360 Threat Intelligence Center

#APT-C-61 #Sanuwa MD5：54f8ac92afeb71cf53fe5c10a71fb880 https://op9.herokuapp[.]com

#Evilnum MD5: 984a7a5f67eddd64dfd538797018feb2 FileName: SelfiePassport2505.jpg.lnk C2: http[:]//apintoative[.]com/get.php

#APT #Kimsuky Template injection file: BIOStyle.dotm MD5: 863fd86868014b5cc008764816c422c5 URL： http://vnskwl[.]mypressonline[.]com/relationship/BIOStyle[.]dotm http://outwd[.]myartsonline[.]com/yu/ls[.]txt

#APT #Kimsuky Malicious PDF document Name: 인터뷰질문지-최은율(한국어).pdf MD5:6d6399e5e98164e365029a9b141e1646 C&C: http:// rhwkdlaktm[.]atwebpages[.]com/download.php?filename=acom2

An XML file uploaded from India, which contains base64-encoded JS, may have started an HTA file MD5: 5d665d6401cc6ea544881db8ad02c6fa

#APT #KONNI It might be a lure document targeting Russia. MD5: ce866ae254de4cabd60a95abcc52c315 http://romanovawillkillyou[.]c1[.]biz/index[.]php?user_id=417

#APT #Gamaredon File Stealer This sample can bypass AV, latest detection result shows that only 6/65 AV on VT detected it. More related samples can be found if you check the communicating files with this C&C. MD5: 6ee61b9935b8483af73ddbe407c6bb46 C2:krashand[.]ru

This code and digital signature are the same as the old sample of #Patchwork: 18363437744197efdfb779bad31b32ca f5f147661da458e39d413ef9b62c7d3c

Our researcher found a malicious document about COVID-19, uploaded from Turkey. MD5: ad7ac4c241bfce6f4cc5b5d1c420acbf

#APT #Kimsuky #GoldDragon is stealing information through mailbox. The attacker's mailbox is [email protected].