性之诱饵 恶意软件分析:借助军事相关诱饵文档传播Cobalt Strike( 六 )


365 af 2d dad 27701d 9d 17 a 069 b 21 DC 95d 39 a2 d2c 5 f 78 bea 655 db 9123 ff 05 Fe 086
b9c 703 DBA 1977 FB 34 e 9 f 6 AC 49 ccdd 0 efb 752 ed 010939d 54 f 30 F8 d 91358 a 9214d
d3f3df 7 cf 1ece 2519829 ee 75d 29 ca 054 e 8233896 B7 Fe 50 b 41 aafd a 497 ff 0498
82155 AAF 86 ba 3555 d5e 809500 c 67 da 51 e 1586 a 97 a 975870 e 22900 c 879019
8 f1 abb 122 f 35 e 66 f 20 BD 345323 FB 5 EB 8 dbdb de 785137 c 80 C1 e 55 fdaf 525520 BD
aa 05 a 822 f 26 a 493 efb 27046 f 772790 cc 67 cc a 29 CD 9 f 842 B7 BC 6 df 2b 391 ce 2 ff 8
59 FD 696 f 95182 be 1a 51011 AE 172 c 5461 ddad 556 a 43 c 329d 939842 cf 7e 7d 7f
12.3 Python模块EXE
85e 69341 F2 Fe 9 b 97 cf 0 BC 81 DC 63917 e 62 bb 17072 BCD 20 fc 6125d 241623 e 68660
4260 de 850 b 4003 C9 d 4663 afae 00 ba 57 EC 02761 f 687 DBA 1117 ded 0 A8 b 20 c6b 5bb
a 657 bb 83 Fe 62 E4 b 555d 20463 BF 090 f 3349 e 55 e 1560507 f 2197 a 42 C2 C3 f 152667
ce 438 B0 d 30 DD 1c 221 e 3c 7 ab 99585 ACB 4254 deaf 68 bdfb 8 fc 73 EB 206 D8 FD 04771
12.4钴罢工哈希值
482858 b 70888 ACF 67 a5c2d 30 dee 61 ca 7b 57 ff 856 feaad 9 a2fa 2b 5 D4 BC 0 bbd 7d
689 F7 d3f 0 def 72248 C4 ff 4b 30 da 5022 EC 808 a 20 e 99 b 139 e 097 c2a 0d 0 ba 5 Bab 66
dbb5 BBA 499 e0ab 07 e 545055d 46 ACF 3 f 78 b5 ed 35 fff 83d 9c 88 ce 57 c 6455 c 02091
c2d 9 bbd 5163 A8 e 733483 bf5 d 0d 4959 f 053 a 2307d 275 b 81 EB 38 e 69d 87 f1 F5 df 7e
12.5恶意JQuery文件
1ea 22d 132 c 1d 478347d 7e 4e 72d 79 BAE 29 f 18 df 9 be 5a 3016 a 5a 9971 f 702 a 8095
B9 efca 96d 451 c 0 b 4028 b 6081456 C1 DDD 3035 ab 39 E6 a 60 BDD 831 BCF 4 a 472 a 31 AE
d2fd 448 a 386416 fdad 0059 be 1 bb 61 f 49 e 99 fc 76 E7 efbd 5 f e 377 dbbf 6 E7 e 3599
bdbc 9 DC 2 f 2812 a 9808357 aafe 908 e 7206 c 9168 BC 7 FEA 761 dec 871926 de 23 EEC 0
12.6恶意文档分发网址
hxxp://bitly/IAF-指南
hxxp://tecbeckcom/IAP39031docx
hxxp://bitlycom/38A5BEO
12.7钴罢工C&C网址
hxxp://134209 . 196 . 51/jquery-3 . 3 . 1 . min . js
hxxp://134209 . 196 . 51/jquery-3 . 3 . 2 . min . js
hxxp://13959.1.154/ca
hxxp://13959.1.154/submit.php
hxxp://13959 . 79 . 105/jquery-3 . 3 . 1 . min . js
hxxp://13959 . 79 . 105/jquery-3 . 3 . 2 . min . js
hxxp://188166 . 14 . 73/jquery-3 . 3 . 1 . min . js
hxxp://188166 . 14 . 73/jquery-3 . 3 . 2 . min . js
12.8 IP地址
134209.196.51
134209.200.91
13959.1.154
13959.79.105
13959.81.167
157245.78.153
16522.201.190
17862.210.85
188166.14.73
188166.25.156
20259.79.131
12.9 MSF外壳代码网址
hxxp://13959 . 1 . 154:8201/cmelkmkl . txt
hxxp://157245.78.153/11.txt
hxxp://157245.78.153/12.txt
hxxp://157245.78.153/21.txt
hxxp://157245.78.153/22.txt
hxxp://157245.78.153/31.txt
hxxp://157245.78.153/32.txt
hxxp://157245.78.153/41.txt
hxxp://157245.78.153/42.txt
hxxp://157245.78.153/51.txt
hxxp://157245.78.153/52.txt
hxxp://20259.79.131/7XyT
hxxp://20259 . 79 . 131/o2q 7 nguwffdzclmnkumayy-IGt8KERPl-6rrhscbjkzwar 33
hxxp://20259 . 79 . 131:8080/8g-qvdrvm 4 HSI 0 C3 D6 IC 8 aib6 wzbs
12.10 jQuery/解码工具Shellcode URL
hxxp://134209 . 196 . 51/jquery-3 . 3 . 0 . min . js
hxxp://134209 . 200 . 91/jquery-3 . 3 . 0 . min . js
hxxp://13959.1.154/ToKN
hxxp://13959 . 79 . 105/jquery-3 . 3 . 0 . min . js
hxxp://13959 . 81 . 167/jquery-3 . 3 . 0 . min . js
hxxp://16522 . 201 . 190/jquery-3 . 3 . 0 . min . js
hxxp://188166 . 14 . 73/jquery-3 . 3 . 0 . min . js
hxxp://188166 . 25 . 156/jquery-3 . 3 . 0 . min . js
hxxp://20259 . 79 . 131/YZn _ pcfliuilleewp6 vuku 9 gvuqfmfnplbp 5 aju 9 QS 709 n4zrad-3e4iupfvv0uhxsaijqurq5ypj-b9zsz 5 rhig 07 rcwcqpipdo 4 yzhqqqqqqqqqjcgwwyi-affhi0q4lrdsuabdqeihgmxz8 obxubv5ru faxm7xwokwk8 d9xk5gipggbins 4

推荐阅读