Input: Public    TURNEDUP  Backdoor capable of uploading and downloading files, creating a reverse shell, taking screenshots, and gathering system information  Non-Public   Indicators of Compromise APT33 Domains Likely Used in Initial Targeting    Domain    boeing.servehttp[.]com    alsalam.ddns[.]net    ngaaksa.ddns[.]net    ngaaksa.sytes[.]net    vinnellarabia.myftp[.]org   APT33 Domains / IPs Used for C2    C2 Domain  MALWARE    managehelpdesk[.]com  NANOCORE    microsoftupdated[.]com  NANOCORE    osupd[.]com  NANOCORE    mywinnetwork.ddns[.]net  NETWIRE    www.chromup[.]com  TURNEDUP    www.securityupdated[.]com  TURNEDUP    googlmail[.]net  TURNEDUP    microsoftupdated[.]net  TURNEDUP    syn.broadcaster[.]rocks  TURNEDUP    www.googlmail[.]net  TURNEDUP   Publicly Available Tools used by APT33    MD5  MALWARE  Compile Time (UTC)    3f5329cf2a829f8840ba6a903f17a1bf  NANOCORE  2017/1/11 2:20    10f58774cd52f71cd4438547c39b1aa7  NANOCORE  2016/3/9 23:48    663c18cfcedd90a3c91a09478f1e91bc  NETWIRE  2016/6/29 13:44    6f1d5c57b3b415edc3767b079999dd50  NETWIRE  2016/5/29 14:11   Unattributed DROPSHOT / SHAPESHIFT MD5 Hashes     MD5   MALWARE   Compile Time (UTC)    0ccc9ec82f1d44c243329014b82d3125  DROPSHOT (drops SHAPESHIFT  n/a - timestomped    fb21f3cea1aa051ba2a45e75d46b98b8  DROPSHOT  n/a - timestomped    3e8a4d654d5baa99f8913d8e2bd8a184  SHAPESHIFT  2016/11/14 21:16:40    6b41980aa6966dda6c3f68aeeb9ae2e0  SHAPESHIFT  2016/11/14 21:16:40   APT33 Malware MD5 Hashes    MD5  MALWARE  Compile Time (UTC)    8e67f4c98754a2373a49eaf53425d79a  DROPSHOT (drops TURNEDUP)  2016/10/19 14:26    c57c5529d91cffef3ec8dadf61c5ffb2  TURNEDUP  2014/6/1 11:01    c02689449a4ce73ec79a52595ab590f6  TURNEDUP  2016/9/18 10:50    59d0d27360c9534d55596891049eb3ef  TURNEDUP  2016/3/8 12:34    59d0d27360c9534d55596891049eb3ef  TURNEDUP  2016/3/8 12:34    797bc06d3e0f5891591b68885d99b4e1  TURNEDUP  2015/3/12 5:59    8e6d5ef3f6912a7c49f8eb6a71e18ee2  TURNEDUP  2015/3/12 5:59    32a9a9aa9a81be6186937b99e04ad4be  TURNEDUP  2015/3/12 5:59    a272326cb5f0b73eb9a42c9e629a0fd8  TURNEDUP  2015/3/9 16:56    a813dd6b81db331f10efaf1173f1da5d  TURNEDUP  2015/3/9 16:56    de9e3b4124292b4fba0c5284155fa317  TURNEDUP  2015/3/9 16:56    a272326cb5f0b73eb9a42c9e629a0fd8  TURNEDUP  2015/3/9 16:56    b3d73364995815d78f6d66101e718837  TURNEDUP  2014/6/1 11:01    de7a44518d67b13cda535474ffedf36b  TURNEDUP  2014/6/1 11:01    b5f69841bf4e0e96a99aa811b52d0e90  TURNEDUP  2014/6/1 11:01    a2af2e6bbb6551ddf09f0a7204b5952e  TURNEDUP  2014/6/1 11:01    b189b21aafd206625e6c4e4a42c8ba76  TURNEDUP  2014/6/1 11:01    aa63b16b6bf326dd3b4e82ffad4c1338  TURNEDUP  2014/6/1 11:01    c55b002ae9db4dbb2992f7ef0fbc86cb  TURNEDUP  2014/6/1 11:01    c2d472bdb8b98ed83cc8ded68a79c425  TURNEDUP  2014/6/1 11:01    c6f2f502ad268248d6c0087a2538cad0  TURNEDUP  2014/6/1 11:01    c66422d3a9ebe5f323d29a7be76bc57a  TURNEDUP  2014/6/1 11:01    ae47d53fe8ced620e9969cea58e87d9a  TURNEDUP  2014/6/1 11:01    b12faab84e2140dfa5852411c91a3474  TURNEDUP  2014/6/1 11:01    c2fbb3ac76b0839e0a744ad8bdddba0e  TURNEDUP  2014/6/1 11:01    a80c7ce33769ada7b4d56733d02afbe5  TURNEDUP  2014/6/1 11:01    6a0f07e322d3b7bc88e2468f9e4b861b  TURNEDUP  2014/6/1 11:01    b681aa600be5e3ca550d4ff4c884dc3d  TURNEDUP  2014/6/1 11:01    ae870c46f3b8f44e576ffa1528c3ea37  TURNEDUP  2014/6/1 11:01    bbdd6bb2e8827e64cd1a440e05c0d537  TURNEDUP  2014/6/1 11:01    0753857710dcf96b950e07df9cdf7911  TURNEDUP  2013/4/10 10:43    d01781f1246fd1b64e09170bd6600fe1  TURNEDUP  2013/4/10 10:43    1381148d543c0de493b13ba8ca17c14f  TURNEDUP  2013/4/10 10:43

Tactics: TA0004, TA0011
Techniques: T1573, T1068