Input: At least three variants of PLAINTEE have been identified to date, however, the following two samples have additional unique differences:      Hash Functions Mutex   bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e helloworld helloworld1,helloworld2,sqmAddTostream,DllEntryPoint microsoftfuckedup   6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31      The following actions are performed with the additional functions:  helloworld – performs actions identical to the newer sample’s ‘Sub’ function helloworld1 – accepts command-line arguments, performs a UAC bypass helloworld2 – drops and compiles a mof filemof file   sqmAddTostream – expected to run initially by the malware, checks OS version and loads the malware with helloworld2  Appendix B    Type Value Cluster   Loaders   Hash 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 B   Hash 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 B   Domain www.facebook-apps.com B   Domain dlj40s.jdanief.xyz B   IP 89.46.222.97 B   Hash a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 A   PLAINTEE   Hash 863a9199decf36895d5d7d148ce9fd622e825f393d7ebe7591b4d37ef3f5f677 A   Hash 22a5bd54f15f33f4218454e53679d7cfae32c03ddb6ec186fb5e6f8b7f7c098b A   Hash c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d B   IP 199.247.6.253 A   IP 45.76.176.236 A   Mutex microsoftfuckedupb A   Hash 9f779d920443d50ef48d4abfa40b43f5cb2c4eb769205b973b115e04f3b978f5 A   Hash bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e A   Hash 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 A   Hash b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 A   Domain goole.authorizeddns.us A   Mutex Microsoftfuckedup A   IP 103.75.189.74 A   IP 131.153.48.146 A   DDKONG   Hash 15f4c0a589dff62200fd7c885f1e7aa8863b8efa91e23c020de271061f4918eb A   Domain microsoft.authorizeddns.us A   IP 103.75.191.177 A   Hash 0f102e66bc2df4d14dc493ba8b93a88f6b622c168e0c2b63d0ceb7589910999d A   Hash 84607a2abfd64d61299b0313337e85dd371642e9654b12288c8a1fc7c8c1cf0a A   Hash a725abb8fe76939f0e0532978eacd7d4afb4459bb6797ec32a7a9f670778bd7e A   Hash 82e1e296403be99129aced295e1c12fbb23f871c6fa2acafab9e08d9a728cb96 A   Hash 9996e108ade2ef3911d5d38e9f3c1deb0300aa0a82d33e36d376c6927e3ee5af A   Domain www.google_ssl.onmypc.org A   Hash 18e102201409237547ab2754daa212cc1454f32c993b6e10a0297b0e6a980823 A   IP 103.75.191.75 A   Hash c78fef9ef931ffc559ea416d45dc6f43574f524ba073713fddb79e4f8ec1a319 A   Hash 01315e211bac543195f2c703033ba31b229001f844854b147c4b2a0973a7d17b A   Hash b8528c8e325db76b139d46e9f29835382a1b48d8941c47060076f367539c2559 A   Hash df14de6b43f902ac8c35ecf0582ddb33e12e682700eb55dc4706b73f5aed40f6 A   Hash 177906cb9170adc26082e44d9ad1b3fbdcba7c0b57e28b614c1b66cc4a99f906 A   Hash 113ae6f4d6a2963d5c9a7f42f782b176da096d17296f5a546433f7f27f260895 A   Domain ftp.chinhphu.ddns.ms A   Hash 128adaba3e6251d1af305a85ebfaafb2a8028eed3b9b031c54176ca7cef539d2 A   Domain www.microsoft.https443.org A   IP 45.121.146.26 A   Hash 5afbee76af2a09c173cf782fd5e51b5076b87f19b709577ddae1c8e5455fc642 A   Domain msdns.otzo.com A   Hash 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 A   Domain goole.authorizeddns.us A   IP 103.75.189.74 A

Tactics: TA0005, TA0007, TA0008, TA0011, TA0010
Techniques: T1550.002, T1573, T1048, T1027, T1016, T1550, T1027.001