Vulnerabilityhigh
New activity of the Blue Termite APT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-5119 | Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray) | — | 99% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 021321e8c168ba3ae39ce3a2e7b3ec87 | ee347881c14 UPLOAD 8dff5f89b87ebf91a1ecc1dbed3a6fbb VERSION 021321e8c168ba3ae39ce3a2e7b3ec87 Commands supported by emdivi t20: command md5 abort 5bb94a1 |
| md5 | 0340b5e3f0d0ea71eeef6ab890270fc0 | e458d6afae9f hjlnk ebb0149209e008e3f87e26659aa9b173 loaddll 0340b5e3f0d0ea71eeef6ab890270fc0 md 793914c9c583d9d86d0f4ed8c521b0c1 mklnk a3bb50704b87da185 |
| md5 | 0800fc577294c34e0b28ad2839435945 | ffa0cbc6c37e4ce2 goto de94e676c0358eefea4794f03d6bda4f hash 0800fc577294c34e0b28ad2839435945 head 96e89a298e0a9f469b9ae458d6afae9f hjlnk ebb0149209e008e |
| md5 | 0a342b59ecdcede0571340b9ed11633f | 901e1c7d166a2a4 type 599dcce2998a6b40b1e38e8c6006cb0a unzip 0a342b59ecdcede0571340b9ed11633f upload 76ee3de97a1b8b903319b7c013d8c877 version 2af72f100c3 |
| md5 | 0b5396d6bd0867485ff63067ad9363e7 | bd3cbd937461c0 exit f24f62eeb789199b9b2e467df3b1876b exuser 0b5396d6bd0867485ff63067ad9363e7 get b5eda0a74558a342cf659187f06f746f getfile b24ba6d783f2aa |
| md5 | 12cba3ee81cf4a793796a51b6327c678 | 2e5d14deabab29f2aa cd 6865aeb3a9ed28f9a79ec454b259e5d0 copy 12cba3ee81cf4a793796a51b6327c678 dir 736007832d2167baaae763fd3a3f3cf1 diskls e120a254f254978 |
| md5 | 1e04875a872812e1f431283244b180d2 | 54a4e79d1d6 doabort 1f6dcc1149b2eef63f6dd4833d5ef0d3 downbg 1e04875a872812e1f431283244b180d2 downbg2 7f3e982a0d9b4aa5303332aaf414d457 download fd4564067 |
| md5 | 1f6dcc1149b2eef63f6dd4833d5ef0d3 | 3fd3a3f3cf1 diskls e120a254f254978fc265354a4e79d1d6 doabort 1f6dcc1149b2eef63f6dd4833d5ef0d3 downbg 1e04875a872812e1f431283244b180d2 downbg2 7f3e982a0d9 |
| md5 | 27dc2525548f8ab10a2532037a9657e0 | 354bb0d5353b screen 599eba19aa93a929cb8589f148b8a6c4 setcmd 27dc2525548f8ab10a2532037a9657e0 setlen 846a44d63b02c23bcfee5b4ccaa89d54 suspend 497927fb538 |
| md5 | 2af72f100c356273d46284f6fd1dfc08 | 0b9ed11633f upload 76ee3de97a1b8b903319b7c013d8c877 version 2af72f100c356273d46284f6fd1dfc08 zip adcdbd79a8d84175c229b192aadc02f2 They both store the md |
| md5 | 316713cb9f82ff9ade53712ab1cbf92c | e1897042568e post 42b90196b487c54069097a68fe98ab6f postfile 316713cb9f82ff9ade53712ab1cbf92c postfile2 f15ae485061a10adead43d7f5d5a9889 rd eeec033a2c4d5 |
| md5 | 3734a903022249b3010be1897042568e | d0f4ed8c521b0c1 mklnk a3bb50704b87da1858a46455dfb5e470 move 3734a903022249b3010be1897042568e post 42b90196b487c54069097a68fe98ab6f postfile 316713cb9f82 |
| md5 | 39cd12d51b236befc5f939a552181d73 | command md5 DOABORT d895d96bc3ae51944b29d53d599a2341 DOWNBG 39cd12d51b236befc5f939a552181d73 GETFILE 74a9d3a81b79eec0aa2f849cbc8a7efb GOTO 4b8bb3c94a967 |
| md5 | 3b42577bbd602934a728744f242ffe26 | 6906 f8d9af763e64c420ffa6e8930727f779 Hashes of emdivi t20: 3b42577bbd602934a728744f242ffe26 f07216c34689a9104b29bbdcba17325f C&Cs: hxxp://**********kin |
| md5 | 42b90196b487c54069097a68fe98ab6f | 58a46455dfb5e470 move 3734a903022249b3010be1897042568e post 42b90196b487c54069097a68fe98ab6f postfile 316713cb9f82ff9ade53712ab1cbf92c postfile2 f15ae48 |
| md5 | 48bb700b80557ee2e5cf06c90ba6698c | e4d7102e5b9 LOADDLL 67ca07ecb95c4055d2687815d0c0f8b9 SETCMD 48bb700b80557ee2e5cf06c90ba6698c SUSPEND ee93a0b023cef18b34ebfee347881c14 UPLOAD 8dff5f89b87 |
| md5 | 497927fb538c4a1572d3b3a98313cab1 | 2037a9657e0 setlen 846a44d63b02c23bcfee5b4ccaa89d54 suspend 497927fb538c4a1572d3b3a98313cab1 tasklist 6e0ad8e44cff1b5d2901e1c7d166a2a4 type 599dcce2998a |
| md5 | 4b8bb3c94a9676b5f34ace4d7102e5b9 | 939a552181d73 GETFILE 74a9d3a81b79eec0aa2f849cbc8a7efb GOTO 4b8bb3c94a9676b5f34ace4d7102e5b9 LOADDLL 67ca07ecb95c4055d2687815d0c0f8b9 SETCMD 48bb700b805 |
| md5 | 512d93c711f006891cbc124392c2e8d9 | s Hashes of flash exploit: f46019f795bd721262dc69988d7e53bc 512d93c711f006891cbc124392c2e8d9 Hashes of emdivi t17: b3bc4b5f17fd5f87ec3714c6587f6906 f8d9 |
| md5 | 599dcce2998a6b40b1e38e8c6006cb0a | b3a98313cab1 tasklist 6e0ad8e44cff1b5d2901e1c7d166a2a4 type 599dcce2998a6b40b1e38e8c6006cb0a unzip 0a342b59ecdcede0571340b9ed11633f upload 76ee3de97a1b8 |
| md5 | 599eba19aa93a929cb8589f148b8a6c4 | 6b69358779091 runas d88f585460839dd14ad3354bb0d5353b screen 599eba19aa93a929cb8589f148b8a6c4 setcmd 27dc2525548f8ab10a2532037a9657e0 setlen 846a44d63b02 |
| md5 | 5bb94a1c12413a2e5d14deabab29f2aa | 7b3ec87 Commands supported by emdivi t20: command md5 abort 5bb94a1c12413a2e5d14deabab29f2aa cd 6865aeb3a9ed28f9a79ec454b259e5d0 copy 12cba3ee81cf4a7937 |
| md5 | 67ca07ecb95c4055d2687815d0c0f8b9 | f849cbc8a7efb GOTO 4b8bb3c94a9676b5f34ace4d7102e5b9 LOADDLL 67ca07ecb95c4055d2687815d0c0f8b9 SETCMD 48bb700b80557ee2e5cf06c90ba6698c SUSPEND ee93a0b023c |
| md5 | 6865aeb3a9ed28f9a79ec454b259e5d0 | t20: command md5 abort 5bb94a1c12413a2e5d14deabab29f2aa cd 6865aeb3a9ed28f9a79ec454b259e5d0 copy 12cba3ee81cf4a793796a51b6327c678 dir 736007832d2167baa |
| md5 | 6e0ad8e44cff1b5d2901e1c7d166a2a4 | ccaa89d54 suspend 497927fb538c4a1572d3b3a98313cab1 tasklist 6e0ad8e44cff1b5d2901e1c7d166a2a4 type 599dcce2998a6b40b1e38e8c6006cb0a unzip 0a342b59ecdcede |
| md5 | 71574cf393bf901effa0cbc6c37e4ce2 | 187f06f746f getfile b24ba6d783f2aa471b9472109a5ec0ee getlnk 71574cf393bf901effa0cbc6c37e4ce2 goto de94e676c0358eefea4794f03d6bda4f hash 0800fc577294c34e |
| md5 | 736007832d2167baaae763fd3a3f3cf1 | 9a79ec454b259e5d0 copy 12cba3ee81cf4a793796a51b6327c678 dir 736007832d2167baaae763fd3a3f3cf1 diskls e120a254f254978fc265354a4e79d1d6 doabort 1f6dcc1149b |
| md5 | 74a9d3a81b79eec0aa2f849cbc8a7efb | 53d599a2341 DOWNBG 39cd12d51b236befc5f939a552181d73 GETFILE 74a9d3a81b79eec0aa2f849cbc8a7efb GOTO 4b8bb3c94a9676b5f34ace4d7102e5b9 LOADDLL 67ca07ecb95c4 |
| md5 | 76ee3de97a1b8b903319b7c013d8c877 | 38e8c6006cb0a unzip 0a342b59ecdcede0571340b9ed11633f upload 76ee3de97a1b8b903319b7c013d8c877 version 2af72f100c356273d46284f6fd1dfc08 zip adcdbd79a8d841 |
| md5 | 793914c9c583d9d86d0f4ed8c521b0c1 | 87e26659aa9b173 loaddll 0340b5e3f0d0ea71eeef6ab890270fc0 md 793914c9c583d9d86d0f4ed8c521b0c1 mklnk a3bb50704b87da1858a46455dfb5e470 move 3734a903022249b |
| md5 | 7f3e982a0d9b4aa5303332aaf414d457 | 4833d5ef0d3 downbg 1e04875a872812e1f431283244b180d2 downbg2 7f3e982a0d9b4aa5303332aaf414d457 download fd456406745d816a45cae554c788e754 download2 b5a4000 |
| md5 | 846a44d63b02c23bcfee5b4ccaa89d54 | 89f148b8a6c4 setcmd 27dc2525548f8ab10a2532037a9657e0 setlen 846a44d63b02c23bcfee5b4ccaa89d54 suspend 497927fb538c4a1572d3b3a98313cab1 tasklist 6e0ad8e44 |
| md5 | 8dff5f89b87ebf91a1ecc1dbed3a6fbb | 6c90ba6698c SUSPEND ee93a0b023cef18b34ebfee347881c14 UPLOAD 8dff5f89b87ebf91a1ecc1dbed3a6fbb VERSION 021321e8c168ba3ae39ce3a2e7b3ec87 Commands supported |
| md5 | 96e89a298e0a9f469b9ae458d6afae9f | ea4794f03d6bda4f hash 0800fc577294c34e0b28ad2839435945 head 96e89a298e0a9f469b9ae458d6afae9f hjlnk ebb0149209e008e3f87e26659aa9b173 loaddll 0340b5e3f0d0 |
| md5 | a3bb50704b87da1858a46455dfb5e470 | 1eeef6ab890270fc0 md 793914c9c583d9d86d0f4ed8c521b0c1 mklnk a3bb50704b87da1858a46455dfb5e470 move 3734a903022249b3010be1897042568e post 42b90196b487c540 |
| md5 | adcdbd79a8d84175c229b192aadc02f2 | 19b7c013d8c877 version 2af72f100c356273d46284f6fd1dfc08 zip adcdbd79a8d84175c229b192aadc02f2 They both store the md5 checksums of backdoor commands. Whe |
| md5 | b24ba6d783f2aa471b9472109a5ec0ee | f63067ad9363e7 get b5eda0a74558a342cf659187f06f746f getfile b24ba6d783f2aa471b9472109a5ec0ee getlnk 71574cf393bf901effa0cbc6c37e4ce2 goto de94e676c0358e |
| md5 | b3bc4b5f17fd5f87ec3714c6587f6906 | 53bc 512d93c711f006891cbc124392c2e8d9 Hashes of emdivi t17: b3bc4b5f17fd5f87ec3714c6587f6906 f8d9af763e64c420ffa6e8930727f779 Hashes of emdivi t20: 3b42 |
| md5 | b5a4000c99977ce512052d4e8bf737f8 | 414d457 download fd456406745d816a45cae554c788e754 download2 b5a4000c99977ce512052d4e8bf737f8 execute ec0cd3cb91fe82b9501f62a528eb07a9 exhide fc236c4ddd3 |
| md5 | b5eda0a74558a342cf659187f06f746f | b2e467df3b1876b exuser 0b5396d6bd0867485ff63067ad9363e7 get b5eda0a74558a342cf659187f06f746f getfile b24ba6d783f2aa471b9472109a5ec0ee getlnk 71574cf393b |
| md5 | d88f585460839dd14ad3354bb0d5353b | dead43d7f5d5a9889 rd eeec033a2c4d56d7ba16b69358779091 runas d88f585460839dd14ad3354bb0d5353b screen 599eba19aa93a929cb8589f148b8a6c4 setcmd 27dc2525548f |
| md5 | d895d96bc3ae51944b29d53d599a2341 | ands. Commands supported by emdivi t17: command md5 DOABORT d895d96bc3ae51944b29d53d599a2341 DOWNBG 39cd12d51b236befc5f939a552181d73 GETFILE 74a9d3a81b7 |
| md5 | de94e676c0358eefea4794f03d6bda4f | 9472109a5ec0ee getlnk 71574cf393bf901effa0cbc6c37e4ce2 goto de94e676c0358eefea4794f03d6bda4f hash 0800fc577294c34e0b28ad2839435945 head 96e89a298e0a9f46 |
| md5 | e120a254f254978fc265354a4e79d1d6 | 796a51b6327c678 dir 736007832d2167baaae763fd3a3f3cf1 diskls e120a254f254978fc265354a4e79d1d6 doabort 1f6dcc1149b2eef63f6dd4833d5ef0d3 downbg 1e04875a872 |
| md5 | ebb0149209e008e3f87e26659aa9b173 | b28ad2839435945 head 96e89a298e0a9f469b9ae458d6afae9f hjlnk ebb0149209e008e3f87e26659aa9b173 loaddll 0340b5e3f0d0ea71eeef6ab890270fc0 md 793914c9c583d9d |
| md5 | ec0cd3cb91fe82b9501f62a528eb07a9 | c788e754 download2 b5a4000c99977ce512052d4e8bf737f8 execute ec0cd3cb91fe82b9501f62a528eb07a9 exhide fc236c4ddd3414cee8bd3cbd937461c0 exit f24f62eeb78919 |
| md5 | ee93a0b023cef18b34ebfee347881c14 | 815d0c0f8b9 SETCMD 48bb700b80557ee2e5cf06c90ba6698c SUSPEND ee93a0b023cef18b34ebfee347881c14 UPLOAD 8dff5f89b87ebf91a1ecc1dbed3a6fbb VERSION 021321e8c16 |
| md5 | eeec033a2c4d56d7ba16b69358779091 | 3712ab1cbf92c postfile2 f15ae485061a10adead43d7f5d5a9889 rd eeec033a2c4d56d7ba16b69358779091 runas d88f585460839dd14ad3354bb0d5353b screen 599eba19aa93a |
| md5 | f07216c34689a9104b29bbdcba17325f | f779 Hashes of emdivi t20: 3b42577bbd602934a728744f242ffe26 f07216c34689a9104b29bbdcba17325f C&Cs: hxxp://**********kind.com/ hxxp://j*******a.org/ hxxp |
| md5 | f15ae485061a10adead43d7f5d5a9889 | e98ab6f postfile 316713cb9f82ff9ade53712ab1cbf92c postfile2 f15ae485061a10adead43d7f5d5a9889 rd eeec033a2c4d56d7ba16b69358779091 runas d88f585460839dd14 |
| md5 | f24f62eeb789199b9b2e467df3b1876b | 1f62a528eb07a9 exhide fc236c4ddd3414cee8bd3cbd937461c0 exit f24f62eeb789199b9b2e467df3b1876b exuser 0b5396d6bd0867485ff63067ad9363e7 get b5eda0a74558a34 |
| md5 | f46019f795bd721262dc69988d7e53bc | his APT modules. Technical Details Hashes of flash exploit: f46019f795bd721262dc69988d7e53bc 512d93c711f006891cbc124392c2e8d9 Hashes of emdivi t17: b3bc |
| md5 | f8d9af763e64c420ffa6e8930727f779 | e8d9 Hashes of emdivi t17: b3bc4b5f17fd5f87ec3714c6587f6906 f8d9af763e64c420ffa6e8930727f779 Hashes of emdivi t20: 3b42577bbd602934a728744f242ffe26 f072 |
| md5 | fc236c4ddd3414cee8bd3cbd937461c0 | d4e8bf737f8 execute ec0cd3cb91fe82b9501f62a528eb07a9 exhide fc236c4ddd3414cee8bd3cbd937461c0 exit f24f62eeb789199b9b2e467df3b1876b exuser 0b5396d6bd0867 |
| md5 | fd456406745d816a45cae554c788e754 | 244b180d2 downbg2 7f3e982a0d9b4aa5303332aaf414d457 download fd456406745d816a45cae554c788e754 download2 b5a4000c99977ce512052d4e8bf737f8 execute ec0cd3cb |
| url | http://j*******a.org/ | c34689a9104b29bbdcba17325f C&Cs: hxxp://**********kind.com/ hxxp://j*******a.org/ hxxp://j*******b.biz/ hxxp://www.n*******b.com/ hxxp://www. |
| url | http://j*******b.biz/ | 325f C&Cs: hxxp://**********kind.com/ hxxp://j*******a.org/ hxxp://j*******b.biz/ hxxp://www.n*******b.com/ hxxp://www.s********ei.com/ More |
| url | http://**********kind.com/ | 2934a728744f242ffe26 f07216c34689a9104b29bbdcba17325f C&Cs: hxxp://**********kind.com/ hxxp://j*******a.org/ hxxp://j*******b.biz/ hxxp://www.n*** |
| url | http://www.n*******b.com/ | ******kind.com/ hxxp://j*******a.org/ hxxp://j*******b.biz/ hxxp://www.n*******b.com/ hxxp://www.s********ei.com/ More information about the Blue |
| url | http://www.s********ei.com/ | *****a.org/ hxxp://j*******b.biz/ hxxp://www.n*******b.com/ hxxp://www.s********ei.com/ More information about the Blue Termite targeted attacks is |
From the original article
5 min read at securelist.com
In October 2014, Kaspersky Lab started to research “Blue Termite”, an Advanced Persistent Threat (APT) targeting Japan. The oldest sample we’ve seen up to now is from November 2013. This is not the first time the country has been a victim of an APT.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.