Input: Wiknet.wikaba.com (192.169.7.250) Wiknet.mooo.com   342a4d93df060289b2d8362461875905 Oct 2018 تسريب من داخل القنصلية السعودية حول مقتل جمال خاشقجي.exe Translation: Leak from the Saudi consulate on the death of Jamal Khashoggi Time-loss.dns05.com (192.169.7.250)   c9cae9026ee2034626e4a43cfdd8b192 Jan 2019 محضر اجتماع السفير القطري العمادي مع الوفد المصري في رام الله .exe Translation: Minutes of meeting of Qatari Ambassador Emadi with the Egyptian delegation in Ramallah Time-loss.dns05.com (192.169.7.250) dji-msi.2waky.com    Appendix II – Indicators of compromise    Type IoC Description   RAR md5 E686FFA90B2BFB567547F1C0DAD1AE0B Stage 1 executable / lure   RAR md5 CE5AA4956D4D0D66BED361DDD7DB1A3B Stage 1 executable / lure   RAR md5 4F34902C9F458008BAE26BFA5C1C00DA Stage 1 executable / lure   RAR md5 535F8EA65969A84A68CEAF88778C6176 Stage 1 executable / lure   RAR md5 E8A29C7A6F6C0140152CA8A01E336B37 Stage 1 executable / lure   RAR md5 E782610BF209E81ECC42CA94B9388580 Stage 1 executable / lure   RAR md5 F9BCC21FBB40247167C8C85ED6EF56E3 Stage 1 executable / lure   EXE md5 33369AFD3042326E964139CABA1888D3 Stage 2 executable (19182-exe) that invokes Pastebin chain   EXE md5 2AD88AE20D8F4CB2C74CAE890FEB337A Stage 2 executable (1918-exe) that invokes Pastebin chain   EXE md5 55929FF3E67D79F9E1E205EBD38BC494 Stage 2 executable (21918-exe) that invokes Pastebin chain   EXE md5 DA486DF0D8E03A220808C3BFA5B40D06 Stage 2 executable (Adope-exe) that invokes Pastebin chain   EXE md5 C7F98F890B21C556D16BFF55E33C33AB Stage 2 executable (Application-exe) that invokes Pastebin chain   EXE md5 FAFCC11AF99ACF1B70997BC4BF36CFC0 Stage 2 executable (bind-exe) which is a backdoored Tile Slide Puzzle computer game that invokes Pastebin chain – code freely available   EXE md5 28CACBF64141F50426830B385AB1BE4C Dell-cmd – Command string to Delete User Temp directory   EXE md5 F30C00E87C7EE27033DC0AC421F3B4F8 Stage 2 executable (D-exe) that invokes Pastebin chain   EXE md5 51A59AEC24B5046EC4615728A5B52802 Stage 2 executable (Dv-exe) that invokes Pastebin chain   EXE md5 98BDE191AE6E2F7D8D4166C4B21A27D2 Office-vbs – github.gist lolpoke/system1   EXE md5 9E152A6ADCB57D44284AF3B6FD0C94C2 Stage 2 executable (p0w-exe) that invokes Pastebin chain   EXE md5 CAB62BB5F00FE15683C6AF760C8E8F7E wPic4-exe – RAT executable similar to Pictures4.exe   EXE md5 192DD65864119017AA307BE3363E31BB Powe1-exe – executable that uses scheduled tasks to execute VB scripts   EXE md5 71E462260F45C5E621A5F5C9A5724844 WinPeggy4-exe – backdoored Peggy Bees computer game – source code available on Microsoft site   EXE md5 AB98768D2440E72F42FCD274806F8D2A WinPeggy-exe – another variant of WinPeggy4.exe   EXE md5 DAACE673B1F4DFE8A4D3D021C5190483 Word-hta – VBS code to invoke PowerShell from github.gist..0lol0/system1.ps1   EXE md5 1529AE427FE4EB2D9B4C3073B2AA9E10 Word-vbs – VBS code to invoke PowerShell from github.gist lolpoke/system1.ps1   Powershell md5 CCD324DF0F606469FCA3D1C6FFA951AD System1.ps1 – PowerShell script that invoke a binary in memory that uses NETSH commands to allow programs, then execute a Trojan downloaded from myftp[.]biz   Powershell md5 D153FF52AE717D8CF26BEF57BDB7867D Install.ps1 – PowerShell script that invoke a cobalt strike beacon   EXE md5 AD1C91BF5E7D1F0AAF2E4EFB8FB79ADE Stage 2 executable (res-vbs) that invokes Pastebin chain   EXE md5 EE3AD5B06DBC6CCA7FDC9096697A9B4A Re-vbs – VBS script that uses Pastebin data to create scheduled task and run JScript to invoke RAT   EXE md5 805CA34E94DA9615C13D8AF48307FB07 Folder.exe – another RAT variant based on Pastebin chain   EXE md5 F330703C07DDD19226A48DEBA4E8AA08 Stage 2 executable (shell-exe) that invokes Pastebin chain   EXE md5 CFD2178185C40C9E30AADA7E3F667D4B Another RAT variant based on Pastebin chain   EXE md5 C2EE081EC3ADEF4AFACAB1F326EE50FF 2poker2.exe – use PowerShell command to invoke base64 string from Pastebin and create another RAT variant   EXE md5 B3A472F81F800B32FE6595F44C9BF63B Stage 1 executable / lure   EXE md5 DF3F3AD279CA98F947214FFB3C91C514 Stage 1 executable / lure   EXE md5 221EEF8511169C0496BBC79F96E84A4A Stage 1 executable / lure   EXE md5 62DF4BC3738BE5AD4892200A1DC6B59A Stage 1 executable / lure   EXE md5 55D33D9DA371FDFE7871F2479621444A Stage 1 executable / lure   EXE md5 838696872F924D28B08AAAA67388202E Stage 1 executable / lure   EXE md5 E8BE9843C372D280A506AC260567BF91 Stage 1 executable / lure   EXE md5 55D33D9DA371FDFE7871F2479621444A Stage 1 executable / lure   EXE md5 D9DBB65A42FFE0575F0E99F7498A593E Stage 1 executable / lure   EXE md5 5DB18AB35D29D44DDA109F49D1B99F38 Stage 1 executable / lure   EXE md5 DAE24E4D1DFCDD98F63F7DE861D95182 Stage 1 executable / lure   EXE md5 2358DBB85A29167FA66EE6BF1A7271CD Stage 1 executable / lure   EXE md5 10DFA690662B9C6DB805B95500FC753D Stage 1 executable / lure   EXE md5 6B5946E326488A8C8DA3AAEC2CB6E70F Stage 1 executable / lure   EXE md5 342A4D93DF060289B2D8362461875905 Stage 1 executable / lure   EXE md5 C9CAE9026EE2034626E4A43CFDD8B192 Stage 1 executable / lure   Network dji-msi.2waky.com External C2 domain; rotates with the others over time   Network checktest.www1.biz External C2 domain; rotates with the others over time   Network fulltest.yourtrap.com External C2 domain; rotates with the others over time   Network microsoft10.compress.to External C2 domain; rotates with the others over time   Network mmh.ns02.us External C2 domain; rotates with the others over time   Network ramliktest.mynetav.org External C2 domain; rotates with the others over time   Network testhoward.mysecondarydns.com External C2 domain; rotates with the others over time   Network testmace.compress.to External C2 domain; rotates with the others over time   Network time-loss.dns05.com External C2 domain; rotates with the others over time   Network wiknet.mooo.com External C2 domain; rotates with the others over time   Network Wiknet.wikaba.com External C2 domain; rotates with the others over time   Network supports.mefound.com External C2 domain; rotates with the others over time   Network saso10.myftp.biz External C2 server used by PowerShell scripts to download malware   Network 192.169.7.250 External C2 server (most active)   Network 104.200.67.190 External C2 server (least active)   Network 185.117.72.190 External C2 server (least active)   Network 45.63.97.44 External C2 server (least active)

Tactics: TA0004, TA0005, TA0007, TA0008, TA0011, TA0010
Techniques: T1041, T1218, T1573, T1036, T1021, T1021.002, T1046, T1055.012, T1124, T1055, T1102, T1218.010