Input: Contact: intelreports@kaspersky.com Indicators of compromise MD5 08acd1149b09bf6455c553f512b51085 a9ec30226c83ba6d7abb8d2011cdae14 E5683fb480353c0dec333a7573710748 159238b473f80272fdcd0a8ddf336a91 16ac1a2c1e1c3b49e1a3a48fb71cc74f 1b086ab28e3d6f73c6605f9ae087ad4a 23c82e8c028af5c64cbe37314732ec19 24e1bd221ba3813ed7b6056136237587 2e82e242cb0684b98a8f6f2c0e8a12f3 37f7e6e5f073508e1ee552ebea5d200e 3bb14adb551663fd2328d59f653ba757 3c2a0d6d0ecf06f1be9ad411d06f7ba8 4c5a5c236c9f4480b3d725f297673fad 4f873578956d2790101443f24e4bd4d3 5466c8a099d1d30096775b1f4357d3cf 59502e209aedf80e170e653306ca1553 5a42a712e3b3cfa1db32d9e3d832f8f1 5bd61a94e7698574eaf82ef277316463 5de97ae178888f2dd222bb8a66060ac2 665947cf7037a6772687b69279753cdf 7a2ff07283ddc69d9f34cfa0d3c936d4 7beb94f602e97785370fec2d059d54a5 801f34abbf90ac2b4fb4b6289830cd16 864d6321be50f29e7a7a4bfab746245a 8a36d91ca331f62642dbcafc2ea1b1ab 9486593e4fb5a4d440093d54a3519187 94edf251b5fe7cc19488b5f0c3c3e359 9c6648cedeb3f5d9f6d104e638bd0c3d 9f4044674100a8c28f9ed1b336c337ce aa1e8d0e1c4d4eb9984124df003ea7f2 aa564e207926d06b8a59ba50ca2c543d ab4f947f4649b9ec28d182b02778aa69 ad92ccf85ec170f340457d33bbb81df5 b8939fa58fad8aa1ec271f6dae0b7255 bb476622bcb0c666e12fbe4ccda8bbef be62fc5b1576e0a8491519e10bab931d bf310319d6ef95f69a45fc4f2d237ed4 c375bbf248592cee1a1999227457c300 c73fc71ee35e99230941f03fc32934d9 c8b0458c384fd34971875b1c753c9c7c cd371d1d3bd7c8e2110587cfa8b7eaea ce2df2907ce543438c19cfaf6c14f699 d15aee026074fbd18f780fb51ec0632a d632c8444aab1b43a663401e80c0bac4 d6acee43d61cbd4bcd7a5bdf4ed9b343 e3e25957b738968befcf2333aa637d97 e5683fb480353c0dec333a7573710748 eb69fb45feb97af81c2f306564acc2da f00fd318bf58586c29ab970132d1fd2a f2b5373f32a4b9b3d34701ff973ba69c f84914c30ae4e6b9b1f23d5c01e001ed faa4469d5cd90623312c86d651f2d930 Ffb8ea0347a3af3dd2ab1b4e5a1be18a 345b1ea293764df86506f97ba498cc5e 029cb7e622f4eb0d058d577c9d322e92 06178b5181f30ce00cd55e2690f667ac 2b8ab9112e34bb910055d85ec800db3f 47ec75d3290add179ac5218d193bb9a8 befc203d7fa4c91326791a73e6d6b4da C561e81e30316208925bfddb3cf3360a 132efd7b3bdfb591c1bf2a4e19c710eb e7a6c57566d9523daa57fe16f52e377e c0e35c4523a7931f4c99616d6079fd14 245fa82c89875b70c2669921d4ba14d3 File names %SystemDrive%\ProgramData\EventManager.dll %SystemDrive%\ProgramData\EventManager.logs %SystemDrive%\ProgramData\WindowsDefenderService.ini %SystemDrive%\ProgramData\Defender.sct %SystemDrive%\ProgramData\DefenderService.inf %SystemDrive%\ProgramData\WindowsDefender.ini %SystemDrive%\ProgramData\ZIPSDK\InstallConfNT.vbs %SystemDrive%\ProgramData\ZIPSDK\ProjectConfManagerNT.ini %SystemDrive%\ProgramData\WindowsDefenderTask.ini %SystemDrive%\ProgramData\WindowsDefenderTask.txt %SystemDrive%\ProgramData\WindowsDefenderTask.xml %SystemDrive%\ProgramData\DefenderNT\ConfigRegister.vbs %SystemDrive%\ProgramData\DefenderNT\SetupConf.ini %SystemDrive%\ProgramData\ASDKiMalwareSDK\ProjectConfSDK.vbs %SystemDrive%\ProgramData\ASDKiMalwareSDK\SetupConfSDK.ini %SystemDrive%\ProgramData\FirefoxSDK\ConfigRegisterSDK.ini %SystemDrive%\ProgramData\FirefoxSDK\ConfigRegisterSDK.vbs %SystemDrive%\ProgramData\OneDrive.dll %SystemDrive%\ProgramData\OneDrive.html %SystemDrive%\ProgramData\OneDrive.ini %SystemDrive%\ProgramData\WindowsNT\WindowsNT.ini %SystemDrive%\ProgramData\WindowsNT\WindowsNT.vbs %SystemDrive%\ProgramData\SYSTEM32SDK\ConfManagerNT.vbs %SystemDrive%\ProgramData\SYSTEM32SDK\ProjectConfManagerNT.ini %windir%\System32\Tasks\Microsoft\WindowsDefenderUpdater %windir%\System32\Tasks\Microsoft\MicrosoftOneDrive %windir%\System32\Tasks\Microsoft\WindowsDifenderUpdate %windir%\System32\Tasks\Microsoft\WindowsSystem32SDK %windir%\System32\Tasks\Microsoft\WindowsDefenderSDK %windir%\System32\Tasks\Microsoft\WindowsMalwareDefenderSDK %windir%\System32\Tasks\Microsoft\WindowsMalwareByteSDK Domains, URLs and IP addresses http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php https://www.adfg[.]ae/wp-includes/widgets/main.php http://adibf[.]ae/wp-includes/js/main.php http://hubinasia[.]com/wp-includes/widgets/main.php https://benangin[.]com/wp-includes/widgets/main.php 104.237.233.60 104.237.255.212 104.237.233.40 5.9.0.155

Tactics: TA0002, TA0003, TA0004, TA0005, TA0007, TA0011
Techniques: T1053.005, T1140, T1053, T1203, T1071, T1090.003, T1553, T1553.002, T1083, T1564, T1090, T1564.001