Rewterz Threat Alert – APT MustangPanda – Active IOCs

May 10, 2022

Severity

High

Analysis Summary

Researchers have identified recent Mustang Panda activity that involves the use of DLL side-loading to deliver PlugX. The initial infection vector is an executable downloaded from a remote URL. The executable is responsible for installing the malware by dropping the required files (a DLL loader, a legitimate binary, and the PlugX payload) onto the system. The legitimate binary is the Adobe CEF Helper and is vulnerable to DLL side-loading. When the installer runs the legitimate binary, the dropped DLL is loaded. This DLL is the loader for the final payload. First, it reads a hardcoded .dat file that contains the XOR key for decrypting the final payload, then it performs the decryption and loads the malware into memory. Once running in memory, the PlugX payload is able to decrypt its configuration data, which includes its installation location, the XOR key for C2 communication, and any C2 addresses and ports

Impact

Information Theft
Exposure of Sensitive Data

Indicators of Compromise

IP

101[.]36[.]125[.]203
103[.]159[.]132[.]70
103[.]200[.]97[.]150
103[.]75[.]190[.]50
103[.]91[.]64[.]134
107[.]178[.]71[.]211
155[.]94[.]200[.]209
185[.]239[.]226[.]17
18[.]138[.]107[.]235
45[.]248[.]87[.]162
45[.]43[.]50[.]197
5[.]206[.]224[.]167
61[.]38[.]252[.]166
92[.]118[.]188[.]78
95[.]217[.]1[.]81

MD5

56f27cd9e8556e9c61fb60e6041e8c9d
b0a7b7a1cb4bf9a1de7f4b1af46ed956
f2ba9bdc31a95d249679f685dfd2a39f
84545b406b428a0028c6cb25dd85bf2d
7b2f41b57b9ab4151eb37ed69db9fdf8
25a14e50486c738bc92da69c02063e23
4b07e341a2bf00479dda19b18ca41362
69ab42012ddce428c73940dcf343910e
ad3ddb4cbe7ece8cb723f63f3b855b85
ae358c1915e794671a1d710d9359146d
6459baafa8ad9d4bd6b360d3a423f921
a84958c32cd9884a052be62bdbe929cf
fa063454e3bda1433bdd2725dfac4487
2102d225508c1f8f488a3f1574a34759
c7c9fee23de57ff885932849a237e6d5
530ed2cbfc57b9e6ae6c3fb3a1ecde9e
8a7e2c7d4be6f17a851bc6b3d10d0d45
66ee022fb975899281885d0e5af55fbe
fd7f4d575fd26bfd74c69ba1392368aa
50c750ddd7f79627f27e48a7dbafeec2
84d1d97d298fcbe237a6270b10e6984d
01d8305b91524d83ccf2c26c1b3b7f1f
f31d40ea1e73c82fcbfee606fb52169e
d404e3cd5f1c6a50f10f56f5c5b9c1e3
3c6173d8693510f6363b608c09feebb1
385a4ca1da76ca4cbbbed6e0ef659f1a
66ee022fb975899281885d0e5af55fbe
257813d292c494797a957f0992ba1405
c5f4da8c703696e2fc034cbcc3da6336
706e0f37a49e013b9fc73a5c05fc861a
c70d8dce46b4551133ecc58aed84bf0e
c43de22826a424b2d24cf1b4b694ce07
43529e54971a2302ae736c40f39d65df
e21e8f398c6d61ae8335664b1ad0444f
2d79767e4f6118afb9e86351be178b6d
fc9e85df9fcbaf261117e94d0132369e
67e017eb7658e390534abc6f55e6af49
3c99e3522923b6ec94093e04b7e13fa5
50b3fb6a2cf209d4bcbea0546e82f58f
3c7469e92990c6a879fad4e1e7fde5d2
3b63e3ab2b668abb7eba8f84602df48a
6cda632104ed1cfb1d03e2bbdb3e443c
84aef9e9285aff8d1551b0ee6f317292
34161eea2f66156969291d6ec53717c8
27daaa3f672d6c584dab4bed2cfda8e4
1072897b03d0566af54edb0f3826b834
6be83a1652c6b3dfb8663aebec3515c7
41aa7cdd6c9ed2ac0932d8084c89f28f
a5660a4a5314f45f67d36d04a37e3571
ac1c480ca73e1122893995fad3f7f469
e7904b4253f0b45fbe94a38b3946a621
81bebcb517930bef9ea182431719c132
6cda632104ed1cfb1d03e2bbdb3e443c
ba9565a7faad19b2f6e80a75877fe938
91440c1865391355b56dd7cc3edf89e8
89631ca603d9943c110fcf2c7fba0f6f
44739c501fcd8b9c0eb5b7f74fff9a00
35b69a125081c5efc6960af0f9b22948
3f4e55daf8722d0656b3f7b9bdd4c22d
b2a22ff19524a849dec35dc75124be91
fec055d1adf03781e3e1427dccdb94b9
80f4ee699f480a6a0c47866d79ea3f4a
363f07437cfa756ba2bcaa59e9da9416
bb1506cc3c26b3ee120fc7fd388a8a58
b502b41727f1e54b8475f9947777dbe7
d3ee0db7e36a88b4b446a5baae8eddf9
a5e391d64d5771c1150bbafaa4fba173
cc197ffd0972660b71d0f1ca86532119
e87769ace15726fdd508c56f7cb04fcd
4d8dcb1f33180c55e42d0d682a6596b3
c70d8dce46b4551133ecc58aed84bf0e
8568bae4c4bbd7f969ba3f1514a26c82
e123c2f0822ec9e459f3ba16793c14a7
697d783f4dfb937c82250fac4efed274
6ca3439153577503fd71f7039a0045ab
b8a78e4e76673b68e94f5312d7e3900d
37f19e06e38b2a8ad9d65a6575ad3413
befa31048a67e9bf37afa92c97f6fbe3
8b941c0b80312c1c630b9c0062d86e30
e9101cee85038bb0f306ef83bc36523c
4efd3d2f09f17dae19f1d5b967ec9949
332a4f864b1f7b1e166edb5d9b47e119
7f0079d2ef1fca0b4bf0789aad3d2b04
8b68dc5dbb99af7de3312771e828b6c8
37d1df5648c2e499b23b4228743f0318
34085fa3adebf09faac315540db16cb4
4a9b98832ba5c2b74f80dadd16b8a079
be8927e1d6ce992982976cc5f3dcbb92
13e51c336fe50f8cbc80a7fe06a3e788
5959d00e2d7b57e1e5885750c0900946
1d281c5353d1b12afb9c4a4ae61e5675
377956881a132dbb70c6f0dcf07b7d47
866ad225f9c997a68aa916ae9c8290f3
1d281c5353d1b12afb9c4a4ae61e5675
0ed497a020ba9ca230e378f339b82f07
030265a85b5c84a2263e9aae8562b86a
eeb2121925451ecb3eb5d79f18ca17cb
e0977e26e7b850e20fd94fefc79af65f
10d0b2b4fd787d43ae20244788d38e8c
d9172a525c8f4a7932559c2ea13ac002
fcd6691fc59610a50740a170a8a5a76f
e7d91f187ff9037d52458e2085929409
793d0e610ecac2da4a8b07ff2ff306ac
72dd4b3337e0c9a70cf772e2b21f87b9
6f580dc7648e7f9c025317f5ad096f3f

SHA-256

bee9c438aced1fb1ca7402ef8665ebe42cab6f5167204933eaa07b11d44641bb
dbdbc7ede98fa17c36ea8f0516cc50b138fbe63af659feb69990cc88bf7df0ad
18230e0cd6083387d74a01bfc9d17ee23c6b6ea925954b3d3c448c0abfc86bd2
668cc21387e01b87c438e778b3a08c964869ce2c7f22c59bcde6604112d77b2e
8a7fbafe9f3395272548e5aadeb1af07baeb65d7859e7a1560f580455d7b1fac
effd63168fc7957baf609f7492cd82579459963f80fc6fc4d261fbc68877f5a1
6019e6ee3dee2ec798667ccb34a2ab8d70bf5960d35f55157a9cb535b00b243f
436d5bf9eba974a6e97f6f5159456c642e53213d7e4f8c75db5275b66fedd886
ca622bdc2b66f0825890d36ec09e6a64e631638fd1792d792cfa02048c27c69f
492fd69150d0cb6765e5201c144e26783b785242f4cf807d3425f8b8df060062
2fc14451ef0ff0919995d46fedc7b7c7f9a9adbf9c40f6b36b480e637d581e6b
1aafbe976c3559b61531910c75f9bb90176641f565f9810a18dcde9564241164
7ded20b7d2c0428641a6ac272c15b444b37bf833bbbea09dc931d649e6dc5277
e1dbe58393268d7ddabd4bed0cdedf0fbba85d4c3ef1300580ed4c74e147aa61
16dd94c228b5e2050d01edfe4849ca1388e9b3f811d39380f6ada3e75c69b353
6fd9d745faa77a58ac84a5a1ef360c7fc1e23b32d49ca9c3554a1edc4d761885
706e53480da95b17d0f9f0f5dc37a50c7abc3f954ce15b4733fd964b03910627
537ac2f79db06191222ba7ae7b7843f063600f87971b8dffc4a31459d6a144b1
3aa80dd8ffbc7b364234cdf0849b10bcead52004fc803a74afb1bd504d024305
aa8fb15d63bd22b2ff15a9f1b4f4422b3c6af026915168c81d7bb38c9be2ab78
567fb0e6e6667ce1674cbdfd0ab26a8a3f68979256ef6680facf1d2d50a25dba
1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0
4c727e21312355cd9a9f0e1e0bb8fc3379f487968a832d00ffde9d5a04b8da9d
017ef960616182daa1ffabc5d5470340cc45bbd5ab3455d74987a3ae478fa118
5851043b2c040fb3dce45c23fb9f3e8aefff48e0438dec7141999062d46c592d
e2aff9d2f5e75bdc09712722d919f2261f638b0b4da878e405b86b927dcaf1e3
537ac2f79db06191222ba7ae7b7843f063600f87971b8dffc4a31459d6a144b1
ec32ff0c049bd8812a35aeaaaae1f66eaf0ce8aefce535d142862ae89435c2e2
930b7a798e3279b7460e30ce2f3a2deccbc252f3ca213cb022f5b7e6a25a0867
6a5b0cfdaf402e94f892f66a0f53e347d427be4105ab22c1a9f259238c272b60
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681
e3e3c28f7a96906e6c30f56e8e6b013e42b5113967d6fb054c32885501dfd1b7
235752f22f1a21e18e0833fc26e1cdb4834a56ee53ec7acb8a402129329c0cdd
afa06df5a2c33dc0bdf80bbe09dade421b3e8b5990a56246e0d7053d5668d917
fc8b2392b92860c7ca669d5274b65498ebd9c3992149cf6727d935c9d0fb48bb
c73c644aa671d76918b56f2ce0124a09156a521e293091b68e2763d2ed386e8f
98f139983882e443116863f795c1df50dae5ceb971075914dfee264dc1502a09
39f9157e24fa47c400d4047c1f6d9b4dbfd067288cfe5f5c0cc2e8449548a6e8
e4766d7e0c13f42cf1ce56efa07cee57889526f398efaae948ce487410d105f6
cab5fa13c8239e97c15b04b27f9b70fb8b561d31935af7b0680bb80aec12c813
aec41c4f461cd08efe1390c8de513e54f766a5903c3c1f67ac4a9c93a3213c6b
71d09abda31f0d7c7161cf6f371305023594bb3ef146aa9fbeab1f717885dd58
8a6da7e23267cadb1b8ec3996d662cbc71342f308ca6b65f545ce78612dfc9a7
86678ad613b4d05a8ad3013323875daa91c69b64411603187dd2bcc595d97a8e
033786a482641aa901a28a3e3c314dbe86723906cea15147629167d8364907f7
0492124645a667b1ca39002aff4b696871f12f7f21ab0a75816aaeb53ed2f78b
ce86d647df2da33c5992c790ddc0d302b56af8a0d7b1433639c235ff03bf09ad
cf7803d1546aab172d17345212cc4de9c2d98a9817c8f9c3770e64744e15e261
1d3e2eeaec0707e531593aa9aadaee0ee7757b67de43eae924fad122e86f60a0
aa9a8f143cf61118c96a3bf226c77a05072ccbef15e990c65e0a118eccbb47e6
1e629fe7c8911a9adbde2e35af4f6f9e60ee538638c82edbcbd7cce5ad2ff4ab
36afa5b3133667f2577687b3e83d7f6c009dd65864c20a408d860b3c6678df2a
71d09abda31f0d7c7161cf6f371305023594bb3ef146aa9fbeab1f717885dd58
3407c5d054491ecf28ea10ec24e30e75915ba6fd3b2656955e94a89b67e0567e
67d6267e0ee81e00f97b25a892d10bd9eeb68179eb7e1b9236fcb01ec3f50beb
e92e49b7af397f6f41a225b8778c6812f78c87f4388f527e6efda0dbe2b49251
2fd6e2ae0e4d78eef9d36376ac39768ec14e3bf8fe39c3ef6a347511b2cd55b1
a1a61052eac5fbe98f28ed6b3ed38a66d333aed3f14326bcd42d0fddcc18c519
a3e5473eb60e8dba6b97e626288b6742e141fa8a393ec7efeb7993449f84b14f
ec60594018da8717fa6b8d93fb919f08e7a8b07401fbce1abe7982c959f78424
b9adc1433ef7c6fee4d36f73b79744ad611d51a8e039d4c384dd453e33452d0f
9b7615b4c2c6ebdd283afb1dae4d951b7ef928939b98ffbe7dea49cc5c5eee02
951b09c559fdc1c447f3dc63870b5244c2b715d728e1318a62db64bc17dcb85d
4743ccff0b5dbc34027165e177143018b9ee9e3232496ca5d4fa5cd56b5646f6
302ae30d464d6958510dcc463e3c3d8339e38bf6ff84de6cd84866303d34c8a5
4d01691573542e1676fc09102ac3120d0eec37b6791f32ec103eb0d0ee2581c1
f863dab6504fa3c4c9f7534d264d13db95ea96679689cb7e5d0460eed8f59a37
61a194cd413614e5ac91d648a87ff6b7e78d2130f54eff8a05c4c9608a7ac3aa
2bce6eb2839569ba077e24468259aa2678677275c632a0d276dcb14566cc6fcf
150525f4490f43877f1281aaaccc9bce78452d556326105fb77db6156095c883
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681
24437d65bee4874fba99a2d57bf050ba719a69518160cebafbd8f7441368093a
d1f848a8477f171430b339acc4d0113660907705d85fa8ea4fbd9bf4ae20a116
acfd58369c0a7dbc866ad4ca9cb0fe69d017587af88297f1eaf62a9a8b1b74b4
5928048ed1d76df1ae4f3ede0e3da0b0006734f712a78036e6f4b6a78c05f0c6
a81719f585a9f40e4304c6ceb2292826676c2d3f7342e88b21f41139743436aa
02ec5c7a7ab17540164b4b499fa095e80113123b3ccba6dda59b5f7021b93e6b
c3d113bfc14a7148419d506e9bd8d44d897f3c71f8d81a63e3b2f4d843ad1c4c
1d72fdb8257a6ec78367f2512ceb18be480860320986845943776959cb4d3dd0
8f07bd408838182a0328ea44156ad47dd5b6ccdcfbd53209717d555ed69adedc
03c5f4cd4a0889f436cd1ac2634b2c76732ce7f280e294ab3a19e8c1e957f101
f76f1657205d7042fccfc811077bbada92c0fef735f158da35e7825da1cc6bec
92f1e5424d53e3f4516d4c831afe3d64e88ed265ec143fb32717f2323836d61b
0b949d6e2078771ed65ce1b81ae9b5619d24317846a4e67bb9494975049bf728
377d65bdbf2b323ef9b497b1d3e2f93521a9ce57d4f2d6c296b048ee1390173e
962bf22710ff07977e3ddad66117094a2cf1c0aefca3d7ed4ba947c62ee36491
bb2990a1bbc417cfec40d5f1a6a8b22cac0ef21aed869dd8503e28573cf84401
c26719156e644cee5e95133d31b30b80147494313e665d4243954435511f5c11
a6057292247d928e6adcda5a48983d8702372ce195fc50ea4496f67c6ca57e26
ce59d8cf4b6eca3420438e05b059d6f61cc484e6fb00b1b2a7033bf36446e683
508d6dd6c45027e3cda3d93364980f32ffc34c684a424c769954d741cf0d40d0
e0fc2cf31a0fd7f4bfa1ba453fd8f272784330de2ecba80104455252a931789b
2aeef18abf22b233de5515a95cdca5aa3cbc6c21e8d2f83a68214e7272f9d947
508d6dd6c45027e3cda3d93364980f32ffc34c684a424c769954d741cf0d40d0
f80d84a3f951a1b62d92a5a2799b149ed0aaca292364f101c1273f135c811565
887345540f1bf31c40755edcda2e3dd9fe640122fc9020f3873c895daa2378bf
4f29180005f3c2e776d1854722270287111ec073ab80dfc1b4dc1bc0d9337ddf
eef56bfc68959c6eaa66ab6abcaaf8fb54aa5b5a7da0866d97a1effeae0952b8
a265e0db5fe311dac60171e27011087bd64b467eb442986f343fe07410e8bf46
d7590ee95a46bc1ca7973a8f09efe23a5b00e54d6e65b95cb16acd17a0f127e8
ef3966d15af3665ee5126df394cefdf6f78fce77db7a70d5f35c19c234715035
ef54e266f8fc9eb97d71c76f2a53b65bef83fe5fc270fbfe83463f83678ff44c
df84d6c284dd39c2bfed6f8eb26149a4154396c27de50595ed5d80b428930dcd
ff1dcab09f24a4c314af3ee829f80127e5b54f5be2a13e812617f77d0deeef57
5009f65e7a8d84a9955d5adbdb86107b15304b1061bdaba5dd2ac2293dd8e6cb

SHA-1

04356f101a5f53f0eff7b1a6b24d1463074f142a
937975e3ea50c15476aef050295f4031f5fda2a4
c71300967110b899eabf81fe96bf5fd927a10564
4dcb1eb86caaf9fe5bbd8f729679435f1f14adc6
2f46a7ed5d7a303c0f25d5e4a18bcbf01ce9af26
22d80be7d7916763648a98a0afdb7c0c7e42b3d9
70f066c77a080d0003fb3047a9e3731828d3b164
698d1ade6defa07fb4e4c12a19ca309957fb9c40
6856bb506a0858cc5597666d966b5b7499e38542
cacc3eb2f415852f57579a69662744f75438e891
db999a5ecf4e1c87fae10983f6d23b26069cbba1
7b90dcdf6ea88b1efa1cee36a0b1ab71e34c8d1d
e4805324ebfb97f3004847de306bf4fd567ed2a3
68af654d9c6bf1d671531d81f0f78a6a75960040
c0bf51550f050e099328b3e228adf16483e30e53
6f20d6d12e793d69126359352ce34c09d4692f85
7fb634831f57c518707b697720f759ce9ae5c7a3
54fc5d132a50dc86fda117fee90b088c6dd9d361
acfd2f5c8efea720cbc40c9da215a733f777037f
52ddd7483eeb8b096457178a7f9f2136af33e604
f586995978e3250d9fa7fd05c89732bfde1a383f
c13d0d669365dfaff9c472e615a611e058ebf596
630a2cd81e605cf418811a8fe12c4bc9ce377656
62bc9524f2c773c0dd486f48f584b309e04f16e0
477a1ce31353e8c26a8f4e02c1d378295b302c9e
f37c1a1d11fd5a90dc3a30edd752eb67f9917f01
54fc5d132a50dc86fda117fee90b088c6dd9d361
eb376b77cb6e2a6d89e3cc7368867c12bcc3317a
13ea93c06e3cb65ab7c5603de713d862a4956404
74d918acc5838177614cf63f2e327bd2d8fa0cc5
00626346632fdfb2a1d5831793e92a3601ec4d9f
6d8e50c567f80372a6f82f1ae2fc2c1177c56d45
b8c40fcec38711a1c0cd663b87c175f7509201ff
94988d605982dc2f10e422505eed6e38fb7093f4
74b269cdf488b09d06ac6b6e8c9c8e75254d642e
35092d156e12d4c500ee999d913c1380a41b3908
92b74d3eeffaad370c9c6f36501fb6cd140c3b12
2cf4bafe062d38faf4772a7d1067b80339c2ce82
50e141b03bcd5b1f6d5d1d3956c42e188782c8dc
9d2dc6be9d580f4acb61d3d28239b601ca332a89
39f65f635a8572e8a4061a5df72c5425da517dfd
c046fba176f44d91c43a920ed35ac96470ecb67d
e23284f42db9d6e4cc259b359612b22e8e3cad87
7276989a740ea1d82bb94fb6d4d3ed921fa1177a
f757e49d4126098b554af41630cf8932b57ecd1b
04063c50d1400f2bd62833d33c3f567c3b796660
b72bedc3183fcb8dcdbfceb93065e253e5921a63
b66f0f8f41722945814fae50ca17a7a19e227626
f66dbfdb6d38a819443bb924a793544698fd8b03
c63b333fa20eedce6d5757d58f54ff1ca1cc80d9
d27f2f75d222c6a85c8a88d76bd9a25aea076b82
d484b8311307a75eaf413e9b3911b0aacef6d27c
c046fba176f44d91c43a920ed35ac96470ecb67d
caf631b79f2078f73ee494adecf33d0df7ba9dad
94f3cfffb2697397b9032f449a8db61747083d11
c413fb3d6d69a5f4405c8c97e1af1955716e9623
21fdb5107d0a38bd4cb8fb7714a2cad913bac7e1
56e43c278aa0398e8933a91f41849fbf97453e5b
caff9e675dbf337badfdbd543d97c68cbf959610
b7f53ea5784e1e699d22b353d5ebb72c5f757e17
077ed17c4757d08db2921b9ba030d2636ca5f130
d22427829001ad66105a3fda8f97cb200f169896
d4ec2dd90e1f2415f3dfe62d0a6627602c6ffee8
74e6171938b75dfd268e2c25ab51850d7d34f7b0
73d730a37699fac734e7a6da508283212ec10016
8c0addc6b1761586b4d8830beb550c7aeb5e186b
62063e502a6a96994e46408bb6a04e5b86c18055
412411c2ab000f61dfcbdc2cf8d2a00c0e631c0c
7e1fc00aece9b3d3df4fd44a6fec5fb77058abed
6af2ade9c744b4689e411536df07040f7f2722ba
00626346632fdfb2a1d5831793e92a3601ec4d9f
c53aa6676f2a4e4f0c372b902dad5aa27c4ef859
ee57cab4bc7065dc8257be0f28c6ed465d5ce3b6
3c78af6efbe0f15b4ff55077152ba5e3675a4ff0
55e57c6bc9f9db1556b6527f60d86edb603c2325
c2533664ffcd4e25ed68a303fcaa3f25b39be848
f4e1de4575a687932029ee4875b59a8a83385a27
8bc1aeda5d3d3b8e88920fee1f99360da1df038d
bcc654fecbb77f643c3616b679075c08bbc6f780
4a6edb973747bce4512f635a076cb47b1b934a83
b8cd43f605eab84838ed36943752c4ffc167f647
fa9ede75fc19abe4b4fc46d37e234926af8744b6
78bb2c6b9a2ca3d79bfd4f313759385705b00922
cf452a470bf3b6654d46e098d13538fe3c547224
3526c49ca637ca2130699590e7bfd22b98c08673
d10f139d4a0e4591968bd8518dd152debaf15638
610f6ca6aa436fd0329d22a639ee2b4ad4ebe484
8a680e220a007d875e82a25c6aead202935415de
5e294219b54bec8933c1d765ed5884b7b174ca35
3f69df382de737a7dee988f98ea35d0b44dc48eb
cd7f8684f6bfabbf733b724e00f5c8782613663c
0b83391363bc2c6fb261781423a9a611a5af0764
95c32bf141584db152fb7fc178a0877f70a838a6
cd7f8684f6bfabbf733b724e00f5c8782613663c
b91ae855e9db2b1129eb3a0380fe86a49e04320c
41a28ee8546ffbe33f92b9589c05d09da10318b5
682488c3fad02a93c2d0614f2b33eebe34c632b4
4a3749c33d235715a84ec4964e1d69d758645a82
e92b86b55fbb1e3533e640c6dfa958603c68d14d
c9f926a2eb5a0ba36d82556ccf820b6838b3108c
396c9bf470fed61ed771561346b60678a6958fce
6020bde7924e6e7933b2b4fc573e6e8f529ebc55
dc479c9002ba733165171f2179d7beadbc64b305
13dd0945827cb1f5f8b929633f911eaa563577d3
a81f8f77d9a2681f1ad2290eb9ae85dd971af0be

URL

http[:]//103[.]107[.]104[.]19/2022/eu[.]docx
http[:]//103[.]107[.]104[.]19/DocConvDll[.]dll
http[:]//103[.]107[.]104[.]19/FontEDL[.]exe
http[:]//103[.]107[.]104[.]19/FontLog[.]dat
http[:]//103[.]85[.]24[.]158/eeas[.]dat
http[:]//107[.]178[.]71[.]211/eu/DocConvDll[.]dll
http[:]//107[.]178[.]71[.]211/eu/FontEDL[.]exe
http[:]//107[.]178[.]71[.]211/eu/FontLog[.]dat
http[:]//107[.]178[.]71[.]211/eu/Report[.]pdf
http[:]//155[.]94[.]200[.]206/images/branding/newtap[.]css
http[:]//155[.]94[.]200[.]206/resources/Invitation[.]jpg
http[:]//155[.]94[.]200[.]209/assets/mail/fonts/v1/fonts/last[.]jpg
http[:]//155[.]94[.]200[.]211/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/server[.]gif
http[:]//155[.]94[.]200[.]211/news/live/world-europe-60830013
http[:]//45[.]154[.]14[.]235/2022/COVID-19%20travel%20restrictions%20EU%20reviews%20list%20of%20third%20coun
tries[.]doc
http[:]//45[.]154[.]14[.]235/2022/PotPlayer[.]dll
http[:]//45[.]154[.]14[.]235/2022/PotPlayer[.]exe
http[:]//45[.]154[.]14[.]235/2022/PotPlayerDB[.]dat
http[:]//45[.]154[.]14[.]235/2023/PotPlayer[.]dll
http[:]//45[.]154[.]14[.]235/2023/PotPlayer[.]dll
http[:]//45[.]154[.]14[.]235/2023/PotPlayer[.]exe
http[:]//45[.]154[.]14[.]235/2023/PotPlayerDB[.]dat
http[:]//45[.]154[.]14[.]235/mfa/Council%20conclusions%20on%20the%20European%20security%20situation[.]pdf
http[:]//45[.]154[.]14[.]235/PotPlayer[.]dll
http[:]//45[.]154[.]14[.]235/PotPlayer[.]exe
http[:]//45[.]154[.]14[.]235/PotPlayerDB[.]dat
http[:]//45[.]154[.]14[.]235/State_aid__Commission_approves_2022-2027_regional_aid_map_for_Greece[.]pdf
http[:]//95[.]217[.]1[.]81/maps/overlayBFPR
http[:]//95[.]217[.]1[.]81/maps/overlaybfpr?q=san%20diego%20ca%20zoo
http[:]//upespr[.]com/PotPlayer[.]exe
http[:]//upespr[.]com/PotPlayerDB[.]dat
http[:]//upespr[.]com/State_aid__Commission_approves_2022-2027_regional_aid_map_for_Greece[.]pdf
http[:]//www[.]zyber-i[.]com/europa/2022[.]zip
https[:]//45[.]154[.]14[.]235/2023/EU
https[:]//45[.]154[.]14[.]235/2023/PotPlayer[.]dll
https[:]//45[.]154[.]14[.]235/2023/PotPlayer[.]exe
https[:]//45[.]154[.]14[.]235/2023/PotPlayerDB[.]dat
https[:]//drive[.]google[.]com/uc?id=1BG0F1NdkPZOY6w2Y0YEs6nMGYLvSJiQo&export=download
https[:]//drive[.]google[.]com/uc?id=1ITPqIFuWOQZ08RmMUDMmzWpg69_EbLTO
https[:]//president-office[.]gov[.]mm/sites/default/files/font/All-in-One_Pyidaungsu_Font[.]zip
https[:]//www[.]president-office[.]gov[.]mm/sites/default/files/font/All-in-One_Pyidaungsu_Font[.]zip

Remediation

Always be suspicious about emails sent by unknown senders.
Never click on links/attachments sent by unknown senders.
Block all threat indicators at your respective controls.
Search for IOCs in your environment.