eff0a38b64c74e03c79 | did manage to obtain the Java exploits: Name MD5 allj.html 536eca0defc14eff0a38b64c74e03c79 allj.jar f41077c4734ef27dec41c89223136cf8 allj64.html 15060 |
| md5 | 554450c1ecb925693fedbb9e56702646 | 5ee90f7f27c6d376a4 102 e6d1dcc6c2601e592f2b03f35b06fa8f 104 554450c1ecb925693fedbb9e56702646 105 df230db9bddf200b24d8744ad84d80e8 161 91a5594343b47462eb |
| md5 | 7731d42b043865559258464fe1c98513 | rypted resource. This drops the malicious file with the MD5 7731d42b043865559258464fe1c98513 . This is an Epic backdoor which connects to the following |
| md5 | 89b0f1a3a667e5cd43f5670e12dba411 | and running a fake Microsoft Security Essentials app (MD5: 89b0f1a3a667e5cd43f5670e12dba411): The fake application is signed by a valid digital certifi |
| md5 | 91a5594343b47462ebd6266a9c40abbe | 693fedbb9e56702646 105 df230db9bddf200b24d8744ad84d80e8 161 91a5594343b47462ebd6266a9c40abbe 162 244505129d96be57134cb00f27d4359c 164 4ae7e6011b550372d2 |
| md5 | a3cbf6179d437909eb532b7319b3dafe | nuProgramsStartupwinsvclg.exe ” is: Name: winsvclg.exe MD5: a3cbf6179d437909eb532b7319b3dafe Compiled: Tue Oct 02 13:51:50 2012 This is a keylogger tool |
| md5 | acae4a875cd160c015adfdea57bd62c4 | 38539b4 lstj.jar 21cbc17b28126b88b954b3b123958b46 lstj.html acae4a875cd160c015adfdea57bd62c4 The Java files exploit a popular vulnerability, CVE-2012-17 |
| md5 | af3e8be26c63c4dd066935629cf9bac8 | ted; the password is checked against an MD5 hash: The MD5 “ af3e8be26c63c4dd066935629cf9bac8 ” has been solved by Kaspersky Lab as the password “kenpach |
| md5 | c0c03b71684eb0545ef9182f5f9928ca | e genuine “dnsquery.exe” tool from Microsoft, unpacked MD5: c0c03b71684eb0545ef9182f5f9928ca . In several cases, an interesting update has been observed |
| md5 | c7617251d523f3bc4189d53df1985ca9 | Lab. Other packages delivered to the victims include: MD5: c7617251d523f3bc4189d53df1985ca9 MD5: 0f76ef2e6572befdc2ca1ca2ab15e5a1 These top level packa |
| md5 | cb1b68d9971c2353c2d6a8119c49b51f | pper from these packages has the following properties: MD5: cb1b68d9971c2353c2d6a8119c49b51f This is called internally by the authors “Carbon System”, p |
| md5 | d7ca9cf72753df7392bfeea834bcf992 | yload dropped by these Java exploits is the following: MD5: d7ca9cf72753df7392bfeea834bcf992 The Java exploit use a special loader that attempts to inje |
| md5 | df230db9bddf200b24d8744ad84d80e8 | 592f2b03f35b06fa8f 104 554450c1ecb925693fedbb9e56702646 105 df230db9bddf200b24d8744ad84d80e8 161 91a5594343b47462ebd6266a9c40abbe 162 244505129d96be5713 |
| md5 | e481f5ea90d684e5986e70e6338539b4 | cf8 allj64.html 15060a4b998d8e288589d31ccd230f86 allj64.jar e481f5ea90d684e5986e70e6338539b4 lstj.jar 21cbc17b28126b88b954b3b123958b46 lstj.html acae4a8 |
| md5 | e6d1dcc6c2601e592f2b03f35b06fa8f | 88c7c8058a8f825a2d 101 43e896ede6fe025ee90f7f27c6d376a4 102 e6d1dcc6c2601e592f2b03f35b06fa8f 104 554450c1ecb925693fedbb9e56702646 105 df230db9bddf200b24 |
| md5 | e9580b6b13822090db018c320e80865f | m a different, yet related family. Size: 275,968 bytes MD5: e9580b6b13822090db018c320e80865f Compiled: Thu Nov 08 11:05:35 2012 another example: Size: 2 |
| md5 | f41077c4734ef27dec41c89223136cf8 | ame MD5 allj.html 536eca0defc14eff0a38b64c74e03c79 allj.jar f41077c4734ef27dec41c89223136cf8 allj64.html 15060a4b998d8e288589d31ccd230f86 allj64.jar e48 |
| url | http://busandcoachdirectory.com.au | nt although it redirects to a currently suspended page at “ hxxp://busandcoachdirectory.com[.]au “. For a full list of C&C servers, please see the Appendi |
| url | http://homaxcompany.com/components/com_sitemap/ | , with a generic internal ID of 1156fd22-3443-4344-c4ffff : hxxp://homaxcompany[.]com/components/com_sitemap/ hxxp://www.hadilotfi[.]com/wp-content/themes/profile/ A f |
| url | http://mfa.tj/upload/security.php | e Ministry of Foreign Affairs of Tajikistan’s website, at “ hxxp://mfa[.]tj/upload/security.php “. The file is a .NET application that contains an encryp |
| url | http://www.hadilotfi.com/wp-content/themes/profile/ | -c4ffff : hxxp://homaxcompany[.]com/components/com_sitemap/ hxxp://www.hadilotfi[.]com/wp-content/themes/profile/ A full list with all the C&C server URLs that we recovere |
From the original article
13 min read at securelist.com
Over the last 10 months, Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call “Epic Turla”. The attackers behind Epic Turla have infected several hundred computers in more than 45 countries, including government institutions, embassies, military, education, research and pharmaceutical companies.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.