Mustang Panda APT IOCs

Cisco Talos обнаружили новую угрозу со стороны Mustang Panda, китайской APT-группы. Mustang Panda начала атаковать европейские (в том числе российские), американские и азиатские организации фишинговыми сообщениями, имитирующими сообщения ЕС или Украины о военном конфликте, с целью доставки вредоносного ПО на устройства жертв. Они также продолжают использовать свой имплант PlugX для обеспечения устойчивости в целях шпионажа.

Indicators of Compromise

IPv4

• 101.36.125.203
• 103.15.28.145
• 103.15.28.208
• 103.159.132.70
• 103.200.97.150
• 103.75.190.50
• 103.91.64.134
• 107.167.64.4
• 107.178.71.211
• 110.42.64.64
• 155.94.200.209
• 155.94.200.212
• 176.118.167.36
• 18.138.107.235
• 185.239.226.17
• 202.58.105.38
• 45.248.87.162
• 45.43.50.197
• 46.8.198.134
• 5.206.224.167
• 61.38.252.166
• 86.105.227.115
• 91.199.212.52
• 92.118.188.78
• 95.217.1.81

IPv4 and Port

• 103.15.28.208:443
• 103.15.28.208:80
• 107.167.64.4:443
• 110.42.64.64:24680
• 202.58.105.38:80
• 91.199.212.52:80
• 92.118.188.78:443

Domains

• fuckeryoumm.nmb.bet

URls

• http://103.107.104.19/2022/eu.docx
• http://103.107.104.19/DocConvDll.dll
• http://103.107.104.19/FontEDL.exe
• http://103.107.104.19/FontLog.dat
• http://103.15.28.145:6666/maps/overlaybfpr?q=san%20diego%20ca%20zoo
• http://103.75.190.50:443/maps/overlaybfpr?q=san%20diego%20ca%20zoo
• http://103.85.24.158/eeas.dathttp://107.178.71.211/eu/DocConvDll.dll
• http://107.178.71.211/eu/FontEDL.exe
• http://107.178.71.211/eu/FontLog.dat
• http://107.178.71.211/eu/Report.pdf
• http://123.51.185.75/jquery-3.3.1.slim.min.js
• http://155.94.200.206/images/branding/newtap.css
• http://155.94.200.206/resources/Invitation.jpg
• http://155.94.200.209/assets/mail/fonts/v1/fonts/last.jpg
• http://155.94.200.211/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/server.gif
• http://155.94.200.211/news/live/world-europe-60830013
• http://45.154.14.235/2022/COVID-19%20travel%20restrictions%20EU%20reviews%20list%20of%20third%20countries.doc
• http://45.154.14.235/2022/PotPlayer.dll
• http://45.154.14.235/2022/PotPlayer.exe
• http://45.154.14.235/2022/PotPlayerDB.dat
• http://45.154.14.235/2023/PotPlayer.dll
• http://45.154.14.235/2023/PotPlayer.exe
• http://45.154.14.235/2023/PotPlayerDB.dat
• http://45.154.14.235/PotPlayer.dll
• http://45.154.14.235/PotPlayer.exe
• http://45.154.14.235/PotPlayerDB.dat
• http://45.154.14.235/State_aid__Commission_approves_2022-2027_regional_aid_map_for_Greece.pdf
• http://45.154.14.235/mfa/Council%20conclusions%20on%20the%20European%20security%20situation.pdf
• http://95.217.1.81/maps/overlayBFPR
• http://95.217.1.81/maps/overlaybfpr?q=san%20diego%20ca%20zoohttp://upespr.com/PotPlayer.exe
• http://upespr.com/PotPlayerDB.dat
• http://upespr.com/State_aid__Commission_approves_2022-2027_regional_aid_map_for_Greece.pdf
• http://www.zyber-i.com/europa/2022.zip
• https://45.154.14.235/2023/EU
• https://45.154.14.235/2023/PotPlayer.dll
• https://45.154.14.235/2023/PotPlayer.exe
• https://45.154.14.235/2023/PotPlayerDB.dat
• https://drive.google.com/uc?id=1BG0F1NdkPZOY6w2Y0YEs6nMGYLvSJiQo&export=download
• https://drive.google.com/uc?id=1ITPqIFuWOQZ08RmMUDMmzWpg69_EbLTO
• https://drive.google.com/uc?id=1NsauYfE3NaFmtI0M99RAe3DmOxO1bBak&export=download
• https://drive.google.com/uc?id=1trg9KJtKJUkKHgP57AhJSirw83-nIwyu&export=download
• https://president-office.gov.mm/sites/default/files/font/All-in-One_Pyidaungsu_Font.zip
• https://www.president-office.gov.mm/sites/default/files/font/All-in-One_Pyidaungsu_Font.zip

SHA256

• 017ef960616182daa1ffabc5d5470340cc45bbd5ab3455d74987a3ae478fa118
• 02ec5c7a7ab17540164b4b499fa095e80113123b3ccba6dda59b5f7021b93e6b
• 033786a482641aa901a28a3e3c314dbe86723906cea15147629167d8364907f7
• 03c5f4cd4a0889f436cd1ac2634b2c76732ce7f280e294ab3a19e8c1e957f101
• 0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681
• 0492124645a667b1ca39002aff4b696871f12f7f21ab0a75816aaeb53ed2f78b
• 0b949d6e2078771ed65ce1b81ae9b5619d24317846a4e67bb9494975049bf728
• 150525f4490f43877f1281aaaccc9bce78452d556326105fb77db6156095c883
• 16dd94c228b5e2050d01edfe4849ca1388e9b3f811d39380f6ada3e75c69b353
• 18230e0cd6083387d74a01bfc9d17ee23c6b6ea925954b3d3c448c0abfc86bd2
• 19870dd4d8c6453d5bb6f3b2beccbbbe28c6f280b6a7ebf5e0785ec386170000
• 1aafbe976c3559b61531910c75f9bb90176641f565f9810a18dcde9564241164
• 1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0
• 1d3e2eeaec0707e531593aa9aadaee0ee7757b67de43eae924fad122e86f60a0
• 1d484ada6d7273ca26c5e695a38cb03f75dee458bcb0f61ea81a6c87d35a0fa0
• 1d72fdb8257a6ec78367f2512ceb18be480860320986845943776959cb4d3dd0
• 1e629fe7c8911a9adbde2e35af4f6f9e60ee538638c82edbcbd7cce5ad2ff4ab
• 235752f22f1a21e18e0833fc26e1cdb4834a56ee53ec7acb8a402129329c0cdd
• 24437d65bee4874fba99a2d57bf050ba719a69518160cebafbd8f7441368093a
• 2aeef18abf22b233de5515a95cdca5aa3cbc6c21e8d2f83a68214e7272f9d947
• 2bce6eb2839569ba077e24468259aa2678677275c632a0d276dcb14566cc6fcf
• 2fc14451ef0ff0919995d46fedc7b7c7f9a9adbf9c40f6b36b480e637d581e6b
• 2fd6e2ae0e4d78eef9d36376ac39768ec14e3bf8fe39c3ef6a347511b2cd55b1
• 302ae30d464d6958510dcc463e3c3d8339e38bf6ff84de6cd84866303d34c8a5
• 3407c5d054491ecf28ea10ec24e30e75915ba6fd3b2656955e94a89b67e0567e
• 36afa5b3133667f2577687b3e83d7f6c009dd65864c20a408d860b3c6678df2a
• 377d65bdbf2b323ef9b497b1d3e2f93521a9ce57d4f2d6c296b048ee1390173e
• 39f9157e24fa47c400d4047c1f6d9b4dbfd067288cfe5f5c0cc2e8449548a6e8
• 3a2aae4ad99f8aba7ff558c5b6ccee0366bcd8c69bc16eeb0aeb5f4f58340f0d
• 3aa80dd8ffbc7b364234cdf0849b10bcead52004fc803a74afb1bd504d024305
• 436d5bf9eba974a6e97f6f5159456c642e53213d7e4f8c75db5275b66fedd886
• 4743ccff0b5dbc34027165e177143018b9ee9e3232496ca5d4fa5cd56b5646f6
• 492fd69150d0cb6765e5201c144e26783b785242f4cf807d3425f8b8df060062
• 4c727e21312355cd9a9f0e1e0bb8fc3379f487968a832d00ffde9d5a04b8da9d
• 4cf38636b0fd129c5cbb4be9cd2c8f7f401529cf17ad6853ff83a2fe36ca533b
• 4d01691573542e1676fc09102ac3120d0eec37b6791f32ec103eb0d0ee2581c1
• 4f29180005f3c2e776d1854722270287111ec073ab80dfc1b4dc1bc0d9337ddf
• 5009f65e7a8d84a9955d5adbdb86107b15304b1061bdaba5dd2ac2293dd8e6cb
• 508d6dd6c45027e3cda3d93364980f32ffc34c684a424c769954d741cf0d40d0
• 537ac2f79db06191222ba7ae7b7843f063600f87971b8dffc4a31459d6a144b1
• 567fb0e6e6667ce1674cbdfd0ab26a8a3f68979256ef6680facf1d2d50a25dba
• 5851043b2c040fb3dce45c23fb9f3e8aefff48e0438dec7141999062d46c592d
• 5928048ed1d76df1ae4f3ede0e3da0b0006734f712a78036e6f4b6a78c05f0c6
• 6019e6ee3dee2ec798667ccb34a2ab8d70bf5960d35f55157a9cb535b00b243f
• 61a194cd413614e5ac91d648a87ff6b7e78d2130f54eff8a05c4c9608a7ac3aa
• 668cc21387e01b87c438e778b3a08c964869ce2c7f22c59bcde6604112d77b2e
• 67d6267e0ee81e00f97b25a892d10bd9eeb68179eb7e1b9236fcb01ec3f50beb
• 6a5b0cfdaf402e94f892f66a0f53e347d427be4105ab22c1a9f259238c272b60
• 6fd9d745faa77a58ac84a5a1ef360c7fc1e23b32d49ca9c3554a1edc4d761885
• 706e53480da95b17d0f9f0f5dc37a50c7abc3f954ce15b4733fd964b03910627
• 71d09abda31f0d7c7161cf6f371305023594bb3ef146aa9fbeab1f717885dd58
• 76da9d0046fe76fc28b80c4c1062b17852264348fd873b7dd781f39491f911e0
• 7ded20b7d2c0428641a6ac272c15b444b37bf833bbbea09dc931d649e6dc5277
• 82df9817d0a8dca7491b0688397299943d9279e848cdc4a5446d3159d8d71e6f
• 86678ad613b4d05a8ad3013323875daa91c69b64411603187dd2bcc595d97a8e
• 887345540f1bf31c40755edcda2e3dd9fe640122fc9020f3873c895daa2378bf
• 8a6da7e23267cadb1b8ec3996d662cbc71342f308ca6b65f545ce78612dfc9a7
• 8a7fbafe9f3395272548e5aadeb1af07baeb65d7859e7a1560f580455d7b1fac
• 8f07bd408838182a0328ea44156ad47dd5b6ccdcfbd53209717d555ed69adedc
• 92f1e5424d53e3f4516d4c831afe3d64e88ed265ec143fb32717f2323836d61b
• 930b7a798e3279b7460e30ce2f3a2deccbc252f3ca213cb022f5b7e6a25a0867
• 94c5c12e03ce6694bdfb5053540f53942640e2aeea22f8ef7d4bc0066b594bca
• 951b09c559fdc1c447f3dc63870b5244c2b715d728e1318a62db64bc17dcb85d
• 962bf22710ff07977e3ddad66117094a2cf1c0aefca3d7ed4ba947c62ee36491
• 98f139983882e443116863f795c1df50dae5ceb971075914dfee264dc1502a09
• 9b7615b4c2c6ebdd283afb1dae4d951b7ef928939b98ffbe7dea49cc5c5eee02
• a07cece1fa9b3c813c0b6880b24a6494a9db83e138102da3bce30ebff51909c0
• a0e1a9d45ab7addf3762d3b872f6b21e8ce41a7ff290f5b8566a39d9ca51b09a
• a1a61052eac5fbe98f28ed6b3ed38a66d333aed3f14326bcd42d0fddcc18c519
• a265e0db5fe311dac60171e27011087bd64b467eb442986f343fe07410e8bf46
• a3e5473eb60e8dba6b97e626288b6742e141fa8a393ec7efeb7993449f84b14f
• a6057292247d928e6adcda5a48983d8702372ce195fc50ea4496f67c6ca57e26
• a81719f585a9f40e4304c6ceb2292826676c2d3f7342e88b21f41139743436aa
• aa8fb15d63bd22b2ff15a9f1b4f4422b3c6af026915168c81d7bb38c9be2ab78
• aa9a8f143cf61118c96a3bf226c77a05072ccbef15e990c65e0a118eccbb47e6
• acfd58369c0a7dbc866ad4ca9cb0fe69d017587af88297f1eaf62a9a8b1b74b4
• aec41c4f461cd08efe1390c8de513e54f766a5903c3c1f67ac4a9c93a3213c6b
• afa06df5a2c33dc0bdf80bbe09dade421b3e8b5990a56246e0d7053d5668d917
• b9adc1433ef7c6fee4d36f73b79744ad611d51a8e039d4c384dd453e33452d0f
• bb2990a1bbc417cfec40d5f1a6a8b22cac0ef21aed869dd8503e28573cf84401
• bee9c438aced1fb1ca7402ef8665ebe42cab6f5167204933eaa07b11d44641bb
• c26719156e644cee5e95133d31b30b80147494313e665d4243954435511f5c11
• c3d113bfc14a7148419d506e9bd8d44d897f3c71f8d81a63e3b2f4d843ad1c4c
• c5455b708c1a1afe61aa5cff80dff19f07972a5b047fd398536c8377dc68a19b
• c73c644aa671d76918b56f2ce0124a09156a521e293091b68e2763d2ed386e8f
• ca622bdc2b66f0825890d36ec09e6a64e631638fd1792d792cfa02048c27c69f
• cab5fa13c8239e97c15b04b27f9b70fb8b561d31935af7b0680bb80aec12c813
• ce59d8cf4b6eca3420438e05b059d6f61cc484e6fb00b1b2a7033bf36446e683
• ce86d647df2da33c5992c790ddc0d302b56af8a0d7b1433639c235ff03bf09ad
• cf7803d1546aab172d17345212cc4de9c2d98a9817c8f9c3770e64744e15e261
• d1f848a8477f171430b339acc4d0113660907705d85fa8ea4fbd9bf4ae20a116
• d7590ee95a46bc1ca7973a8f09efe23a5b00e54d6e65b95cb16acd17a0f127e8
• dbdbc7ede98fa17c36ea8f0516cc50b138fbe63af659feb69990cc88bf7df0ad
• df84d6c284dd39c2bfed6f8eb26149a4154396c27de50595ed5d80b428930dcd
• e0fc2cf31a0fd7f4bfa1ba453fd8f272784330de2ecba80104455252a931789b
• e1dbe58393268d7ddabd4bed0cdedf0fbba85d4c3ef1300580ed4c74e147aa61
• e2aff9d2f5e75bdc09712722d919f2261f638b0b4da878e405b86b927dcaf1e3
• e3dc7be52151828d3be43fa6016bc7c134230315f0f2d3f2fdeb852b494da357
• e3e3c28f7a96906e6c30f56e8e6b013e42b5113967d6fb054c32885501dfd1b7
• e4766d7e0c13f42cf1ce56efa07cee57889526f398efaae948ce487410d105f6
• e751834f0dcd0cb1411142761fcb940c7ac18e0b851c625ee0bca38db170a17a
• e92e49b7af397f6f41a225b8778c6812f78c87f4388f527e6efda0dbe2b49251
• ec32ff0c049bd8812a35aeaaaae1f66eaf0ce8aefce535d142862ae89435c2e2
• ec60594018da8717fa6b8d93fb919f08e7a8b07401fbce1abe7982c959f78424
• eef56bfc68959c6eaa66ab6abcaaf8fb54aa5b5a7da0866d97a1effeae0952b8
• ef3966d15af3665ee5126df394cefdf6f78fce77db7a70d5f35c19c234715035
• ef54e266f8fc9eb97d71c76f2a53b65bef83fe5fc270fbfe83463f83678ff44c
• effd63168fc7957baf609f7492cd82579459963f80fc6fc4d261fbc68877f5a1
• f76f1657205d7042fccfc811077bbada92c0fef735f158da35e7825da1cc6bec
• f80d84a3f951a1b62d92a5a2799b149ed0aaca292364f101c1273f135c811565
• f863dab6504fa3c4c9f7534d264d13db95ea96679689cb7e5d0460eed8f59a37
• fc8b2392b92860c7ca669d5274b65498ebd9c3992149cf6727d935c9d0fb48bb
• fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025
• ff1dcab09f24a4c314af3ee829f80127e5b54f5be2a13e812617f77d0deeef57