Input: They are consistent and serve as stable IoC: %system32%driverswinntd_.dat %system32%driverswinntd.dat %system32%driverswincache.dat %system32%driversmlang.dat %system32%driversosver32nt.dat %LOCALAPPDATA%adobewind002.dat %LOCALAPPDATA%adobesettings.sol %LOCALAPPDATA%adobewinver.dat %LOCALAPPDATA%adobecache.dat BE2 also uses start menu locations for persistence: UsersuserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupflashplayerapp.exe BE3 uses the following known filenames: %USERPROFILE%NTUSER.LOG %LOCALAPPDATA%FONTCACHE.DAT BE2 MD5s: d57ccbb25882b16198a0f43285dafbb4 7740a9e5e3feecd3b7274f929d37bccf 948cd0bf83a670c05401c8b67d2eb310 f2be8c6c62be8f459d4bb7c2eb9b9d5e 26a10fa32d0d7216c8946c8d83dd3787 8c51ba91d26dd34cf7a223eaa38bfb03 c69bfd68107ced6e08fa22f72761a869 3cd7b0d0d256d8ff8c962f1155d7ab64 298b9a6b1093e037e65da31f9ac1a807 d009c50875879bd2aefab3fa1e20be09 88b3f0ef8c80a333c7f68d9b45472b88 17b00de1c61d887b7625642bad9af954 27eddda79c79ab226b9b24005e2e9b6c 48937e732d0d11e99c68895ac8578374 82418d99339bf9ff69875a649238ac18 f9dcb0638c8c2f979233b29348d18447 72372ffac0ee73dc8b6d237878e119c1 c229a7d86a9e9a970d18c33e560f3dfc ef618bd99411f11d0aa5b67d1173ccdf 383c07e3957fd39c3d0557c6df615a1a 105586891deb04ac08d57083bf218f93 1deea42a0543ce1beeeeeef1ffb801e5 7d1e1ec1b1b0a82bd0029e8391b0b530 1f751bf5039f771006b41bdc24bfadd3 d10734a4b3682a773e5b6739b86d9b88 632bba51133284f9efe91ce126eda12d a22e08e643ef76648bec55ced182d2fe 04565d1a290d61474510dd728f9b5aae 3c1bc5680bf93094c3ffa913c12e528b 6a03d22a958d3d774ac5437e04361552 0217eb80de0e649f199a657aebba73aa 79cec7edf058af6e6455db5b06ccbc6e f8453697521766d2423469b53a233ca7 8a449de07bd54912d85e7da22474d3a9 3f9dc60445eceb4d5420bb09b9e03fbf 8f459ae20291f2721244465aa6a6f7b9 4b323d4320efa67315a76be2d77a0c83 035848a0e6ad6ee65a25be3483af86f2 90d8e7a92284789d2e15ded22d34ccc3 edb324467f6d36c7f49def27af5953a5 c1e7368eda5aa7b09e6812569ebd4242 ec99e82ad8dbf1532b0a5b32c592efdf 391b9434379308e242749761f9edda8e 6bf76626037d187f47a54e97c173bc66 895f7469e50e9bb83cbb36614782a33e 1feacbef9d6e9f763590370c53cd6a30 82234c358d921a97d3d3a9e27e1c9825 558d0a7232c75e29eaa4c1df8a55f56b e565255a113b1af8df5adec568a161f3 1821351d67a3dce1045be09e88461fe9 b1fe41542ff2fcb3aa05ff3c3c6d7d13 53c5520febbe89c25977d9f45137a114 4513e3e8b5506df268881b132ffdcde1 19ce80e963a5bcb4057ef4f1dd1d4a89 9b29903a67dfd6fec33f50e34874b68b b637f8b5f39170e7e5ada940141ddb58 c09683d23d8a900a848c04bab66310f1 6d4c2cd95a2b27777539beee307625a2 e32d5c22e90cf96296870798f9ef3d15 64c3ecfd104c0d5b478244fe670809cc b69f09eee3da15e1f8d8e8f76d3a892a 294f9e8686a6ab92fb654060c4412edf 6135bd02103fd3bab05c2d2edf87e80a b973daa1510b6d8e4adea3fb7af05870 8dce09a2b2b25fcf2400cffb044e56b8 6008f85d63f690bb1bfc678e4dc05f97 1bf8434e6f6e201f10849f1a4a9a12a4 6cac1a8ba79f327d0ad3f4cc5a839aa1 462860910526904ef8334ee17acbbbe5 eeec7c4a99fdfb0ef99be9007f069ba8 6bbc54fb91a1d1df51d2af379c3b1102 8b152fc5885cb4629f802543993f32a1 6d1187f554040a072982ab4e6b329d14 3bfe642e752263a1e2fe22cbb243de57 c629933d129c5290403e9fce8d713797 1c62b3d0eb64b1511e0151aa6edce484 811fcbadd31bccf4268653f9668c1540 0a89949a3a933f944d0ce4c0a0c57735 a0f594802fbeb5851ba40095f7d3dbd1 bf6ce6d90535022fb6c95ac9dafcb5a5 df84ff928709401c8ad44f322ec91392 fda6f18cf72e479570e8205b0103a0d3 39835e790f8d9421d0a6279398bb76dc fe6295c647e40f8481a16a14c1dfb222 592c5fbf99565374e9c20cade9ac38aa ad8dc222a258d11de8798702e52366aa bc21639bf4d12e9b01c0d762a3ffb15e 3122353bdd756626f2dc95ed3254f8bf e02d19f07f61d73fb6dd5f7d06e9f8d2 d2c7bf274edb2045bc5662e559a33942 ac1a265be63be7122b94c63aabcc9a66 e06c27e3a436537a9028fdafc426f58e 6cf2302e129911079a316cf73a4d010f 38b6ad30940ddfe684dad7a10aea1d82 f190cda937984779b87169f35e459c3a 698a41c92226f8e444f9ca7647c8068c bc95b3d795a0c28ea4f57eafcab8b5bb 82127dc2513694a151cbe1a296258850 d387a5e232ed08966381eb2515caa8e1 f4b9eb3ddcab6fd5d88d188bc682d21d 8e42fd3f9d5aac43d69ca740feb38f97 a43e8ddecfa8f3c603162a30406d5365 ea7dd992062d2f22166c1fca1a4981a1 7bf6dcf413fe71af2d102934686a816b cf064356b31f765e87c6109a63bdbf43 4a46e2dc16ceaba768b5ad3cdcb7e097 2134721de03a70c13f2b10cfe6018f36 7add5fd0d84713f609679840460c0464 cc9402e5ddc34b5f5302179c48429a56 9803e49d9e1c121346d5b22f3945bda8 c5f5837bdf486e5cc2621cc985e65019 2b72fda4b499903253281ebbca961775 7031f6097df04f003457c9c7ecbcda1c 6a6c2691fef091c1fc2e1c25d7c3c44c 9bd3fa59f30df5d54a2df385eba710a5 5100eb13cac2fc3dec2d00c5d1d3921c 0a2c2f5cf97c65f6473bdfc90113d81e 30b74abc22a5b75d356e3a57e2c84180 a0424e8436cbc44107119f62c8e7491b c1ba892d254edd8a580a16aea6f197e9 e70976785efcfaeed20aefab5c2eda60 397b5d66bac2eb5e950d2a4f9a5e5f2c 4e9bde9b6abf7992f92598be4b6d1781 54d266dee2139dd82b826a9988f35426 5b4faa2846e91e811829a594fecfe493 907448af4388072cdc01e69b7b97b174 ccad214045af69d06768499a0bd3d556 1395dfda817818c450327ab331d51c1b 715e9e60be5a9b32075189cb04a0247e 3835c8168d66104eed16c2cd99952045 f32c29a620d72ec0a435982d7a69f683 95e9162456d933fff9560bee3c270c4e da01ef50673f419cf06b106546d06b50 2dd4c551eacce0aaffedf4e00e0d03de 34f80f228f8509a67970f6062075e211 81ca7526881a0a41b6721048d2f20874 d642c73d0577dd087a02069d46f68dac BE3 MD5s: f0ebb6105c0981fdd15888122355398c 7cb6363699c5fd683187e24b35dd303e 4d5c00bddc8ea6bfa9604b078d686d45 f37b67705d238a7c2dfcdd7ae3c6dfaa 46649163c659cba8a7d0d4075329efa3 628ef31852e91895d601290ce44650b1 723eb7a18f4699c892bc21bba27a6a1a 8b9f4eade3a0a650af628b1b26205ba3 f6c47fcc66ed7c3022605748cb5d66c6 6c1996c00448ec3a809b86357355d8f9 faab06832712f6d877baacfe1f96fe15 2c72ef155c77b306184fa940a2de3844 2e62e8949d123722ec9998d245bc1966 b0dc4c3402e7999d733fa2b668371ade 93fa40bd637868a271002a17e6dbd93b f98abf80598fd89dada12c6db48e3051 8a7c30a7a105bd62ee71214d268865e3 2f6582797bbc34e4df47ac25e363571d 81d127dd7957e172feb88843fe2f8dc1 3e25544414030c961c196cea36ed899d Previous and Parallel Research Botnet History Illustrated by BlackEnergy 2, PH Days, Kaspersky Lab – Maria Garnaeva and Sergey Lozhkin, May 2014 BlackEnergy and Quedagh (pdf), F-Secure, September 2014 Sandworm, iSIGHT Partners, October 2014 Alert (ICS-ALERT-14-281-01A) Ongoing Sophisticated Malware Campaign Compromising ICS (Update A), ICS-CERT, October 2014

Tactics: TA0005, TA0007, TA0009
Techniques: T1007, T1036, T1074