Malwarehigh
Threat Actors Target Government of Belarus Using CMSTAR Trojan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files | — | 97% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | mia.by | s Control Department, Ministry of Foreign Affairs ablameiko@mia[.]by Unknown. Likely used by the Ministry of Internal Affairs |
| domain | oeiowidfla22.com | ommunication, connecting to the following host on port 443: oeiowidfla22[.]com After the initial connection is established, BYEBY will c |
| ipv4 | 108.61.175.110 | Ij5NaH.dat http://45.77.60[.]138/jVJlw3wp379neaJ.dat http://108.61.175[.]110/tlhXVFeBvT64LC9.dat http://45.77.60[.]138/HJDBvnJ7wc4S5qZ |
| ipv4 | 45.76.80.32 | sYCw5j.dat http://45.77.60[.]138/UScHrzGWbXb01gv.dat http://45.76.80[.]32/tYD7jzfVNZqMfye.dat http://45.77.60[.]138/liW0ecpxEWCfIgU |
| ipv4 | 45.77.60.138 | 66c2a CMSTAR Download Locations in Phishing Campaign http://45.77.60[.]138/YXza9HkKWzqtXlt.dat http://45.77.60[.]138/mePVDjnAZsYCw5j |
| sha256 | 09890dc8898b99647cdc1cceb97e764b6a88d55b5a520c8d0ea3bfd8f75ed83b | b381bc3722304ab1a21a21e082583bf6b88b84e7f65c4fdda48971c20a2 09890dc8898b99647cdc1cceb97e764b6a88d55b5a520c8d0ea3bfd8f75ed83b fd22973451b88a4d10d9f485baef7f5e7a6f2cb9ce0826953571bd8f5d8 |
| sha256 | 16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5 | fc16ae785834908f024fb3ddd4d9d62b29675859a8e737e3b949e85327a 16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5 6843d183b41b6b22976fc8d85e448dcc4d2e0bd2c159e6d966bfd4afa1c |
| sha256 | 2008ec82cec0b62bdb4d2cea64ff5a159a4327a058dfd867f877536389a72fb6 | e5921b0dfff9045ada7e775c1755e6ea44eab55da7ccc362f2a70ce26a6 2008ec82cec0b62bdb4d2cea64ff5a159a4327a058dfd867f877536389a72fb6 cecd72851c265f885ff02c60cbc3e6cbf1a40b298274761f623dfa44782 |
| sha256 | 2a0169c72c84e6d3fa49af701fd46ee7aaf1d1d9e107798d93a6ca8df5d25957 | f9aa617e7060779bc217a42372e99d59dc88f8ea2f3b9f45aacf3ba7209 2a0169c72c84e6d3fa49af701fd46ee7aaf1d1d9e107798d93a6ca8df5d25957 4da6ce5921b0dfff9045ada7e775c1755e6ea44eab55da7ccc362f2a70c |
| sha256 | 2c8267192b196bf8a92c8b72d52096e46e307fa4d4dafdc030d3e0f5b4145e9e | 8ecdeceba83396c98370f8f458ea7f7a935aabbcc3d41b80d4e85746357 2c8267192b196bf8a92c8b72d52096e46e307fa4d4dafdc030d3e0f5b4145e9e 2debf12b1cb1291cbd096b24897856948734fa62fd61a1f24d379b4224b |
| sha256 | 2debf12b1cb1291cbd096b24897856948734fa62fd61a1f24d379b4224bda212 | 7192b196bf8a92c8b72d52096e46e307fa4d4dafdc030d3e0f5b4145e9e 2debf12b1cb1291cbd096b24897856948734fa62fd61a1f24d379b4224bda212 79b30634075896084135b9891c42fca8a59db1c0c731e445940671efab9 |
| sha256 | 3c3efa89d1dd39e1112558af38ba656e048be842a3bedb7933cdd4210025f791 | 183b41b6b22976fc8d85e448dcc4d2e0bd2c159e6d966bfd4afa1cd9221 3c3efa89d1dd39e1112558af38ba656e048be842a3bedb7933cdd4210025f791 b2bebb381bc3722304ab1a21a21e082583bf6b88b84e7f65c4fdda48971 |
| sha256 | 4da6ce5921b0dfff9045ada7e775c1755e6ea44eab55da7ccc362f2a70ce26a6 | 9c72c84e6d3fa49af701fd46ee7aaf1d1d9e107798d93a6ca8df5d25957 4da6ce5921b0dfff9045ada7e775c1755e6ea44eab55da7ccc362f2a70ce26a6 2008ec82cec0b62bdb4d2cea64ff5a159a4327a058dfd867f877536389a |
| sha256 | 65d5ef9aa617e7060779bc217a42372e99d59dc88f8ea2f3b9f45aacf3ba7209 | Compromise CMSTAR Variants Identified in Phishing Campaign 65d5ef9aa617e7060779bc217a42372e99d59dc88f8ea2f3b9f45aacf3ba7209 2a0169c72c84e6d3fa49af701fd46ee7aaf1d1d9e107798d93a6ca8df5d |
| sha256 | 6843d183b41b6b22976fc8d85e448dcc4d2e0bd2c159e6d966bfd4afa1cd9221 | c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5 6843d183b41b6b22976fc8d85e448dcc4d2e0bd2c159e6d966bfd4afa1cd9221 3c3efa89d1dd39e1112558af38ba656e048be842a3bedb7933cdd421002 |
| sha256 | 79b30634075896084135b9891c42fca8a59db1c0c731e445940671efab9a0b61 | 12b1cb1291cbd096b24897856948734fa62fd61a1f24d379b4224bda212 79b30634075896084135b9891c42fca8a59db1c0c731e445940671efab9a0b61 b0065fc16ae785834908f024fb3ddd4d9d62b29675859a8e737e3b949e8 |
| sha256 | b0065fc16ae785834908f024fb3ddd4d9d62b29675859a8e737e3b949e85327a | 634075896084135b9891c42fca8a59db1c0c731e445940671efab9a0b61 b0065fc16ae785834908f024fb3ddd4d9d62b29675859a8e737e3b949e85327a 16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af |
| sha256 | b2bebb381bc3722304ab1a21a21e082583bf6b88b84e7f65c4fdda48971c20a2 | a89d1dd39e1112558af38ba656e048be842a3bedb7933cdd4210025f791 b2bebb381bc3722304ab1a21a21e082583bf6b88b84e7f65c4fdda48971c20a2 09890dc8898b99647cdc1cceb97e764b6a88d55b5a520c8d0ea3bfd8f75 |
| sha256 | cecd72851c265f885ff02c60cbc3e6cbf1a40b298274761f623dfa44782a01f8 | c82cec0b62bdb4d2cea64ff5a159a4327a058dfd867f877536389a72fb6 cecd72851c265f885ff02c60cbc3e6cbf1a40b298274761f623dfa44782a01f8 d8c0f8ecdeceba83396c98370f8f458ea7f7a935aabbcc3d41b80d4e857 |
| sha256 | d8c0f8ecdeceba83396c98370f8f458ea7f7a935aabbcc3d41b80d4e85746357 | 2851c265f885ff02c60cbc3e6cbf1a40b298274761f623dfa44782a01f8 d8c0f8ecdeceba83396c98370f8f458ea7f7a935aabbcc3d41b80d4e85746357 2c8267192b196bf8a92c8b72d52096e46e307fa4d4dafdc030d3e0f5b41 |
| sha256 | fd22973451b88a4d10d9f485baef7f5e7a6f2cb9ce0826953571bd8f5d866c2a | dc8898b99647cdc1cceb97e764b6a88d55b5a520c8d0ea3bfd8f75ed83b fd22973451b88a4d10d9f485baef7f5e7a6f2cb9ce0826953571bd8f5d866c2a CMSTAR Download Locations in Phishing Campaign http://45.77 |
From the original article
13 min read at unit42.paloaltonetworks.com
Palo Alto Networks Unit 42 has identified a series of phishing emails containing updated versions of the previously discussed CMSTAR malware family targeting various government entities in the country of Belarus. We first reported on CMSTAR in spear phishing attacks in spring of 2015 and later in 2016 .
By Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.