z3r0

[z3r0 @ccxsaber]

@jq0904 👍

[z3r0 @ccxsaber]

CVE-2021-1647 ?
eset_nod32:"a variant of Win32/Exploit.CVE-2021-1647.A"
638c14f53ca39c9572bee12adc1c11194b84e6abaa08b0ff30977aa56ec9ba6b
24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a
db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7
...

[z3r0 @ccxsaber]

@Cray_16310 Online Sandbox.
https://bit[.]ly/39y2FuK
https://bit[.]ly/3qoiCdw
https://bit[.]ly/2LWkWte

[z3r0 @ccxsaber]

#APT #Winnti #Linux
9c770b12a2da76c41f921f49a22d7bc6b5a1166875b9dc732bc7c05b6ae39241
NC: up.linux-headers[.]com

cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31
NC: p.samkdd[.]com

[z3r0 @ccxsaber]

Some others TemplateInject sample.
#Lazarus
28cd09ecad4149eec8665edf79c1c2036df67375f964e7e18a101ca88fe5f8e1
WN: Boeing_Russia_AA.docx
NC: https://docentfx[.]com/wp-includes/theme-compat/logo/b_r_205699.jpg

[z3r0 @ccxsaber]

#Donot #APT #TemplateInject
6a5d70c47d314c310003fcd0d74295d2442a27a5de87aedef715e426aa7222bd
WN: Jul 2020.docx
NC: http://filecopying[.]xyz/KB234520/update/2107SP
https://tampotrust[.]top/tax/lodi/pkra

[z3r0 @ccxsaber]

Many ways to hunt this sample.
1. LNK command
2. The ZIP
etc...

[z3r0 @ccxsaber]

#SideWinder #APT #LNK
53a4299b79bde7504d2b354c1d6c28660338ea7778723a9d6ed1260c20b8dd5d
WN: Hajj Policy and Plan 2020.pdf.lnk
NC: http://www.hajjinfo-org.tar-gz[.]net/images/6DAD7366/15984/11992/f37b72e3/23d3382

[z3r0 @ccxsaber]

#SideWinder #APT #IN #THU
58ece87d7521234153f84db973b2587ec6e999a8c2a56e8c3ef88261415b03e8
NC: www-oimc.gov-mil[.]cn

04e0d94b1a24d12d690c41a5142b8652cfb517454b0c52eee912179dceb52a9a
NC: tsinghua.gov-mil[.]cn

etc...

[z3r0 @ccxsaber]

#Donot #TemplateInject #LK
7ad93760a7c96c74f5be57cac2ac0250b781c97c5d7e0f9bb8d773c0bd6c69d4
WN: NOIC(TS) 090600 PPPP.docx
NC: http://yourcontents[.]xyz/KB23465/028PN

[z3r0 @ccxsaber]

#Donot #APT
85efbeb17d8e366e0f67d21fecc3fc754ecb997ee2033682f47cb0da38439c02
NC: yourcontents[.]xyz

[z3r0 @ccxsaber]

3. Case:
#Bitter
623f433228482051e7c3a952805c6b4fefa4cdb4aa4298736b7257a7c41d52cd
WN: Guidelines for Extension of official-Gratis Passports.docx
#maybe china
2a5890aca37a83ca02c78f00f8056e20d9b73f0532007b270dbf99d5ade59e2a
WN: Boris Johnson Pledges to Admit 3 Million From Hong K.

[z3r0 @ccxsaber]

#APT #Hunt #TemplateInject
How to hunt some APT sample?
Case: TemplateInject
1. Hunt: nano_antivirus:"Exploit.Xml.CVE-2017-0199.equmby", etc
2. Identify: metadata(any), payload, TTPs, code, protocol, etc

#Lazarus
8de4eb52db0ce19d295dd7f1c6e89522d1a09fa26709c058327701b4c436349f

[z3r0 @ccxsaber]

#Donot #APT
Malicious site, hosting RTF file.
http://securecon[.]top/KB8XP/

[z3r0 @ccxsaber]

#Kimsuky #HWP #DPRK
c6661195693d0f09d70c643f87194282593ef0d6a0e349720310d760d002e062
WN: 북한의 회색지대 전략과 대응방안.hwp
The DPRK's Gray Zone Strategy and the Counter-Measures
NC: lovelovelove.atwebpages[.]com/home/jpg/post.php

[z3r0 @ccxsaber]

@trungduc751995 Unfortunately, no lure file.

[z3r0 @ccxsaber]

#APT32 #VN #CobaltStrike #Safebrowsing
6d83ea41005d69dbc58200b8657e8f015f4219e4c359d8a79e8aaa165aab1212
NC: feeder.blogdns[.]com

[z3r0 @ccxsaber]

#APT32 #ASEAN #PH #Apple #SFX
dbde2b710bee38eb3ff1a72b673f756c27faa45d5c38cbe0f8a5dfccb16c18ba
WN: ASEAN Summit 26-06-2020 Conference.doc~.exe
NC: tripplekill.mentosfontcmb[.]com

[z3r0 @ccxsaber]

#Lazarus #Crypto
21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831
WN: DorusioUpgrade.exe
NC: dorusio[.]com

[z3r0 @ccxsaber]

#Gamaredon #UA
811e8b4103e61480e077babbcd465cd27105cbc66de6803d15207c13c3f92e44
WN: Щодо доступу до публічної інформації.rar
NC: http://validat.freedynamicdns[.]org/var/post.php
http://krembo.freedynamicdns[.]org/installer/cache/eEpEaH.dot