Threat actorhigh
RedAlpha: New Campaigns Discovered Targeting the Tibetan Community
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ackques.com | on port 80, as well as issuing POST requests to the <index.ackques[.]com> C2 server with the specific User-Agent, pictured below: |
| domain | acques.com | ation about the victim system while POST requests to “index.acques[.]com/index.html” primarily uploaded zlib compressed files from |
| domain | hktechy.com | creating a separate thread with an open socket to the < www.hktechy[.]com> server on port 80, as well as issuing POST requests to t |
| domain | internetdocss.com | s; however, malware from both campaigns made use of the doc.internetdocss[.]com C2 domain, thus tying both campaigns together. A maliciou |
| ipv4 | 198.44.172.97 | bserved on June 19, 2017, when it resolved to a Chinese IP, 198.44.172[.]97, belonging to Chinese VPS provider VPSQuan LLC. Four hash |
| ipv4 | 220.218.70.160 | that doc.internetdocss[.]com first resolved to Japanese IP 220.218.70[.]160 on June 28, 2017, only a few weeks after the original dro |
| ipv4 | 45.77.250.80 | doc.internetdocss[.]com currently points to Singaporean IP 45.77.250[.]80 (Choopa, LLC), and historically resolved to at least two |
| md5 | 1b67183acc18d7641917f4fe07c1b053 | ampaign, we were unable to acquire one of the samples (MD5: 1b67183acc18d7641917f4fe07c1b053) from common malware multiscanner repositories at the time |
| md5 | e6c0ac26b473d1e0fa9f74fdf1d01af8 | nce executed, the lure document loads an embedded DLL (MD5: e6c0ac26b473d1e0fa9f74fdf1d01af8) that drops the validator implant into the users “Temp” dir |
From the original article
13 min read at recordedfuture.com
Scope Note : Recorded Future analyzed new malware targeting the Tibetan community. This report includes a detailed analysis of the malware itself and associated infrastructure. Sources include Recorded Future’s platform, VirusTotal, ReversingLabs, and third-party metadata, as well as common OSINT and network metadata enrichments, such as DomainTools Iris and PassiveTotal, and researcher collaboration.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.