본문 바로가기
Security/News

유튜브는 나의 C2 - bit_of_hex 관련 IOC 158개 발견

by 올엠 2023. 1. 24.
반응형

IOC:
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://copy.com/hSn32C8TeJKq/file.html
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://copy.com/hSn32C8TeJKq/file.html
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://youtu.be/AApRxqOjLs4
http://youtu.be/aZRJQdwN4-g
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/108098760042015113400/posts?hl=en
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://copy.com/hSn32C8TeJKq/file.html
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://youtu.be/AApRxqOjLs4
http://youtu.be/aZRJQdwN4-g
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/108098760042015113400/posts?hl=en
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://copy.com/hSn32C8TeJKq/file.html
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://copy.com/hSn32C8TeJKq/file.html
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://youtu.be/AApRxqOjLs4
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://copy.com/hSn32C8TeJKq/file.html
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://youtu.be/aZRJQdwN4-g
http://plus.google.com/108098760042015113400/posts?hl=en
http://youtu.be/AApRxqOjLs4
http://youtu.be/aZRJQdwN4-g
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/108098760042015113400/posts?hl=en
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://copy.com/hSn32C8TeJKq/file.html
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://copy.com
http://youtu.be/AApRxqOjLs4
http://87.120.254.100
http://youtu.be/aZRJQdwN4-g
http://87.120.37.68
http://dl.dropboxusercontent.com/s/vz5unuqw4n1smun/index.html
http://169.130.156.190
http://dl.dropboxusercontent.com/s/7ttsyz4ypnco0sd/file.html
http://119.131.4.30
http://www.youtube.com/watch?v=EsVgsH-NfD0b
http://169.130.156.190
http://www.youtube.com/watch?v=8Sxcin85wxQ
http://119.131.4.30
http://plus.google.com/109526023785415750407/posts/1ecFp1jLnX1
http://plus.google.com/108098760042015113400/posts?hl=en
http://plus.google.com/105611301541879878976/posts/fCo9jvzZKNT
http://copy.com/hSn32C8TeJKq/file.html
87.120.254.100
87.120.37.68
169.130.156.190
119.131.4.30
169.130.156.190
119.131.4.30
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
00:50:56:c0:00:08
1be621c3cd6f26f3ccce00ec492b92bc7197537d7be34ddda06a1ebb15136184
20026af8c1bd95d4a39c2d1d1c2909ed133a5d2efac2d6c6b87cbc4d2782fef0
26fd8d1abe275f611779951c1687c3e04091dba12147500409e2db59b7bf6de1
2f92936228e4e83ddcb040267bac970908c4d3ed41bc636f808feb7a2eb60044
48de3d2ba47f482e912792ef677fec95557da5d14eb65321ff8290e59531076a
62901e68c0c990a7ee69a2954f931dc643be430a8d09f316974d88a0ed97a268
65469ae4cb1f05ea1b7a174cbdfbb63021cc2971693a29e226dc510dec20dc3e
7eb4ea6277bd62653cc474cf1125165c9bdc43858811c0d88be25e2ec34bc14d
83d6a78e4e03fdf0447502626df4931099b57fc557ef0fe22032e34733d494e1
bbd2a1f2cb9b929e4ca09310caeb43c7257ebdd7c3872b8f62645eb659c4c89d
d7d74fafc0c4a65e080c04479a0f1fd1da8cd34aee59e88ac49de3f844362416
1be621c3cd6f26f3ccce00ec492b92bc7197537d7be34ddda06a1ebb15136184
20026af8c1bd95d4a39c2d1d1c2909ed133a5d2efac2d6c6b87cbc4d2782fef0
26fd8d1abe275f611779951c1687c3e04091dba12147500409e2db59b7bf6de1
2f92936228e4e83ddcb040267bac970908c4d3ed41bc636f808feb7a2eb60044
48de3d2ba47f482e912792ef677fec95557da5d14eb65321ff8290e59531076a
62901e68c0c990a7ee69a2954f931dc643be430a8d09f316974d88a0ed97a268
65469ae4cb1f05ea1b7a174cbdfbb63021cc2971693a29e226dc510dec20dc3e
7eb4ea6277bd62653cc474cf1125165c9bdc43858811c0d88be25e2ec34bc14d
83d6a78e4e03fdf0447502626df4931099b57fc557ef0fe22032e34733d494e1
bbd2a1f2cb9b929e4ca09310caeb43c7257ebdd7c3872b8f62645eb659c4c89d
d7d74fafc0c4a65e080c04479a0f1fd1da8cd34aee59e88ac49de3f844362416
D28C1C4F4C705B21E84ADADB42594E42543DF4F1C4B44219569DC18B375E78E3
1be621c3cd6f26f3ccce00ec492b92bc7197537d7be34ddda06a1ebb15136184
20026af8c1bd95d4a39c2d1d1c2909ed133a5d2efac2d6c6b87cbc4d2782fef0
26fd8d1abe275f611779951c1687c3e04091dba12147500409e2db59b7bf6de1
2f92936228e4e83ddcb040267bac970908c4d3ed41bc636f808feb7a2eb60044
48de3d2ba47f482e912792ef677fec95557da5d14eb65321ff8290e59531076a
62901e68c0c990a7ee69a2954f931dc643be430a8d09f316974d88a0ed97a268
65469ae4cb1f05ea1b7a174cbdfbb63021cc2971693a29e226dc510dec20dc3e
7eb4ea6277bd62653cc474cf1125165c9bdc43858811c0d88be25e2ec34bc14d
83d6a78e4e03fdf0447502626df4931099b57fc557ef0fe22032e34733d494e1
bbd2a1f2cb9b929e4ca09310caeb43c7257ebdd7c3872b8f62645eb659c4c89d
d7d74fafc0c4a65e080c04479a0f1fd1da8cd34aee59e88ac49de3f844362416

요약:
며칠 전에 나는 Virus Total에서 찾은 흥미로운 LNK 파일 샘플에 대해 트윗했다. 그들은 VBE 스크립트에서 VBE 스크립트를 추출하고 헤더를 패치하고 바이트를 되돌리는 것을 포함하는 끝없는 러시아 돌에스크 스타일의 동작 때문에 흥미로웠다.
2020년 5월 31일 현재, 나는 2020-03-02에서 2020-05-29 사이의 11개 샘플을 바이러스 토탈에 업로드한 것으로 확인했다. 모두 동일한 VMWare 호스트에서 동일한 계정을 사용하고 LECMD의 출력에서 볼 수 있는 동일한 기본 LNK 템플릿을 사용하여 일관되게 생성됩니다:
LNK 파일



SHA256 해시
생성된 대상
대상 수정됨
액세스된 대상
SID
기계.MAC 주소




1be621cd3cd6f26f3ccce00ec492b92bc7197537d7be34dda06a1ebb15136184
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


20026af8c1bd95d4a39c2d1c2909ed133a5d2efac2d6c6b87cbc4d2782fef0
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


26★8d1abef611779951c1687c3e04091★12147500409e2db59b7★6de1
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


2f92936228e4e83ddcb040267f970908c4d3ed41bc636f808feb7a2eb60044
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


48de3d2ba47f482e912792ef677f95557da5d14eb65321ff8290e59531076a
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


62901e68c0c990a7ee69a2954f931dc643be440a8d09f316974d88a0ed97a268
2010-11-21 03:24:03
2010-11-21 03:24:03
2010-11-21 03:24:03
S-1-5-21-2529457200-49751210-1696528657-1000
00:50:56:c0:00:08


65469ae4cb1f05ea1b7a174cbdbb63021cc2971693a29e226dc510dec20dc3e
2010-11-21 03:24:03
2010-11-21 03:24:03
20.....

유튜브는 나의 C2 - bit_of_hex:
https://bitofhex.com/2020/05/31/youtube-is-my-c2/

'Security > News' 카테고리의 다른 글

블루보틀: 아프리카 프랑스어권 국가의 은행을 강타한 캠페인 | Symantec Enterprise 블로그 관련 IOC 67개 발견  (0) 2023.01.24
빌버그: 국가가 후원하는 Actor Targets Cert Authority, 여러 아시아 국가의 정부 기관 | Symantec Enterprise 블로그 관련 IOC 23개 발견  (0) 2023.01.24
러시아-우크라이나 사이버 공격에 대한 또 다른 사이버 스파이 활동 관련 IOC 14개 발견  (0) 2023.01.24
중동을 겨냥한 머디워터의 '라이트' 1단계 관련 IOC 18개 발견  (0) 2023.01.24
이달 11월 처음으로 공개된 새로운 랜섬웨어인 AXLocker 랜섬웨어에 대한 분석 결과를 최근 발표했다. 기사에서 설명하듯이 랜섬웨어는 불협화음을 이용해 데이터를 암호화하고 유출한다. 이..  (0) 2023.01.24

태그

관련글

댓글0

티스토리툴바