Operation Ke3chang Resurfaces With New TidePool Malware

Palo Alto Unit 42by Micah Yates, Mike Scott, Brandon Levene, Jen Miller-OsbornMay 22, 2020 · 04:11 UTC (May 22, 2020)7 min read2 · 1 read

Read at unit42.paloaltonetworks.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2015-2545

Tags: cve-2015-2545 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2015-2545	Malformed EPS Image RCE in Microsoft Office	—	86%	KEV	— KEV Mar 3, 2022

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

7 min read at unit42.paloaltonetworks.com

Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago. However, Unit 42 has recently discovered the actors have continued to evolve their custom malware arsenal. We’ve discovered a new malware family we’ve named TidePool.

Palo Alto Unit 42

By Micah Yates, Mike Scott, Brandon Levene, Jen Miller-Osborn · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
domain	strangled.net	f8d95dd11ebbb945dda3d72aac512512b48ad93ba C2 domain: goback.strangled[.]net TidePool sample groupings Group 1: 3/1/2012 - 3/22/2012 7
sha256	012fe5fa86340a90055f7ab71e1e9989db8e7bb7594cd9c8c737c3a6231bc8cc	80c9c9bd2dba5b694863704ef37643255797b41f 2013 post Ke3chang 012fe5fa86340a90055f7ab71e1e9989db8e7bb7594cd9c8c737c3a6231bc8cc 2014 post Ke3chang 04db80d8da9cd927e7ee8a44bfa3b4a5a126b15d
sha256	023e8f5922b7b0fcfe86f9196ae82a2abbc6f047c505733c4b0a732caf30e966	873b6dc4613ba4d6a6059610fa1 Group 3: 8/28/2012 - 11/19/2012 023e8f5922b7b0fcfe86f9196ae82a2abbc6f047c505733c4b0a732caf30e966(BS2005) 064051e462990b0a530b7bbd5e46b68904a264caee9d825e542
sha256	04db80d8da9cd927e7ee8a44bfa3b4a5a126b15d431cbe64a508d4c2e407ec05	1e1e9989db8e7bb7594cd9c8c737c3a6231bc8cc 2014 post Ke3chang 04db80d8da9cd927e7ee8a44bfa3b4a5a126b15d431cbe64a508d4c2e407ec05 2014 post Ke3chang eca724dd63cf7e98ff09094e05e4a79e9f8f2126
sha256	064051e462990b0a530b7bbd5e46b68904a264caee9d825e54245d8c854e7a8a	0fcfe86f9196ae82a2abbc6f047c505733c4b0a732caf30e966(BS2005) 064051e462990b0a530b7bbd5e46b68904a264caee9d825e54245d8c854e7a8a(BS2005) 07aa6f24cec12b3780ebaba2ca756498e3110243ca82dca018b
sha256	07aa6f24cec12b3780ebaba2ca756498e3110243ca82dca018b02bd099da36bb	b0a530b7bbd5e46b68904a264caee9d825e54245d8c854e7a8a(BS2005) 07aa6f24cec12b3780ebaba2ca756498e3110243ca82dca018b02bd099da36bb(BS2005) cdb8a15ededa8b4dee4e9b04a00b10bf4b6504b9a05a25ecae0
sha256	0ec913017c0adc255f451e8f38956cfc1877e1c3830e528b0eb38964e7dd00ff	5b4caf36d00b255fdaccb542b33b3a7d12aef9939e35fdb1c5f06c2d69c 0ec913017c0adc255f451e8f38956cfc1877e1c3830e528b0eb38964e7dd00ff Post Fireye's Ke3chang blog Group 5: 5/2/2013 - 10/23/2013
sha256	0f88602a11963818b73a52f00a4f670a0bf5111b49549aa13682b66dd9895155	5fa86340a90055f7ab71e1e9989db8e7bb7594cd9c8c737c3a6231bc8cc 0f88602a11963818b73a52f00a4f670a0bf5111b49549aa13682b66dd9895155 2a454d9577d75ac76f5acf0082a6dca37be41f7c74e0a4dbd41d8a9a751
sha256	12cc0fdc4f80942f0ba9039a22e701838332435883fa62d0cefd3992867a9e88	bfd69405dded13c3a6ceb5abe4d27 Group 2: 6/1/2012 - 7/10/2012 12cc0fdc4f80942f0ba9039a22e701838332435883fa62d0cefd3992867a9e88(BS2005) a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b53
sha256	1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51	eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5 1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51 de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703
sha256	2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18	4a79e9f8f2126af3a41ff5144929f8fede4b4 2015 Current TidePool 2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18 Starting with a known Operation Ke3chang BS2005 sample, we
sha256	233bd004ad778b7fd816b80380c9c9bd2dba5b694863704ef37643255797b41f	on and usage we looked at: BS2005 Operation Ke3chang sample 233bd004ad778b7fd816b80380c9c9bd2dba5b694863704ef37643255797b41f 2013 post Ke3chang 012fe5fa86340a90055f7ab71e1e9989db8e7bb7
sha256	25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5abe4d27	1d5f86b3a9585cca42a7785b0ff0d50cd1b61a56c811d854f5f02909a5d 25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5abe4d27 Group 2: 6/1/2012 - 7/10/2012 12cc0fdc4f80942f0ba9039a22e70
sha256	2a454d9577d75ac76f5acf0082a6dca37be41f7c74e0a4dbd41d8a9a75120f5c	02a11963818b73a52f00a4f670a0bf5111b49549aa13682b66dd9895155 2a454d9577d75ac76f5acf0082a6dca37be41f7c74e0a4dbd41d8a9a75120f5c 66d9001b6107e16cdb4275672e8dd21b3263481a56f461428909a7c265c
sha256	3795fd3e1fe4eb8a56d611d65797e3947acb209ddb2b65551bf067d8e1fa1945	b7fd816b80380c9c9bd2dba5b694863704ef37643255797b41f(BS2005) 3795fd3e1fe4eb8a56d611d65797e3947acb209ddb2b65551bf067d8e1fa1945(BS2005) 6d744f8a79e0e937899dbc90b933226e814fa226695a7f0953e
sha256	38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f	b37948656b1fb93b12a266e8de82c6c668e60e9fc TidePool Dropper: 38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f TidePool dlls: 67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a
sha256	39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966d610e0190f9297	50356111f394e5fc64ac54d5a07d9bc57852315484c2046093 (BS2005) 39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966d610e0190f9297 (BS2005) bfa5d062bfc1739e1fcfacefd3a1f95b40104c91201efc6188
sha256	4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5	ol is provided by TID 14588. TidePool IOCs Phishing emails: 4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5 1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b7
sha256	4e38848fabd0cb99a8b161f7f4972c080ce5990016212330d7bfbe08ab49526a	062bfc1739e1fcfacefd3a1f95b40104c91201efc618804b6eb9e30c018 4e38848fabd0cb99a8b161f7f4972c080ce5990016212330d7bfbe08ab49526a d097a1d5f86b3a9585cca42a7785b0ff0d50cd1b61a56c811d854f5f029
sha256	66d9001b6107e16cdb4275672e8dd21b3263481a56f461428909a7c265c67851	d9577d75ac76f5acf0082a6dca37be41f7c74e0a4dbd41d8a9a75120f5c 66d9001b6107e16cdb4275672e8dd21b3263481a56f461428909a7c265c67851 863ee162a18d429664443ce5c88a21fd629e22ad739191c7c6a9237f64c
sha256	67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed	9cdb9c530298c0c4936722975c4e7446544fd6dcac9f TidePool dlls: 67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed 2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c
sha256	690c4f474553a5da5b90fb43eab5db24f1f2086e6d6fd75105b54e616c490f3f	23fcd6e1d4b8fd18fe2a6d74d05638f1c27d70659fbf2dcc58 (BS2005) 690c4f474553a5da5b90fb43eab5db24f1f2086e6d6fd75105b54e616c490f3f d64cd5b4caf36d00b255fdaccb542b33b3a7d12aef9939e35fdb1c5f06c
sha256	6bcf242371315a895298dbe1cdec73805b463c13f9ce8556138fa4fa0a3ad242	98f7f9e3cf40540d774ab1819cddf352c5823d Group 10: 08/04/2015 6bcf242371315a895298dbe1cdec73805b463c13f9ce8556138fa4fa0a3ad242 Group 11: 12/28/2015 2252dcd1b6afacde3f94d9557811bb769c4f0a
sha256	6d744f8a79e0e937899dbc90b933226e814fa226695a7f0953e26a5b65838c89	b8a56d611d65797e3947acb209ddb2b65551bf067d8e1fa1945(BS2005) 6d744f8a79e0e937899dbc90b933226e814fa226695a7f0953e26a5b65838c89(BS2005) b344b9362ac274ca3547810c178911881ccb44b81847071fa84
sha256	6eb3528436c8005cfba21e88f498f7f9e3cf40540d774ab1819cddf352c5823d	bfa3b4a5a126b15d431cbe64a508d4c2e407ec05 Group 9: 3/11/2015 6eb3528436c8005cfba21e88f498f7f9e3cf40540d774ab1819cddf352c5823d Group 10: 08/04/2015 6bcf242371315a895298dbe1cdec73805b463c
sha256	71b548e09fd51250356111f394e5fc64ac54d5a07d9bc57852315484c2046093	net TidePool sample groupings Group 1: 3/1/2012 - 3/22/2012 71b548e09fd51250356111f394e5fc64ac54d5a07d9bc57852315484c2046093 (BS2005) 39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966
sha256	785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db	da5a5e727d99f407c8703db649 Weaponized document attachments: 785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e6
sha256	7c17ccdd8eba3791773de8bc05ab4854421bc3f2554c7ded00065c10698300fe	376aa93b6d17903f1f3d6a557eb91a977dae19b4358ef57e686cd52cc03 7c17ccdd8eba3791773de8bc05ab4854421bc3f2554c7ded00065c10698300fe Group 7: 08/26/2014 eca724dd63cf7e98ff09094e05e4a79e9f8f212
sha256	863ee162a18d429664443ce5c88a21fd629e22ad739191c7c6a9237f64cdd2f3	01b6107e16cdb4275672e8dd21b3263481a56f461428909a7c265c67851 863ee162a18d429664443ce5c88a21fd629e22ad739191c7c6a9237f64cdd2f3 8b3ef6112f833d6d232864cf66b57a0f513e0663ee118f8d33d93ad8651
sha256	89ccea68f76afa99d4b5d00d35b6d2f229c4af914fbb2763e37f5f87dcf2f7bf	92d7f90249be07bbf2602fe97488e2fef8d3e7285384c41b54e(BS2005) 89ccea68f76afa99d4b5d00d35b6d2f229c4af914fbb2763e37f5f87dcf2f7bf be378ad63b61b03bdc6fd3ef3b81d3c2d189602a24a960118e074d7aff2
sha256	8b3ef6112f833d6d232864cf66b57a0f513e0663ee118f8d33d93ad8651af330	162a18d429664443ce5c88a21fd629e22ad739191c7c6a9237f64cdd2f3 8b3ef6112f833d6d232864cf66b57a0f513e0663ee118f8d33d93ad8651af330 904e31e4ab030cba00b06216c81252f6ee189a2d044eca19d2c0dc41508
sha256	904e31e4ab030cba00b06216c81252f6ee189a2d044eca19d2c0dc41508512f3	6112f833d6d232864cf66b57a0f513e0663ee118f8d33d93ad8651af330 904e31e4ab030cba00b06216c81252f6ee189a2d044eca19d2c0dc41508512f3 Group 6: 03/09/2014 F3c39376aa93b6d17903f1f3d6a557eb91a977d
sha256	9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba	cd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18 9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba C2 domain: goback.strangled[.]net TidePool sample groupings
sha256	a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076	42f0ba9039a22e701838332435883fa62d0cefd3992867a9e88(BS2005) a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076(BS2005) c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4
sha256	b344b9362ac274ca3547810c178911881ccb44b81847071fa842ffc8edfcd6ec	937899dbc90b933226e814fa226695a7f0953e26a5b65838c89(BS2005) b344b9362ac274ca3547810c178911881ccb44b81847071fa842ffc8edfcd6ec(BS2005) e72c5703391d4b23fcd6e1d4b8fd18fe2a6d74d05638f1c27d7
sha256	be378ad63b61b03bdc6fd3ef3b81d3c2d189602a24a960118e074d7aff26c7bd	a68f76afa99d4b5d00d35b6d2f229c4af914fbb2763e37f5f87dcf2f7bf be378ad63b61b03bdc6fd3ef3b81d3c2d189602a24a960118e074d7aff26c7bd c5d274418532231a0a225fc1a659dd034f38fde051840f8ed39e0b960d8
sha256	bfa5d062bfc1739e1fcfacefd3a1f95b40104c91201efc618804b6eb9e30c018	a350ec5bd3de31b6649456993b3f9642f966d610e0190f9297 (BS2005) bfa5d062bfc1739e1fcfacefd3a1f95b40104c91201efc618804b6eb9e30c018 4e38848fabd0cb99a8b161f7f4972c080ce5990016212330d7bfbe08ab4
sha256	c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4d6a6059610fa1	e230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076(BS2005) c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4d6a6059610fa1 Group 3: 8/28/2012 - 11/19/2012 023e8f5922b7b0fcfe86f9196ae
sha256	c5d274418532231a0a225fc1a659dd034f38fde051840f8ed39e0b960d84c056	ad63b61b03bdc6fd3ef3b81d3c2d189602a24a960118e074d7aff26c7bd c5d274418532231a0a225fc1a659dd034f38fde051840f8ed39e0b960d84c056 Group 4: 4/18/2013 - 11/5/2013 233bd004ad778b7fd816b80380c9
sha256	cdb8a15ededa8b4dee4e9b04a00b10bf4b6504b9a05a25ecae0b0aca8df01ff9	b3780ebaba2ca756498e3110243ca82dca018b02bd099da36bb(BS2005) cdb8a15ededa8b4dee4e9b04a00b10bf4b6504b9a05a25ecae0b0aca8df01ff9(BS2005) f84a847c0086c92d7f90249be07bbf2602fe97488e2fef8d3e7
sha256	d097a1d5f86b3a9585cca42a7785b0ff0d50cd1b61a56c811d854f5f02909a5d	48fabd0cb99a8b161f7f4972c080ce5990016212330d7bfbe08ab49526a d097a1d5f86b3a9585cca42a7785b0ff0d50cd1b61a56c811d854f5f02909a5d 25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5ab
sha256	d64cd5b4caf36d00b255fdaccb542b33b3a7d12aef9939e35fdb1c5f06c2d69c	f474553a5da5b90fb43eab5db24f1f2086e6d6fd75105b54e616c490f3f d64cd5b4caf36d00b255fdaccb542b33b3a7d12aef9939e35fdb1c5f06c2d69c 0ec913017c0adc255f451e8f38956cfc1877e1c3830e528b0eb38964e7d
sha256	de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649	190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51 de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649 Weaponized document attachments: 785e8a39eb66e872ff5abee48b
sha256	e72c5703391d4b23fcd6e1d4b8fd18fe2a6d74d05638f1c27d70659fbf2dcc58	4ca3547810c178911881ccb44b81847071fa842ffc8edfcd6ec(BS2005) e72c5703391d4b23fcd6e1d4b8fd18fe2a6d74d05638f1c27d70659fbf2dcc58 (BS2005) 690c4f474553a5da5b90fb43eab5db24f1f2086e6d6fd75105
sha256	eca724dd63cf7e98ff09094e05e4a79e9f8f2126af3a41ff5144929f8fede4b4	bfa3b4a5a126b15d431cbe64a508d4c2e407ec05 2014 post Ke3chang eca724dd63cf7e98ff09094e05e4a79e9f8f2126af3a41ff5144929f8fede4b4 2015 Current TidePool 2252dcd1b6afacde3f94d9557811bb769c4f0
sha256	eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc	a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc TidePool Dropper: 38f2c86041e0446730479cdb9c530298c0c493672
sha256	f3c39376aa93b6d17903f1f3d6a557eb91a977dae19b4358ef57e686cd52cc03	81252f6ee189a2d044eca19d2c0dc41508512f3 Group 6: 03/09/2014 F3c39376aa93b6d17903f1f3d6a557eb91a977dae19b4358ef57e686cd52cc03 7c17ccdd8eba3791773de8bc05ab4854421bc3f2554c7ded00065c10698
sha256	f84a847c0086c92d7f90249be07bbf2602fe97488e2fef8d3e7285384c41b54e	b4dee4e9b04a00b10bf4b6504b9a05a25ecae0b0aca8df01ff9(BS2005) f84a847c0086c92d7f90249be07bbf2602fe97488e2fef8d3e7285384c41b54e(BS2005) 89ccea68f76afa99d4b5d00d35b6d2f229c4af914fbb2763e37