Недавно Trendmicro обнаружили новую группу передовых постоянных угроз (APT), которую мы окрестили Earth Berberoka (она же GamblingPuppet). Согласно анализу, эта группа нацелена на сайты азартных игр. Расследование также показало, что Earth Berberoka нацелена на платформы Windows, Linux и macOS и использует семейства вредоносных программ, которые исторически приписывались лицам, говорящим на китайском языке.
Indicators of Compromise
IPv4
- 139.5.202.8
- 149.28.31.166
- 42.200.181.116
- 45.76.199.119
- 45.77.22.215
IPv4 and Port
- 139.5.202.82:443
- 149.28.31.166:29527
- 149.28.31.166:443
- 45.77.22.215:83
Domains
- 1.googie.ph
- 2.googie.ph
- 3.googie.ph
- adobe.name
- dust.github.wiki
- exmail.googie.com.ph
- fuckeryoumm.nmb.bet
- fbi.fuckbc.com
- fuckyou.fbi.am
- gb.googie.ph
- huaidan.fbi.am
- linux.daj8.me
- linux.daji8.me
- linux.wy01.com
- linux.wy01.vip
- list.whoamis.info
- localhost.11i.me
- mail.whoamis.info
- mmimdown.oss-cn-hongkong.aliyuncs.com
- mmr.whoamis.info
- poer.whoamis.info
- rc.dajuw.com
- update.adobe.wiki
- win.googie.ph
- yabo.googie.ph
- tools.daji8.me
- shopingchina.net
- steam.dajuw.com
- rootkit.tools
- test.mircrosoftscoulds.com
- wmgnews.daji8.me
- wps.daj8.me
- wpsup.daj8.me
- www.adobe.name
- www.whoamis.info
- d.github.wiki
- caonimade.11i.me
- darknet.rootkit.tools
- darwin.github.wiki
- flash.wy886066.com
- flash.wy886066.com
- download.mircrosoftscoulds.com
- hk.whoamis.info
- hkdust.github.wiki
- agph.ivi66.net
- bos.github.wiki
- adobe-flash.wiki
- 1qw6etagydbn2peifj8hf.fbi.am
- 12371829hkdanm.fbi.am
Domain and port
- huaidan.fbi.am:443
- huaidan.fbi.am:53
- linux.daj8.me:80
- linux.shopingchina.net
- linux.shopingchina.net:80
- linux.wy01.com:443
- linux1.shopingchina.net
- linux1.shopingchina.net:80
- linux2.shopingchina.net
- localhost.11i.me:443
- localhost.11i.me:53
- rc.dajuw.com:443
- rootkit.tools:443
- steam.dajuw.com:53
- tools.daji8.me:443
- tools.daji8.me:53
- www.whoamis.info:5237
- yabo.googie.ph:443
- 1.googie.ph:10050
- 1.googie.ph:1723
- 1.googie.ph:443
- 2.googie.ph:1723
- 2.googie.ph:443
- 3.googie.ph:5432
- adobe.name:83
- agph.ivi66.net:443
- agph.ivi66.net:53
- bos.github.wiki:443
- caonimade.11i.me:443
- caonimade.11i.me:53
- darknet.rootkit.tools:8443
- darwin.github.wiki:53
- fbi.fuckbc.com:29527
- fuckeryoumm.nmb.bet:443
- fuckeryoumm.nmb.bet:53
- fuckyou.fbi.am:8080
- gb.googie.ph:443
- helloword.11i.me
- helloword.11i.me:443
- helloword.daj8.me
- helloword.daj8.me:443
URLs
- 45.76.199.119/g.pixel
- http://27.255.79.17/ieboxs.exe
- http://27.255.79.17/rdpclip.exe
- http://42.200.181.116/java
- http://adobe.name:8080/7v9v
- http://d.github.wiki/dust/amazon-hk
- http://hk.whoamis.info/list.exe
- http://www.adobe.name/Download/flashplayerpp_install_cn.exe
- http://www.whoamis.info/dllhost8080.exe
- https://adobe-flash.wiki/Download/flash_install_cn.exe
- https://d.github.wiki/mac/darwinx64
- https://mmimdown.oss-cn-hongkong.aliyuncs.com/mac/mmchat-1.1.6.3.dmg
- https://mmimdown.oss-cn-hongkong.aliyuncs.com/windows/mimi-setup-1.1.6.3.exe
- https://update.adobe.wiki/Download/Flash_Installer.exe
- https://www.adobe.name/Download/flashplayerpp_install_cn.exe
- https://www.adobe.name/Download/Updater.exe
SHA256
- 06f6ca3feaabfe07aa370d502bc00782df88fa0584c870fc31e642808f0f3924
- 0cc36dd25e099cc6f1798dabe1d6a3e2d8c3883aa0e0d7296e94d035cdb74f3c
- 119c0a8258cc1ff958e6ec9ec8eae9d8e73a50833e01aa6565395464b8e33f7a
- 1d8cef17a8588c216a9e69f3b4acd55dad1b9c69b25b344452ade112eaa96cb5
- 29969986180a89ab00f6578ffe0748749d4fbd767ee0d09f516458bf47380514
- 2c403e390f59b2c2bfafde476dc18000b0ad1bbc8ac9ee0670662c48ba5b748f
- 2ecb9e6f123aef47a0650fbd76da8d57408bc43413959750f46b47645e58f88e
- 3210460b6afa2b0219895685d12de570a711cce64d1fc2f9fec3dac2918543a7
- 354fed4072f0c12b9a7e40f48feb32c043481d0a87fbff599ce36fd2e323d379
- 369e74a8e1f686896f82d92ee2467ca6736bc44b06faab9db9ea6473aef4c397
- 3c873ed23fe64445168382cd59a3a9eef08b3be19a660999afc474b890e57959
- 3d57b604db0023cc57de8f224ad5b211a0a5250de68671fc61c55e1b354ceb38
- 401d0b1f1a94df6a70818ef2bad80d139bb258c0e7746612066599aa43456dad
- 44f80cb1d774bbdee01281f621b8f42d2facee8db1678828db9e9b3a00fa2a63
- 4d591853294dcc8afc8c646fffddc8b0efaeb44f120145011b83a6c63463e18d
- 50f4c8cf2b50fb75e7fc32860207e7d13e88a813bf7c96ed12a6953bd5fe71f5
- 5ead238621bef7cc4c4f58ac5eb614dd16acbcfd30c75169ff5f16d7905243a5
- 618e38e0e5ccdefbd4bc4987f60c40f1c2f733c2441ed2026d1530910d7196bd
- 68feab7ef7a2bd4754620b3a5a511988d18384bbd42d100e528cc5b876a1d771
- 6aa3fa0fc477966c81ff15725ae3f8d687f847256ab20833802e983a510d5ff9
- 6ab71022f268885c67e7251e52fab62c163820c67988cf579e76a383a0f6f8dd
- 6b8ae6f01ab31243a5176c9fd14c156e9d5c139d170115acb87e1bc65400d54f
- 74d93253090f999977fa8e32b03b94bb8d35f59a8390545fd10da0f7fb1fcd13
- 76d008d9955509d3db6e190acfa58fdf12fc64253884ac6981187a3e5ffdeb20
- 784ceff596d94ef365ae261ae43a83c43d52e04dc46b09a8fb5960772bca4a00
- 794991233088eb8c9ecc2d63df97041f5dc63f8169e2da8a42f07366c6fb215f
- 7afd418750824969fd6d0c6db949456998f792c97d6a69669051e1c90a458a5b
- 7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f
- 7de8be300fc35f81a316a61d07840c9963b5590b16296fde54c70ac88de6e837
- 81d2be1565c05f77e829e1296d17d9456ae672459e4283315cdd0dfae01626a9
- 825b2e89cec971074819bafde889208dea729997d8b71599017e3277d5f32523
- 844a3992b2a4f0b81f813175650135b2571825fc0dbfac7e3ebea8370be74748
- 86fb171f52fef167ba8dd202c6b6530d3fe3def1158a4d3385bef3258650724d
- 89fb709ed5ac5cc3342b9894af039dcbb1988848c87063ba15b4ab69399ae77d
- 8e101eb365d5f7a2f66f253a7ca7736f1a7ae9e71567da3436615be105f0844e
- 9217518710b77766d9dc3397c3ce9bd88734c71c8b80a2dd1e9ed1312efacd9c
- 9bf4ab66bc119ccbf13ac3b0374c39de4c27e0f2aae4fc4383fe7ec0c7246ec5
- 9d72cb7c95bcec88f7bf4bfffdb2b0ebe5902f3da943d03794e8a6f586f0c1a3
- a3d3a7aac4b42cd7a295a44d23ef457fb4dc74113912f3d3270649c10bedd0b4
- aefaaa2c69a2f275d05c2d319877f321c617b337e3c67e3e9acfbaeffdd1c3eb
- b0d62e927975627c720fcf734ea7bb49ebe0790defa6d1085ff93e4b39c74f57
- b7d91f0e15cf0258fc857699171b6627337d511ecca9ab22adf668e0918eec50
- b85955932ef6c04f92cdddf9c2f9d6f4693b2a35f6fa2be252fef93cb44c73c0
- be213cfb0795e8a645d50eec7e55520e952279963dcef4e11b49c022ec283129
- c664a816771b8d058796bdddbc0554510c430cc7fc98bae5153a21b1797bf39c
- d4140f016eba287d34182ae4ff29f52349d8c0b151eb2d253e5838ca6f662053
- d6a97f90030a981a1495196f2fdf99f70d333abe165eecafc5b08302f70a6ea3
- ddd19d60f37f04e33fb74f6ef2e45f24be1bab8423aba608987804eed9316567
- e0395231a9c1fdb9299ab3803a50405e095f25671b5435712562cd5619f6fc1d
- e2451144e007e588ac81cbf76573a1ab5279b1f8ddc9d2ea6066c33c2691284e
- eb17f6e4b31656887640fdadd17958ac9dfb5de8c1128258618bd8c63921f2f4
- eb9ffe12dff87a143ea188fc6c16f2b3f44e43c2ae20506c4a69c23c3c74e6c2
- ebfc2b62ea889cf96c4eb0b649672c6b713ad163fd5818c2f46a9b5726dd80fb
- f3de33eac07bebd2ce91ec7603b7d021c5e5e68d6b39a3615ee27134b008942c
- f78d5fd3c8e680a25f0372a82c19866bf1c9fcb131612301f5988128011ce91f
- f8720cc2747a3518d13193a2fe9cb791be7e37396fbc448f63a8227d5f552e52
- fadd3aebdcdf61da44bccf7b71f30312c807c432514b761010aef10ddaf93270
- fb765bb69ceb6e63fbb5aaf0bf5be2373d1043507dc4aa41819b84c4d6c9a83e
- fc1e2a0ed20ef3cb8a543b65cc0db5d05f5e107a6c43bf6f1c0b581e6167a59f
- fc8ee97fd67dbcd47780713f076c36bedf7c29be0ba6f1912635b0557fc3764f
- fcf56480bc8bb87af97cdc5dbd7aba94e0178eb5af98f4a2fb813b89b228b63e
- 003f4431743b69894b5d7988e53a37a7bad0b9cfe4248153e477b572af081786
- 0f67c729100cb4872d56830ef5907448eddb9a34dac14f8ff62aece5d947c0a0
- 11edea24abac633b9e7b8aae0965cd9cb56834a32d73d8bfe4fd1c009755f640
- 18698365a4ba96d1a918f61b988291fc9eed80615518a72826b0bb92c6c90a06
- 1901008555ebe8cbd511f9e9dac40d59286556a46a372532bc124cfe231d9689
- 2dd033d67ebed75bc5a2de24835bfd2440df98e4f3dc946b385cad6992e1aafe
- 466bfc2f13ca97dc805f6d48d28a8a1b96d250f919b3e9cc8d55b88bf24c3ecc
- 51371a402a13a4cdff55c79d52f2e560c46ca72ce7b4edf9ae55a721448a4512
- 575d44db142d2ef2e280ecfafeacd4eb9e6562102426032080584e769086d774
- 5bf94e591b100f7006d10197008675f3db3862e8bbef6e88107063cb6c858122
- 68196d13e1e5e900eb6cffdbf5517c564905440fe76b0197ff44a505b4f48c13
- 69fa10bf283474ca53295e0a7eff2fc07373092c1031581b748dce8aef7b6aea
- 6cc526fb8cd43f38011b46a2c0aea9905bd1ba554d2c4df950b370a95d0eda8d
- 70c3fd8ac880ffab91db3c81456639f226cf9a7ec8a851ad72406d7ddcc629d9
- 778ee62d1df9f7bf5183e1d2f95ec4036bf5be80074ca333f4d4e85bee937c1c
- 79b8b383c848bbf940111eca00ddc47a0e8e9ac74ac006077cecb925a971d618
- 79efad9e9b272a2cea0d328a881c7f6a1933b41a7d1468549dfc60c83a31037f
- 8388c17ce29399175c60bf689358e033eb03a696007e5856725bd0c205629436
- 951c97fa34c0f84d85ab7b9879860444f57e58d685156abe3d2a9a2f502fae7d
- 960459363583458fa220540eb84cb73af157b03f835b4bf34b986ee4c3afe704
- 9f40d4d53222e229a58c20473abaef7c0648c19fd0f13eb0f9ec841ed18f6ff3
- a5047dfc3e89935b982c4b5df91b56ae5e9d0bb557f84ef791352e54ab0077c2
- a7776eb4512d08e594854215aead32c4480091a7ca14870b793c290f1e36cfdb
- b26ec8e98e05dc54779c1c91a9cf31aa40d757569074346548facdddd79c02fb
- b33fb600d46309bafd31d3b056bbba816f5bac0f1024e774530f6c4320d3c5c2
- bc7e80232e28c680a585c3cc1125fb10862d338e5a4b94cdfdfb954df451621d
- c718d73ffbc182c2799f3999326486c93cd59d1e04b9676edf955a1324522a2c
- ca23b21cfd1fff75c3acec4c74020cfe013393983b997b3a7178f2e969b4a7bf
- d890db7136f72fa367aff0d1550f04034232a2fa3d97bae3a6516e3d5dcad056
- e74632e3f010bce10de73b34f4dee68054207d7b12b1a0cf1820ce833e1b5991
- eadd6ea80e727f78e91093097b4297a88a59100fcc19299b5ce4b5280db27cdc
- ebb8985880e911db8a498e20a269a00c07dbcfde2d077e88fe4b9d78a4deed7e
- ec42e1562fab95d0fbc86b3980cc392e368b50a4a150a2258d4293e4de1bc730
- f646eb1685da341ccb3c1d5e4a14ae93f3271a84232708ee7234b44d4a834251
- fb5434ff3030214c672226c52bc6883bf55c3129a5ee9b78ef5b2c773f8a1101
- fd0f0841c8502dc03689ebb64dd9764e3772fc91400d1d2c9e81530bf5ad0b0f
- df5c5921e4ec822ec94a0146f6f4abc7b471dfac90b046f3dae23db693e3f6f1
- ee07dfd6443af8f20f5f11effb9cbcec07e125697a28aee78718caeed17f1407
- fcc427ad960d6571a5368a686ed08dc15ab4b470c18e864fabe5887c616bb8bb