Appendix

Lurk: Retracing the Group’sFive-Year Campaign
Appendix

TrendLabs Security Intelligence Blog
Fyodor Yarochkin and Vladimir KropotovFebruary 2017

Trend Micro | Lurk: Retracing the Group’s Five-Year Campaign

TREND MICRO LEGAL DISCLAIMER
The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice.
The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be reliedon or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing herein should be construed otherwise.
Trend Micro reserves the right to modify the contents of this document at any time without prior notice.
Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise
related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in thetranslation are not binding and have no legal effect for compliance or enforcement purposes.
Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any
kind as to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk.
Trend Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing, or delivering this document
shall be liable for any consequence, loss, or damage, including direct, indirect, special, consequential, loss of business profits, or special damages, whatsoever
arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof. Use of thisinformation constitutes acceptance for use in an “as is” condition.

Trend Micro | Lurk: Retracing the Group’s Five-Year Campaign

Indicators of Compromise (IoCs):
Hashes (SHA256)
SHA256Detecion

7382ef1638e6ce8fc5c0cf766cea2e93ae9e8ea4ef891f79a1589f1978779aa0

JAVA_EXPLOIT.GL

6b10d6fba9974e3be421081722b16b3d56cdecbd5461711dc4f1919fde9a8452

TROJ_RANBYUS.GAT

d947e1ad59d4dfeaa6872a6bda701e67d40a265f711f74984aa286a59daf1373

SWF_EXPLOIT.YYRO

73eda8a8c2511e8cf7261da36be78064c16094e3e83ebdeb76e7ee7803a32f69

JAVA_EXPLOIT.SBGX

URLs
URLs
hxxp://zaurona[.]eu/GLMF

Category

hxxp://zaurona[.]eu/0GLMFss

Disease Vector
Disease Vector

hxxp://zaurona[.]eu/1GLMFss

Disease Vector

askd29-as72hhoip[.]poweji093fbad[.]in/indexm.html
askd29-as72hhoip[.]poweji093fbad[.]in/0MSKMdl

C&C
C&C

askd29-as72hhoip[.]poweji093fbad[.]in/cljlkzaaukinh[.]html

C&C

Note: IoCs will be updated with more related information.

3

Trend Micro Incorporated, a global leader in security software, strives to make theworld safe for exchanging digital information. Our innovative solutions for consumers,
businesses and governments provide layered content security to protect information
on mobile devices, endpoints, gateways, servers and the cloud. All of our solutions
are powered by cloud-based global threat intelligence, the Trend Micro™ SmartProtection Network™, and are supported by over 1,200 threat experts around theglobe. For more information, visit www.trendmicro.com.
©2017 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend
Micro t-ball logo are trademarks or registered trademarks of Trend Micro,Incorporated. All other product or company names may be trademarks or registeredtrademarks of their owners.

10101 N. De Anza Blvd.
Cupertino, CA 95014
U.S. toll free: 1 +800.228.5651
Phone: 1 +408.257.1500
Fax: 1 +408.257.2003