Input: This variant of NanoCore was configured to communicate with the following IP address as its C2 server over TCP port 6666:   115.186.136[.]237   Bitly short URLs and expanded domains    Short Bitly URL Expanded URL   http://bit[.]ly/Loaloding http://www.asaigoldenrice[.]com/daq/doc/2.doc   http://bit[.]ly/Loadingnnsa http://onedrivenet[.]xyz/work/docnew/4.doc   http://bit[.]ly/2JmQLW6 http://stemtopx[.]com/work/doc/13.doc   http://bit[.]ly/2JsruKm http://stemtopx[.]com/work/doc/4.doc   http://bit[.]ly/2GUaY49 http://fast-cargo[.]com/images/file/vb/VBS/doc/3.doc   http://bit[.]ly/Loadingnns http://onedrivenet[.]xyz/work/docnew/4.doc   http://bit[.]ly/2Im2IOF http://panelonetwothree[.]ml/zico/doc/doc8/zloadings.doc   http://bit[.]ly/primeload http://fast-cargo[.]com/images/file/vb/VBS/doc/1.doc   http://bit[.]ly/loader2018 http://asaigoldenrice[.]com/sim/new.doc   http://bit[.]ly/2xZ1kO6wdscsac http://stemtopx[.]com/work/doc/3.doc   http://bit[.]ly/2M2bIYh http://stemtopx[.]com/work/doc/root.doc   http://bit[.]ly/2r9PSIv http://stevemike-fireforce[.]info/work/doc/11.doc   http://bit[.]ly/Loadiendg http://www.0-day[.]us/img/doc/6.doc   http://bit[.]ly/2rpmJKsrdtrdtdfysersgerstrdFCGRDR http://stevemikeforce[.]com/work/doc/7.doc   http://bit[.]ly/2Fu4ZSfloading http://panelonetwothree[.]ml/zico/xe/snoop/ocsnoop/snoop.doc   http://bit[.]ly/2HloaderqVbva http://diamondfoxpanel[.]ml/doc/1/11.doc   http://bit[.]ly/Loardising http://onedrivenet[.]xyz/work/docnew/12.doc   http://bit[.]ly/2JB3KXD http://stemtopx[.]com/work/doc/8.doc   http://bit[.]ly/1_loadingH7TvJa http://diamondfoxpanel[.]ml/doc/1.doc   http://bit[.]ly/Loadijging http://onedrivenet[.]xyz/work/docnew/8.doc   http://bit[.]ly/Laodiingplease http://onedrivenet[.]xyz/work/docnew/13.doc   http://bit[.]ly/2HvQBirEam832ASADx http://stevemike-fireforce[.]info/work/dola/3.doc   http://bit[.]ly/2I5T7b9hgvgvjcVYVY http://stevemikeforce[.]com/work/doc/6.doc   http://bit[.]ly/paymentsuae http://brevini-france[.]cf/xp/doc/swift.doc   http://bit[.]ly/Laodingipleasewait http://www.asaigoldenrice[.]com/daq/doc/10.doc   http://bit[.]ly/loadingxxxx http://www.asaigoldenrice[.]com/daq/doc/4.doc   http://bit[.]ly/2Gmziko http://zupaservices[.]info/doc/z.doc   http://bit[.]ly/2sQhJOO http://stemtopx[.]com/work/doc/6.doc   http://bit[.]ly/laodinfokqaw http://stevemike-fireforce[.]info/work/doc/5.doc   http://bit[.]ly/loadrinfing http://www.asaigoldenrice[.]com/daq/doc/15.doc   http://bit[.]ly/2JaBgAS http://acorn-paper[.]com/administrator/help/7.doc   http://bit[.]ly/2loadingqlOQcM http://diamondfoxpanel[.]ml/doc/4/44.doc   http://bit[.]ly/loardding http://fast-cargo[.]com/images/file/vb/VBS/doc/11.doc   http://bit[.]ly/loidaring https://www.0-day[.]us/img/doc/5.doc   http://bit[.]ly/LoadingPleaseWait http://www.asaigoldenrice[.]com/daq/doc/20.doc   http://bit[.]ly/2HJv5Ud http://stevemike-fireforce[.]info/work/doc/1.doc   http://bit[.]ly/Loading13 http://fast-cargo[.]com/images/file/vb/VBS/doc/13.doc   http://bit[.]ly/2Lzpjp1 http://stemtopx[.]com/work/doc/19.doc   http://bit[.]ly/tt_seafood http://acorn-paper[.]com/administrator/help/en-GB/8.doc   http://bit[.]ly/Lording http://fast-cargo[.]com/images/file/vb/VBS/doc/7.doc   http://bit[.]ly/loadingsmins http://www.asaigoldenrice[.]com/daq/doc/1.doc   http://bit[.]ly/2_loadingJwkhJA http://diamondfoxpanel[.]ml/doc/7.doc   http://bit[.]ly/Laodiingpleasesa http://onedrivenet[.]xyz/work/docnew/13.doc   http://bit[.]ly/2tnW5lu http://stemtopx[.]com/work/newdoc/1.doc   http://bit[.]ly/tt_loading http://acorn-paper[.]com/administrator/components/com_templates/4.doc   http://bit[.]ly/2wzkloading http://panelonetwothree[.]ml/zico/doc/zloading.doc   http://bit[.]ly/Loadingans http://onedrivenet[.]xyz/work/docnew/14.doc   http://bit[.]ly/2r9jLcQloading http://panelonetwothree[.]ml/zico/doc/zik.doc   http://bit[.]ly/loadingpleasewairrs http://stevemike-fireforce[.]info/work/dola/2.doc   http://bit[.]ly/2arubabKmpgwP http://panelonetwothree[.]ml/iran/uae/done/oc/uae.doc   http://bit[.]ly/2HAwzmN3290293sadjokwwadjoW http://stevemike-fireforce[.]info/work/doc/12.doc   http://bit[.]ly/loadingasz http://0-day[.]us/img/doc/10.doc   http://bit[.]ly/ntissa2vFamys http://acorn-paper[.]com/images/locations/thumbnails/oc/m.doc   http://bit[.]ly/2IgzmRxEmasidE9kEjidlE http://panelonetwothree[.]ga/work/doc/3.doc   http://bit[.]ly/2JqmuWp http://stemtopx[.]com/work/doc/16.doc   http://bit[.]ly/load242HmFqZ6 http://panelonetwothree[.]ml/simon/exp/oc/mm.doc   http://bit[.]ly/2L17QGqloading http://panelonetwothree[.]ml/zico/doc/doc8/zxloading.doc   http://bit[.]ly/2MarX5t http://stemtopx[.]com/work/doc/9.doc   http://bit[.]ly/Loadingnix http://www.asaigoldenrice[.]com/daq/doc/3.doc   http://bit[.]ly/2HyVGGy_loading http://panelonetwothree[.]ml/iran/uae/done/oc1/uae.doc   http://bit[.]ly/2H8euros http://acorn-paper[.]com/administrator/components/com_templates/views/2.doc   http://bit[.]ly/2I2mUBFstthdhtrhdtyftfyj http://stevemikeforce[.]com/work/doc/8.doc   http://bit[.]ly/Loininding http://www.0-day[.]us/img/doc/8.doc   http://bit[.]ly/2F02ZRq http://stevemike-fireforce[.]info/work/doc/2.doc   http://bit[.]ly/Loadingpleasewait http://onedrivenet[.]xyz/work/docnew/19.doc   http://bit[.]ly/2jE36KjhvjhgkHJHKLHGFHJ http://stevemikeforce[.]com/work/doc/3.doc   http://bit[.]ly/Waitpleasewait http://stevemike-fireforce[.]info/work/doc/8.doc   http://bit[.]ly/Loiading http://fast-cargo[.]com/images/file/newvbs/doc/1.doc   http://bit[.]ly/Loadingplasewaitsm http://stevemike-fireforce[.]info/work/doc/3.doc   http://bit[.]ly/2jCTHCNasiudhasdASdy7656basdu http://stevemikeforce[.]com/work/doc/2.doc   http://bit[.]ly/loadingpleaswaitrr http://stevemike-fireforce[.]info/work/doc/4.doc   http://bit[.]ly/Loadingnsi http://onedrivenet[.]xyz/work/docnew/2.doc   http://bit[.]ly/2JRUNKh http://www.stemtopx[.]com/work/newdoc/3.doc   http://bit[.]ly/2Hload25YdU19 http://panelonetwothree[.]ml/simon/exp/oc/25/m25.doc   http://bit[.]ly/2lording http://fast-cargo[.]com/images/file/vb/VBS/doc/8.doc   http://bit[.]ly/2M9lLL6 http://stemtopx[.]com/work/doc/15.doc   http://bit[.]ly/Loggeding http://fast-cargo[.]com/images/file/newvbs/doc/4.doc   http://bit[.]ly/Loadingwaitplez http://stevemike-fireforce[.]info/work/doc/10.doc   http://bit[.]ly/ASDj23234j4oDj3234Sdmk http://stevemike-fireforce[.]info/work/doc/5.doc   http://bit[.]ly/2JloadingspWgLs2 http://acorn-paper[.]com/components/com_content/models/oc/s.doc   http://bit[.]ly/Loadingpleasewaitnn http://stevemike-fireforce[.]info/work/dola/4.doc   http://bit[.]ly/2sPe3wZrdtrdytd http://stemtopx[.]com/work/doc/2.doc   http://bit[.]ly/LAdooing http://onedrivenet[.]xyz/work/docnew/6.doc   http://bit[.]ly/LoadIng http://guelphupholstery[.]com/images/yupsia/doc/62.doc   http://bit[.]ly/2JnMVQz http://stemtopx[.]com/work/doc/14.doc   http://bit[.]ly/DocumentIsLoadingPleasewait http://stemtopx[.]com/work/i/2.doc   http://bit[.]ly/2HVD1Bh http://fast-cargo[.]com/images/file/vb/VBS/doc/4.doc   http://bit[.]ly/2uoqexc http://zupaservices[.]info/doc/1.doc   http://bit[.]ly/2vXgnqdASdj2929iqwSdu9iw9i http://stevemike-fireforce[.]info/work/doc/13.doc   http://bit[.]ly/4_loadingEwHlnA http://diamondfoxpanel[.]ml/doc/4.doc   http://bit[.]ly/lLoadingl9 http://fast-cargo[.]com/images/file/vb/VBS/doc/9.doc   http://bit[.]ly/LlLoadinG https://www.0-day[.]us/img/doc/2.doc   http://bit[.]ly/2kTPwmFdrwfdtsfdfyr http://stemtopx[.]com/work/doc/1.doc   http://bit[.]ly/2G34tww http://fast-cargo[.]com/old/images/file/vb/VBS/smon/doc/testa.doc   http://bit[.]ly/2HvQBir http://stevemike-fireforce[.]info/work/dola/3.doc   http://bit[.]ly/golden_uae http://fast-cargo[.]com/old/images/file/vb/VBS/smon/doc/xchange.doc   http://bit[.]ly/pele2HROHp1 http://acorn-paper[.]com/images/locations/thumbnails/z/oc/z.doc   http://bit[.]ly/2rlqLDBMSloading http://panelonetwothree[.]ml/iran/uae/done/oc2/uae.doc   http://bit[.]ly/2JDUVMC http://stemtopx[.]com/work/doc/11.doc   http://bit[.]ly/2K1GYVgtyfctftfTFTYFUFtufutfu http://stevemikeforce[.]com/work/doc/11.doc   http://bit[.]ly/2Jr4dby http://stemtopx[.]com/work/doc/18.doc   http://bit[.]ly/2M9I8z4 http://stemtopx[.]com/work/newdoc/2.doc   http://bit[.]ly/ASD8239ASdmkWi38AS http://stevemike-fireforce[.]info/work/dola/4.doc   http://bit[.]ly/LoadingPelasewaits http://stevemike-fireforce[.]info/work/docnew/2.doc   http://bit[.]ly/2JnNtG7 http://stemtopx[.]com/work/doc/17.doc   http://bit[.]ly/shawclk2HZJXOr http://panelonetwothree[.]ml/simon/exp/25exp/26/doc/final/26.doc   http://bit[.]ly/loadijgng http://onedrivenet[.]xyz/work/docnew/9.doc   http://bit[.]ly/PleaseWaitLoading http://www.asaigoldenrice[.]com/daq/doc/7.doc   http://bit[.]ly/Loadinger http://onedrivenet[.]xyz/work/docnew/1.doc   http://bit[.]ly/Workingwait http://onedrivenet[.]xyz/work/docnew/21.doc   http://bit[.]ly/Loadingplzwait http://www.asaigoldenrice[.]com/daq/doc/5.doc   http://bit[.]ly/2HuOFBQ http://stemtopx[.]com/work/doc/5.doc   http://bit[.]ly/LoadingPleasewait1 http://onedrivenet[.]xyz/work/docnew/20.doc   http://bit[.]ly/LlOrRinding http://www.0-day[.]us/img/doc/11.doc   http://bit[.]ly/Loadingwaitplzz http://onedrivenet[.]xyz/work/docnew/16.doc   http://bit[.]ly/2HWdrzTgfufuyfkCTYTDFYTgtfutf http://stevemikeforce[.]com/work/doc/12.doc   http://bit[.]ly/2KHEnRKxestrhdyhdDTDRDTRthdydy http://stevemikeforce[.]com/work/doc/10.doc   http://bit[.]ly/unkwonas http://asaigoldenrice[.]com/sim/new.vbs   http://bit[.]ly/Laodiingpleasewait http://onedrivenet[.]xyz/work/docnew/13.doc   http://bit[.]ly/wordxchange http://asaigoldenrice[.]com/sim/doc/kalu.doc   http://bit[.]ly/Loadsinfpleasewait http://onedrivenet[.]xyz/work/docnew/30.docx   http://bit[.]ly/Loardsing http://www.0-day[.]us/img/doc/7.doc   http://bit[.]ly/2ImbyrQ http://acorn-paper[.]com/administrator/6.doc   http://bit[.]ly/LoadingPleasewait http://onedrivenet[.]xyz/work/docnew/20.doc      Domains For a list of domains encountered in use by malware throughout this campaign, please refer to the following file

Tactics: TA0001, TA0003, TA0004, TA0005, TA0007, TA0011, TA0010
Techniques: T1071, T1090.003, T1566.003, T1048, T1566, T1574.002, T1083, T1566.001, T1571, T1008, T1090, T1574