Input: Palo Alto Networks customers are protected via the following:  WildFire identification and detection of malicious samples Command and control servers are classified as malicious AutoFocus tags have been created  Magic Hound MagicHound DropIt MagicHound Fetch MagicHound Retriever MagicHound Rollover MagicHound Leash MagicHound MPKBot PuPYRAT    INDICATORS OF COMPROMISE MagicHound.DropIt SHA256 c21074f340665935e6afe2a972c8d1ab517954e2dd05cc73e5ff0e8df587b99d ea139a73f8ec75ea60dfa87027c7c3ef4ed61b45e1acb5d1650cc54e658984ba da2abdc951e4b2272fea5c8989debd22e26350bab4b4219104bccec5b8a7ff5a 0d3ae682868cb3ff069ec52e1ffc5ef765453fd78e47b6366d96aebb09afd8ab f0ecc4388f0d84501499711681a64a74c5d95e0bb6a2174cbe3744bd5a456396 860f4cd44371a180a99bc16526f54f8b051c420a3df334d05d569d0cdadac3d2 b42b1186211633c2d47f3d815f0371ba234fee2ed0f26e487badc58e1ab81061 4beee6e7aa244335e161fdc05296ea100090c2114b4ff2e782e3ee3e1f936fdf 5e0e09c9860b293c4c9a2382a7392963adc54d6a23440abb9a2d89c50f8fd305 3161f9087d89a2d036ea32741d5a006c6bb279d36ff8d1acde63f2e354f8c502   MagicHound.Fetch PE SHA256 b6c159cad5a867895fd41c103455cebd361fc32d047b573321280b1451bf151c 6a7537f2cedbf453114cfba086e4746e698713777fb4fa4fc8964247dde741ed 16d87fbd8667677da1af5433b6d797438f8dc0ab565fb40ecb29f83f148888cd 92bc7d04445cf67aa7ddf15792cd62778d2d774d06616d1986f4c389b3d463f5 86d3409c908f667dd298b6a7e1e17652bb29af73e7daed4a5e945fbdf742e9f4 c3a8f5176351e87d28f45e58c79bb6646bb5d94ade7a24c6556514c860004143 a390365ddfcce146a8fa8435022f19b9a1be29f2b11a049cb660ec53f36beb06 d2ffc757a12817e4b58b3d58d71da951b177dedd3f65ca41fad04a03fc63fac6 79c9894b50cde62b182bd1560060c5c2bf5a1cef2b8afdffc4766e8c55ff6932 2f7f3582504fbce349a6991fbb3b5f9577c5c014b6ce889b80d51977fa6fb31a 8c2e4aa8d73ad2e48d70dfa18abea62769c7bef59c8c1607720f4f6162413f75 abe8e86b787998a07411ee24f3f3d8a79e37c6da539650ceed566b081f968c26 9e4d2e983f8a807f741f8873e6fa5d222dc6f3b358ccfc3a6c700398b342f656 e57f77cc3d117923ec01aa0e044edc11b1042e57993ca7f74d971630893ca263 ca6e823dedd6ca5fada2b1fa63d0acb288027f5a3cdd2c60dcace3c424c5ced0 eaaecabb439c81e522d9f5681fdb047ee62381e763f0d9646e68cd507479ba5a 1c3e527e496c4b0594a403d6d582bc6db3029d27369720d0d5122f862b10d8f1 29a659fb0ef0262e4de0dc3c6a140677b6ddee13c1819b791bd280be0547e309   MagicHound.Fetch PE C2 service.chrome-up[.]date www3.chrome-up[.]date www7.chrome-up[.]date timezone[.]live service1.chrome-up[.]date 104.238.184[.]252 www5.chrome-up[.]date servicesystem.serveirc[.]com   MagicHound.Fetch DOC SHA256 218fac3d0639c0d762fcf71685bcf6b64c33d1533df03b4cf223d9b07ca1e3c2 e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6 71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087 388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d 33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e 5469facc266d5582bd387d69032a91c8fff373213b66a2f0852666e72bcdc1da 528714aaaa4a083e72599c32c18aa146db503eee80da236b20aea11aa43bdf62 66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b cfce4827106c79a81eef6d3a0618c90bf5f15936036873573db76bed7e8a0864 68db2b363a88b061cc9063535f3920673f1f08d985b14cb52b898ced6c0f8964 e837f6b814c09900726dac2cf55f41babf361152875ba2a765a34ee5cc496087 f912d40de9fe9a726448c1d84dfba2d4941f57210b2dbc035f5d34d68e8ac143 af0ae0fa877f921d198239b7c722e12d14b2aa32fdfadaa37b47f558ae366de9 6d1a50ca3e80442fa3e2caca86c166ed60bef32c2d0af7352cd227303cdec031   MagicHound.Fetch DOC C2 45.76.128[.]165 139.59.46[.]154 104.218.120[.]128 89.107.62[.]39 69.87.223[.]26 analytics-google[.]org 89.107.60[.]11 www3.chrome-up[.]date www.microsoftsubsystem.com-adm[.]in www1.chrome-up[.]date   MagicHound.Fetch XLS SHA256 6c195ea18c05bbf091f09873ed9cd533ec7c8de7a831b85690e48290b579634b 97943739ccf8a00036dd3cdd0ba48e17a82ab9b65cc22c17c6e6258e72bb9ade   MagicHound.Fetch XLS C2 45.76.128[.]165 139.59.46[.]154   Pupy Loaders SHA256 7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f 82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190   Pupy Loaders C2 139.59.46[.]154 www1.chrome-up[.]date   MagicHound.Retriever SHA256 1c550dc73b7a39b0cd21d3de7e6c26ece156253ac96f032efc0e7fcc6bc872ce 7cdbf5c035a64cb6c7ee8c204ad42b4a507b1fde5e6708ea2486942d0d358823 b2ea3fcd2bc493a5ac86e47029b076716ed22ef4487f9090f4aa1923a48015d6 3f23972a0e80983351bedf6ad45ac8cd63669d3f1c76f8834c129a9e0418fff1   MagicHound.Retriever C2 service.chrome-up[.]date msservice[.]site microsoftexplorerservices[.]cloud   MagicHound.Leash SHA256 133959be8313a372f7a8d95762722a6ca02bc30aaffde0cbcf6ba402426d02f5 ba3560d3c789984ca29d80f0a2ea38a224e776087e0f28104569630f870adaf4 d8731a94d17e0740184910ec81ba703bad5ff7afc92ba056f200533f668e07bf   MagicHound.Leash C2 45.56.123[.]129 syn.timezone[.]live   MPKBot SHA256 d08d737fa59edbea4568100cf83cff7bf930087aaa640f1b4edf48eea4e07b19   MPKBot C2 45.58.37[.]142 Appendix MAGICHOUND.ROLLOVER The Magic Hound campaign used Word and Excel documents as a delivery method, specifically documents that contain a malicious macro that attempts to load either the Pupy RAT or possibly Meterpreter

Tactics: TA0006, TA0007, TA0011, TA0010
Techniques: T1552.001, T1041, T1552, T1573, T1071, T1124, T1571, T1008, T1102