Purgalicious VBA: Macro Obfuscation With VBA Purging

0
Malicious Office documents remain a favorite technique for every type of threat actor, from red teamers to FIN groups to APTs. In this blog post, we will discuss "VBA Purging", a...

WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

0
Microsoft is known for their backwards compatibility. When they rolled out the 64-bit variant of Windows years ago they needed to provide compatibility with existing 32-bit applications. In order...

In Wild Critical Buffer Overflow Vulnerability in Solaris Can Allow Remote Takeover — CVE-2020-14871

0
FireEye Mandiant has been investigating compromised Oracle Solaris machines in customer environments. During our investigations, we discovered an exploit tool on a customer’s system and analyzed it to see...

Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945

0
Through Mandiant investigation of intrusions between February 2018 and September 2020, the FLARE Advanced Practices team observed a group we track as UNC1945 compromise telecommunications companies and operate against...

Welcome to ThreatPursuit VM: A Threat Intelligence and Hunting Virtual Machine

0
Skilled adversaries can deceive detection and often employ new measures in their tradecraft. Keeping a stringent focus on the lifecycle and evolution of adversaries allows analysts to devise new...

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser

0
First Seen Server Subject MD5 12/12/19 140.82.60.155:443 CN=updatemanagirus ec16be328c09473d5e5c07310583d85a 12/21/19 96.30.192.141:443 CN=cmdupdatewincom 3d4de17df25412bb714fda069f6eb27e 1/6/20 45.76.49.78:443 CN=scrservallinstinfo cd6035bd51a44b597c1e181576dd44d9 1/8/20 149.248.58.11:443 CN=updatewinlsasscom 8c581979bd11138ffa3a25b895b97cc0 1/9/20 96.30.193.57:443 CN=winsystemupdatecom e4e732502b9658ea3380847c60b9e0fe 1/14/20 95.179.219.169:443 CN=jomambabest 80b7001e5a6e4bd6ec79515769b91c8b 1/16/20 140.82.27.146:443 CN=winsysteminfocom 29e656ba9d5d38a0c17a4f0dd855b37e 1/19/20 45.32.170.9:443 CN=livecheckpointsrscom 1de9e9aa8363751c8a71c43255557a97 1/20/20 207.148.8.61:443 CN=ciscocheckapicom 97ca76ee9f02cfda2e8e9729f69bc208 1/28/20 209.222.108.106:443 CN=timesshiftscom 2bb464585f42180bddccb50c4a4208a5 1/29/20 31.7.59.141:443 CN=updatewinsoftrcom 07f9f766163c344b0522e4e917035fe1 1/29/20 79.124.60.117:443 C=US 9722acc9740d831317dd8c1f20d8cfbe 1/29/20 66.42.86.61:443 CN=lsassupdatecom 3c9b3f1e12473a0fd28dc37071168870 1/29/20 45.76.20.140:443 CN=cylenceprotectcom da6ce63f4a52244c3dced32f7164038a 1/29/20 45.76.20.140:80 CN=cylenceprotectcom da6ce63f4a52244c3dced32f7164038a 1/30/20 149.248.5.240:443 CN=sophosdefencecom e9b4b649c97cdd895d6a0c56015f2e68 1/30/20 144.202.12.197:80 CN=windefenceinfocom c6c63024b18f0c5828bd38d285e6aa58 1/30/20 149.248.5.240:80 CN=sophosdefencecom e9b4b649c97cdd895d6a0c56015f2e68 1/30/20 149.28.246.25:80 CN=lsasswininfocom f9af8b7ddd4875224c7ce8aae8c1b9dd 1/30/20 144.202.12.197:443 CN=windefenceinfocom c6c63024b18f0c5828bd38d285e6aa58 1/30/20 149.28.246.25:443 CN=lsasswininfocom f9af8b7ddd4875224c7ce8aae8c1b9dd 1/30/20 45.77.119.212:443 CN=taskshedulewincom e1dc7cecd3cb225b131bdb71df4b3079 1/30/20 45.77.119.212:80 CN=taskshedulewincom e1dc7cecd3cb225b131bdb71df4b3079 1/30/20 149.28.122.130:443 CN=renovatesystemcom 734c26d93201cf0c918135915fdf96af 1/30/20 45.32.170.9:80 CN=livecheckpointsrscom 1de9e9aa8363751c8a71c43255557a97 1/30/20 149.248.58.11:80 CN=updatewinlsasscom 8c581979bd11138ffa3a25b895b97cc0 1/30/20 149.28.122.130:80 CN=renovatesystemcom 734c26d93201cf0c918135915fdf96af 1/30/20 207.148.8.61:80 CN=ciscocheckapicom 97ca76ee9f02cfda2e8e9729f69bc208 1/31/20 81.17.25.210:443 CN=update-windcom 877bf6c685b68e6ddf23a4db3789fcaa 1/31/20 31.7.59.141:80 CN=updatewinsoftrcom 07f9f766163c344b0522e4e917035fe1 2/2/20 155.138.214.247:80 CN=cleardefencewincom 61df4864dc2970de6dcee65827cc9a54 2/2/20 155.138.214.247:443 CN=cleardefencewincom 61df4864dc2970de6dcee65827cc9a54 2/2/20 45.76.231.195:443 CN=checkwinupdatecom d8e5dddeec1a9b366759c7ef624d3b8c 2/2/20 45.76.231.195:80 CN=checkwinupdatecom d8e5dddeec1a9b366759c7ef624d3b8c 2/3/20 46.19.142.154:443 CN=havesetupnet cd354c309f3229aff59751e329d8243a 2/3/20 95.179.219.169:80 CN=jomambabest 80b7001e5a6e4bd6ec79515769b91c8b 2/3/20 140.82.60.155:80 CN=updatemanagirus ec16be328c09473d5e5c07310583d85a 2/3/20 209.222.108.106:80 CN=timesshiftscom 2bb464585f42180bddccb50c4a4208a5 2/3/20 66.42.118.123:443 CN=conhostservicecom 6c21d3c5f6e8601e92ae167a7cff721c 2/4/20 80.240.18.106:443 CN=microsoftupdateswincom 27cae092ad6fca89cd1b05ef1bb73e62 2/4/20 95.179.215.228:443 CN=iexploreservicecom 26010bebe046b3a33bacd805c2617610 2/12/20 155.138.216.133:443 CN=defenswincom e5005ae0771fcc165772a154b7937e89 2/12/20 45.32.130.5:443 CN=avrenewcom f32ee1bb35102e5d98af81946726ec1b 2/14/20 45.76.167.35:443 CN=freeallsafecom 85f743a071a1d0b74d8e8322fecf832b 2/14/20 45.63.95.187:443 CN=easytuscom 17de38c58e04242ee56a9f3a94e6fd53 2/17/20 45.77.89.31:443 CN=besttuscom 2bda8217bdb05642c995401af3b5c1f3 2/17/20 95.179.147.215:443 CN=windefenscom 57725c8db6b98a3361e0d905a697f9f8 2/17/20 155.138.216.133:443 CN=defenswincom c07774a256fc19036f5c8c60ba418cbf 2/17/20 104.238.190.126:443 CN=aaatuscom 4039af00ce7a5287a3e564918edb77cf 2/17/20 144.202.83.4:443 CN=greattuscom 7f0fa9a608090634b42f5f17b8cecff0 2/17/20 104.156.245.0:443 CN=comssitecom f5bb98fafe428be6a8765e98683ab115 2/17/20 45.32.30.162:443 CN=bigtuscom 698fc23ae111381183d0b92fe343b28b 2/17/20 108.61.242.184:443 CN=livetuscom 8bedba70f882c45f968c2d99b00a708a 2/17/20 207.148.15.31:443 CN=findtuscom 15f07ca2f533f0954bbbc8d4c64f3262 2/17/20 149.28.15.247:443 CN=firsttuscom 88e8551f4364fc647dbf00796536a4c7 2/21/20 155.138.136.182:443 CN=worldtuscom b31f38b2ccbbebf4018fe5665173a409 2/25/20 45.77.58.172:443 CN=freeoldsafecom a46e77b92e1cdfec82239ff54f2c1115 2/25/20 45.77.58.172:443 CN=freeoldsafecom a46e77b92e1cdfec82239ff54f2c1115 2/26/20 108.61.72.29:443 CN=myserviceconnectnet 9f551008f6dcaf8e6fe363caa11a1aed 2/27/20 216.155.157.249:443 CN=myserviceupdatercom 4c6a2c06f1e1d15d6be8c81172d1c50c 2/28/20 45.77.98.157:443 CN=topservicesboostercom ba4b34962390893852e5cc7fa7c75ba2 2/28/20 104.156.250.132:443 CN=myserviceboostercom 89be5670d19608b2c8e261f6301620e1 2/28/20 149.28.50.31:443 CN=topsecurityservicenet 77e2878842ab26beaa3ff24a5b64f09b 2/28/20 149.28.55.197:443 CN=myyserviceupdatercom 0dd8fde668ff8a301390eef1ad2f9b83 2/28/20 207.246.67.70:443 CN=servicesecurityorg c88098f9a92d7256425f782440971497 2/28/20 63.209.33.131:443 CN=serviceupdatesnet 16e86a9be2bdf0ddc896bc48fcdbb632 2/29/20 45.77.206.105:443 CN=myserviceboosternet 6e09bb541b29be7b89427f9227c30a32 2/29/20 140.82.5.67:443 CN=servicesboosterorg 42d2d09d08f60782dc4cded98d7984ed 2/29/20 108.61.209.123:443 CN=brainschampionscom 241ab042cdcb29df0a5c4f853f23dd31 2/29/20 104.156.227.250:443 CN=servicesboostercom f45f9296ff2a6489a4f39cd79c7f5169 2/29/20 140.82.10.222:443 CN=topservicesecuritynet b9375e7df4ee0f83d7abb179039dc2c5 2/29/20 149.28.35.35:443 CN=topservicesecurityorg 82bd8a2b743c7cc3f3820e386368951d 2/29/20 207.148.21.17:443 CN=topserviceupdatercom ece184f8a1309b781f912d4f4d65738e 2/29/20 45.77.153.72:443 CN=topservicesupdatecom 8330c3fa8ca31a76dc8d7818fd378794 3/1/20 140.82.10.222:80 CN=topservicesecuritynet b9375e7df4ee0f83d7abb179039dc2c5 3/1/20 207.148.21.17:80 CN=topserviceupdatercom ece184f8a1309b781f912d4f4d65738e 3/1/20 108.61.90.90:443 CN=topservicesecuritycom 696aeb86d085e4f6032e0a01c496d26c 3/1/20 45.32.130.5:80 CN=avrenewcom f32ee1bb35102e5d98af81946726ec1b 3/2/20 217.69.15.175:443 CN=serviceshelperscom 9a437489c9b2c19c304d980c17d2e0e9 3/2/20 155.138.135.182:443 CN=topservicesupdatescom b9deff0804244b52b14576eac260fd9f 3/2/20 95.179.210.8:80 CN=serviceuphelpercom bb65efcead5b979baee5a25756e005d8 3/2/20 45.76.45.162:443 CN=boostsecurityscom 7d316c63bdc4e981344e84a017ae0212 3/4/20 108.61.176.237:443 CN=yoursuperservicecom 7424aaede2f35259cf040f3e70d707be 3/4/20 207.246.67.70:443 CN=servicesecurityorg d66cb5528d2610b39bc3cecc20198970 3/6/20 188.166.52.176:443 CN=top-serviceboostercom f882c11b294a94494f75ded47f6f0ca0 3/7/20 149.248.56.113:443 CN=topservicehelpercom 2a29e359126ec5b746b1cc52354b4adf 3/8/20 199.247.13.144:443 CN=hakunamatatatacom e2cd3c7e2900e2764da64a719096c0cb 3/8/20 95.179.210.8:443 CN=serviceuphelpercom bb65efcead5b979baee5a25756e005d8 3/8/20 207.246.67.70:443 CN=servicesecurityorg d89f6bdc59ed5a1ab3c1ecb53c6e571c 3/9/20 194.26.29.230:443 CN=secondserviceupdatercom c30a4809c9a77cfc09314a63f7055bf7 3/9/20 194.26.29.229:443 CN=firstserviceupdatercom bc86a3087f238014b6c3a09c2dc3df42 3/9/20 194.26.29.232:443 CN=fourthserviceupdatercom 3dc6d12c56cc79b0e3e8cd7b8a9c320b 3/9/20 194.26.29.234:443 CN=sixthserviceupdatercom 951e29ee8152c1e7f63e8ccb6b7031c1 3/9/20 194.26.29.235:443 CN=seventhserviceupdatercom abe1ce0f83459a7fe9c72839fc46330b 3/9/20 194.26.29.236:443 CN=eighthserviceupdatercom c7a539cffdd230a4ac9a4754c2c68f12 3/9/20 194.26.29.237:443 CN=ninethserviceupdatercom 1d1f7bf2c0eec7a3a0221fd473ddbafc 3/9/20 194.26.29.225:443 CN=seventeenthservicehelpercom 6b1e0621f4d891b8575a229384d0732d 3/9/20 194.26.29.227:443 CN=nineteenthservicehelpercom 38756ffb8f2962f6071e770637a2d962 3/9/20 194.26.29.242:443 CN=thirdservicehelpercom 3b911032d08ff4cb156c064bc272d935 3/9/20 194.26.29.244:443 CN=tenthservicehelpercom a2d9b382fe32b0139197258e3e2925c4 3/9/20 194.26.29.226:443 CN=eighteenthservicehelpercom 4acbca8efccafd92da9006d0cc91b264 3/9/20 194.26.29.243:443 CN=ninthservicehelpercom 0760ab4a6ed9a124aabb8c377beead54 3/9/20 194.26.29.201:443 CN=secondservicehelpercom d8a8d0ad9226e3c968c58b5d2324d899 3/9/20 194.26.29.202:443 CN=thirdservicehelpercom 0d3b79158ceee5b6ce859bb3fc501b02 3/9/20 194.26.29.220:443 CN=fourservicehelpercom 831e0445ea580091275b7020f2153b08 3/11/20 207.246.67.70:80 CN=servicesecurityorg d89f6bdc59ed5a1ab3c1ecb53c6e571c 3/13/20 165.227.196.0:443 CN=twentiethservicehelpercom 977b4abc6307a9b3732229d4d8e2c277 3/14/20 45.141.86.91:443 CN=thirdservice-developercom edc2680e3797e11e93573e523bae7265 3/14/20 194.26.29.219:443 CN=firstservisehelpercom 6b444a2cd3e12d4c3feadec43a30c4d6 3/14/20 45.141.86.93:443 CN=fifthservice-developercom 60e7500c809f12fe6be5681bd41a0eda 3/15/20 45.141.86.90:443 CN=secondservice-developercom de9460bd6b1badb7d8314a381d143906 3/15/20 45.141.86.84:443 CN=firstservice-developercom 6385acd425e68e1d3fce3803f8ae06be 3/17/20 45.141.86.96:443 CN=eithtservice-developercom e1d1fb4a6f09fb54e09fb27167028303 3/17/20 45.141.86.92:443 CN=fourthservice-developercom 5b5375bf30aedfa3a44d758fe42fccba 3/18/20 45.141.86.94:443 CN=sixthservice-developercom 4d42bea1bfc7f1499e469e85cf75912c 3/18/20 108.61.209.121:443 CN=service-boostercom 692ed54fb1fb189c36d2f1674db47e45 3/18/20 134.122.116.114:443 CN=service-helpescom ad0914f72f1716d810e7bd8a67c12a71 3/18/20 209.97.130.197:443 CN=helpforyourservicecom 00fe3cc532f876c7505ddbf5625de404 3/18/20 192.241.143.121:443 CN=serviceshelpscom e50998208071b4e5a70110b141542747 3/18/20 45.141.86.95:443 CN=seventhservice-developercom 413ca4fa49c3eb6eef0a6cbc8cac2a71 3/18/20 198.211.116.199:443 CN=actionshuntercom 8e5bedbe832d374b565857cce294f061 3/18/20 45.141.86.155:443 CN=sexyserviceecom cca37e58b23de9a1db9c3863fe2cd57c 3/19/20 194.26.29.239:443 CN=eleventhserviceupdatercom 7e0fcb78055f0eb12bc8417a6933068d 3/19/20 45.141.86.206:443 CN=servicedhuntercom fdefb427dcf3f0257ddc53409ff71d22 3/19/20 45.141.86.92:443 CN=service-updateercom 51ba9c03eac37751fe06b7539964e3de 3/19/20 134.122.116.59:443 CN=servicedboostercom db7797a20a5a491fb7ad0d4c84acd7e8 3/19/20 134.122.118.46:443 CN=servicedpowercom 7b57879bded28d0447eea28bacc79fb5 3/19/20 134.122.124.26:443 CN=serviceboostnumberonecom 880982d4781a1917649ce0bb6b0d9522 3/20/20 45.141.86.97:443 CN=ninethservice-developercom e4a720edfcc7467741c582cb039f20e0 3/20/20 178.62.247.205:443 CN=top-serviceupdatercom a45522bd0a26e07ed18787c739179ccb 3/20/20 159.203.36.61:443 CN=yourserviceupdatercom 7b422c90dc85ce261c0a69ba70d8f6b5 3/20/20 134.122.20.117:443 CN=fifthserviceupdatercom 99aa16d7fc34cdcc7dfceab46e990f44 3/23/20 165.22.125.178:443 CN=servicemonsterrcom 82abfd5b55e14441997d47aee4201f6d 3/24/20 69.55.60.140:443 CN=boostyourservicecom 7f3787bf42f11da321461e6db7f295d1 3/24/20 45.141.86.98:443 CN=tenthservice-developercom eef29bcbcba1ce089a50aefbbb909203 3/26/20 178.79.132.82:443 CN=developmasterscom 5cf480eba910a625e5e52e879ac5aecb 3/26/20 194.26.29.247:443 CN=thirteenthservicehelpercom 2486df3869c16c0d9c23a83cd61620c2 5/4/20 159.65.216.127:443 CN=info-developcom 5f7a5fb72c6689934cc5d9c9a681506b 9/22/20 69.61.38.155:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gtrsqercom d37ba4a4b1885e96ff54d1f139bf3f47 9/22/20 96.9.225.144:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hakunamancom 4408ba9d63917446b31a0330c613843d 9/22/20 96.9.209.216:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=caonimascom d921dd1ba03aaf37d5011020577e8147 9/22/20 107.173.58.176:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=chalenggescom dfeb6959b62aff0b93ca20fd40ef01a8 9/22/20 96.9.225.143:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=regindscom 05c03b62dea6ec06006e57fd0a6ba22e 9/22/20 69.61.38.156:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=errvghucom c14a892f8203a04c7e3298edfc59363a 9/22/20 45.34.6.229:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=harddaggercom 7ed16732ec21fb3ec16dbb8df0aa2250 9/22/20 45.34.6.226:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=getinformationsscom 1788068aff203fa9c51d85bf32048b9c 9/22/20 45.34.6.225:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gameleaderrcom 0fff2f721ad23648175d081672e77df4 9/22/20 107.173.58.185:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=razorsescom b960355ba112136f93798bf85e6392bf 9/22/20 107.173.58.183:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nomadfunclubcom a3d4e6d1f361d9c335effdbd33d12e79 9/22/20 107.173.58.175:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bouthscom e13fbdff954f652f14faf11b735c0ef8 9/22/20 185.184.223.194:443 C=US,ST=CA,L=Texas,O=lol,OU=,CN=regbedcom 67310b30bada4f77f8f336438890d8f2 9/22/20 109.70.236.134:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=vnuretcom ae74cbb9838688363b7928b06963c40a 9/23/20 64.44.131.103:443 C=US,ST=TX,L=Texas,O=serviceswork,OU=,CN=servicesworknet af518cc031807f43d646dc508685bcd3 9/23/20 69.61.38.157:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=moonsharddcom c8fd81d6d3c8cbb8256c470a613a7c7b 9/23/20 193.142.58.129:443 C=US,ST=TX,L=Texas,O=zapored,OU=,CN=zaporedcom 5a22c3c8a0ed6482cad0e2b867c4c10c 9/23/20 45.34.6.223:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=hurrypottercom bf598ba46f47919c264514f10ce80e34 9/23/20 107.173.58.179:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=biliyilishcom 1c8243e2787421373efcf98fc0975031 9/23/20 45.34.6.222:443 C=US,ST=TX,L=Texas,O=dagger,OU=,CN=daggerclipcom 576d65a68900b270155c2015ac4788bb 9/23/20 107.173.58.180:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=blackhoallcom 69643e9b1528efc6ec9037b60498b94c 9/23/20 107.173.58.182:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=checkhunterrcom ca9b7e2fcfd35f19917184ad2f5e1ad3 9/23/20 45.34.6.221:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=check4listcom e5e0f017b00af6f020a28b101a136bad 9/24/20 213.252.244.62:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=ayiyascom 8367a1407ae999644f25f665320a3899 9/24/20 185.25.50.167:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=chainnsscom 34a78f1233e53010d29f2a4fa944c877 9/30/20 88.119.171.75:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=martahzzcom eaebbe5a3e3ea1d5992a4dfd4af7a749 10/1/20 88.119.171.74:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=jonsonsbabyycom adc8cd1285b7ae62045479ed39aa37f5 10/1/20 88.119.171.55:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=tiancaiicom bfe1fd16cd4169076f3fbaab5afcbe12 10/1/20 88.119.171.67:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=cantlieecom c8a623eb355d172fc3e083763934a7f7 10/1/20 88.119.171.76:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=realgamesscom 0ac5659596008e64d4d0d90dfb6abe7c 10/1/20 88.119.171.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=maybebaybecom 48003b6b638dc7e79e75a581c58f2d77 10/1/20 88.119.171.69:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=saynoforbubblecom 5c75a6bbb7454a04b9ea26aa80dfbcba 10/1/20 88.119.171.73:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=chekingkingcom e391c997b757424d8b2399cba4733a60 10/1/20 88.119.171.77:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=wondergodstcom 035697cac0ee92bb4d743470206bfe9a 10/1/20 88.119.171.78:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=zetrexxcom fc133bed713608f78f9f112ed7498f32 10/1/20 213.252.244.38:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=mountasdcom 8ead6021e2a5b9191577c115d4e68911 10/1/20 107.173.58.184:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=pudgeeecom 1c9949d20441df2df09d13778b751b65 10/1/20 88.119.174.109:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=loockfinderrscom c0ddfc954aa007885b467f8c4f70ad75 10/1/20 88.119.174.110:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=puckhunterrrcom ee63098506cb82fc71a4e85043d4763f 10/1/20 88.119.174.114:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=voiddascom 422b020be24b346da826172e4a2cf1c1 10/1/20 88.119.174.116:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sibalsakiecom 8d8f046e963bcd008fe4bbed01bed4c8 10/1/20 88.119.174.117:443 C=US,ST=TX,L=TExas,O=lol,OU=,CN=rapirasacom c381fb63e9cb6b0fc59dfaf6e8c40af3 10/1/20 88.119.174.118:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=raidbossacom add6b742d0f992d56bede79888eef413 10/1/20 88.119.174.119:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=lindasakcom 9bbd073033e34bfd80f658f0264f6fae 10/1/20 88.119.174.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bithunterrcom 9afef617897e7089f59c19096b8436c8 10/1/20 88.119.174.120:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=giveaseescom 3f366e5f804515ff982c151a84f6a562 10/1/20 88.119.174.107:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=shabiherecom c2f99054e0b42363be915237cb4c950b 10/1/20 88.119.174.125:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=tarhungangstercom 4ac8ac12f1763277e35da08d8b9ea394 10/1/20 88.119.174.126:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=imagoddcom 7080547306dceb90d809cb9866ed033c 10/1/20 88.119.174.127:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=raaidbosscom 03037dff61500d52a37efd4b4f520518 10/1/20 88.119.174.128:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sunofgoddcom 959bed7a2662d7274b303f3b120fddea 10/1/20 213.252.244.126:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hungrrybabycom 1d28556cc80df9627c20316358b625d6 10/1/20 213.252.244.170:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=loxlivercom 85e65803443046f921b9a0a9b8cc277c 10/1/20 213.252.246.154:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicegungstercom 9df6ba82461aa0594ead03993c0e4c42 10/5/20 5.2.64.113:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=qasckercom 18aadee1b82482c3cd5ebe32f3628f3f 10/7/20 5.2.79.122:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=cheapshhotcom 94bc44bd438d2e290516d111782badde 10/7/20 88.119.171.94:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=havemostscom f0ede92cb0899a9810a67d716cdbebe2 10/7/20 5.2.64.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=mixunderaxcom e0f9efedd11d22a5a08ffb9c4c2cbb5a 10/7/20 5.2.64.135:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bugsbunnyycom 4aa2acabeb3ff38e39ed1d840124f108 10/7/20 5.2.72.202:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sweetmonsterrcom c04034b78012cca7dcc4a0fb5d7bb551 10/7/20 88.119.175.153:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=zhamehardencom 2670bf08c43d995c74b4b83383af6a69 10/7/20 213.252.245.71:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=serviceboosterrcom 127cc347b711610c3bcee434eb8bf822 10/7/20 213.252.246.144:443 C=US,ST=TX,L=Texas,O=US,OU=,CN=servicewikiicom b3e7ab478ffb0213017d57a88e7b2e3b 10/7/20 5.2.64.149:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sobcasecom 188f603570e7fa81b92906af7af177dc 10/7/20 5.2.64.144:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=unlockwsacom 22d7f35e624b7bcee7bb78ee85a7945c 10/7/20 88.119.174.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=serviceupdattercom 12c6e173fa3cc11cc6b09b01c5f71b0c 10/7/20 88.119.174.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-boosterrcom 28435684c76eb5f1c4b48b6bbc4b22af 10/7/20 88.119.175.214:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=dotmaingamecom 9c2d64cf4e8e58ef86d16e9f77873327 10/7/20 5.2.72.200:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=wodemayaacom f6f484baf1331abf55d06720de827190 10/7/20 5.2.79.10:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hybriqdjscom d8eacda158594331aec3ad5e42656e35 10/7/20 5.2.79.12:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gunsdragcom 29032dd12ea17fc37ffff1ee94cc5ba8 10/7/20 5.2.79.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gungameoncom eaf32b1c2e31e4e7b6d5c3e6ed6bff3d 10/7/20 5.2.64.174:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=quwasdcom 442680006c191692fcc3df64ec60d8fa 10/7/20 5.2.64.172:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=remotessacom 0593cbf6b3a3736a17cd64170e02a78d 10/7/20 5.2.64.167:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=secondlivvecom 38df81824bd8cded4a8fa7ad9e4d1f67 10/7/20 5.2.64.182:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=luckyhunterrscom 99dbe71ca7b9d4a1d9f722c733b3f405 10/7/20 88.119.171.97:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicesupdatercom 7d7199ffa40c50b6e5b025b8cb2661b2 10/7/20 88.119.171.96:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicemountcom f433d25a0dad0def0510cd9f95886fdb 10/7/20 96.9.209.217:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=fastbloodhuntercom e84c7aa593233250efac903c19f3f589 10/7/20 69.61.38.132:443 C=US,ST=CA,L=Mountainvew,O=Office,OU=,CN=kungfupandasacom e6e80f6eb5cbfc73cde40819007dcc53 10/13/20 45.147.230.131:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bakcup-monstercom 4fdeab3dad077589d52684d35a9ea4ab 10/13/20 45.147.229.92:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bakcup-checkercom b70cdb49b26e6e9ba7d0c42d5f3ed3cb 10/13/20 45.147.229.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup-simplecom 57024c1fe5c4acaf30434ba1f58f9144 10/13/20 45.147.229.52:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup-leadercom ec5496048f1962494d239d377e53db0c 10/13/20 45.147.229.44:443 C=US,ST=TX,L=Texsa,O=lol,OU=,CN=backup-helpercom 938593ac1c8bdb2c5256540d7c8476c8 10/14/20 45.147.230.87:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nasmastrservicecom cced46e0a9b6c382a97607beb95f68ab 10/14/20 45.147.230.159:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-leadercom e912980fc8e9ec1e570e209ebb163f65 10/14/20 45.147.230.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-checkercom 39d7160ce331a157d3ecb2a9f8a66f12 10/14/20 45.147.230.140:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-simple-helpercom d9ca73fe10d52eef6952325d102f0138 10/14/20 45.147.230.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-leadercom 920d04330a165882c8076c07b00e1d93 10/14/20 45.147.230.132:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-servicesscom 771463611a43ee35a0ce0631ef244dee 10/14/20 45.147.229.180:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=elephantdrrivecom 1e4a794da7d3c6d0677f7169fbe3b526 10/14/20 45.147.230.159:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-leadercom 9c7fe10135f6ad96ded28fac51b79dfd 10/15/20 45.147.230.132:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-servicesscom a78c0e2920e421667ae734d923dd5ca6 10/15/20 45.138.172.95:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-hellpercom a0b2378ceae498f46401aadeb278fb31 10/16/20 108.62.12.119:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top-backuphelpercom e95bb7804e3add830496bd36664ed339 10/16/20 108.62.12.105:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=best-nascom 8d5dc95b3bd4d16a3434b991a09bf77e 10/16/20 108.62.12.114:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top-backupservicecom d5de2f5d2ca29da1724735cdb8fbc63f 10/16/20 108.62.12.116:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bestservicehelpercom 9c7396ecd107ee8f8bf5521afabb0084 10/16/20 45.147.230.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-checkercom 1134a6f276f4297a083fc2a605e24f70 10/16/20 45.147.230.140:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-simple-helpercom 2150045f476508f89d9a322561b28ff9 10/16/20 45.147.230.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-leadercom f4ddc4562e5001ac8fdf0b7de079b344 10/19/20 74.118.138.137:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top3-servicescom 75fb6789ec03961c869b52336fa4e085 10/19/20 74.118.138.115:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=simple-backupboostercom 9f5e845091015b533b59fe5e8536a435 10/19/20 108.177.235.53:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=best-backupcom 4b78eaa4f2748df27ebf6655ea8a7fe9 10/19/20 74.118.138.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topbackup-helpercom bcccda483753c82e62482c55bc743c16 10/21/20 45.153.241.1:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1helpercom 672c66dd4bb62047bb836bd89d2e1a65 10/21/20 45.153.240.240:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=checktodriverscom 6825409698a326cc319ca40cd85a602e 10/21/20 45.153.240.194:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1mastercom 7f9be0302da88e0d322e5701d52d4128 10/21/20 45.153.240.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-yourservicecom 2c6a0856d1a75b303337ac0807429e88 10/21/20 45.153.240.136:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1mastercom 6559dbf8c47383b7b493500d7ed76f6a 10/23/20 45.153.240.157:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1updatercom 7bd044e0a6689ef29ce23e3ccb0736a3 10/23/20 45.153.240.178:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1updatercom 9859a8336d097bc30e6e5c7a8279f18e 10/23/20 45.153.240.220:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driverdwlcom 43fb2c153b59bf46cf6f67e0ddd6ef51 10/23/20 45.153.240.222:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=viewdriverscom 22bafb30cc3adaa84fef747d589ab235 10/23/20 45.153.241.134:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backups1helpercom 31e87ba0c90bb38b986af297e4905e00 10/23/20 45.153.241.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1downloadscom f8a14846b7da416b14303bced5a6418f 10/23/20 45.153.241.146:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicehelcom 01abdaf870d859f9c1fd76f0b0328a2b 10/23/20 45.153.241.153:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-helcom c2eaf144e21f3aef5fe4b1502d318ba6 10/23/20 45.153.241.158:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicereadercom de54af391602f3deea19cd5e1e912316 10/23/20 45.153.241.167:443 C=US,ST=TX,L=Texas,O=US,OU=,CN=view-backupcom 5f6fa19ffe5735ff81b0e7981a864dc8 10/23/20 45.147.231.222:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top3serviceboostercom ff54a7e6f51a850ef1d744d06d8e6caa 10/23/20 45.153.241.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1viewcom 4cda9d0bece4f6156a80967298455bd5 10/26/20 74.118.138.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topbackupintheworldcom e317485d700bf5e8cb8eea1ec6a72a1a 10/26/20 108.62.12.12:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topservice-masterscom e0022cbf0dd5aa597fee73e79d2b5023 10/26/20 108.62.12.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topserviceboostercom 44e7347a522b22cdf5de658a4237ce58 10/26/20 172.241.27.65:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1servicescom cd3e51ee538610879d6fa77fa281bc6f 10/26/20 172.241.27.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backupmaster-servicecom 04b6aec529b3656040a68e17afdabfa4 10/26/20 172.241.27.70:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backupmasterservicecom 200c25c2b93203392e1acf5d975d6544 10/26/20 45.153.241.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver-boosterscom 9d7c52c79f3825baf97d1318bae3ebe2 10/27/20 45.153.241.14:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1updatecom 5bae28b0d0e969af2c0eda21abe91f35 10/28/20 190.211.254.154:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driverjumpercom a1e62e7e547532831d0dd07832f61f54 10/28/20 81.17.28.70:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1boostcom 67c7c75d396988ba7d6cd36f35def3e4 10/28/20 81.17.28.105:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveheplercom 880e59b44e7175e62d75128accedb221 10/28/20 179.43.160.205:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivedownloadcom cdea09a43bef7f1679e9cd1bbeb4b657 10/28/20 179.43.158.171:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivefindercom 512c6e39bf03a4240f5a2d32ee710ce5 10/28/20 179.43.133.44:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivedwncom 87f3698c743f8a1296babf9fbebafa9f 10/28/20 179.43.128.5:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivecheckcom 6df66077378c5943453b36bd3a1ed105 10/28/20 179.43.128.3:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveupdatecom 9706fd787a32a7e94915f91124de3ad3 10/28/20 81.17.28.122:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveviewcom 0e1b0266de2b5eaf427f5915086b4d7c

Flare-On 7 Challenge Solutions

0
We are thrilled to announce the conclusion of the seventh annual Flare-On challenge. This year proved to be the most difficult challenge we’ve produced, with the lowest rate of...

FIN11: Widespread Email Campaigns as Precursor for Ransomware and Data Theft

0
Mandiant Threat Intelligence recently promoted a threat cluster to a named FIN (or financially motivated) threat group for the first time since 2017. We have detailed FIN11's various tactics, techniques...

Fuzzing Image Parsing in Windows, Part One: Color Profiles

0
Image parsing and rendering are basic features of any modern operating system (OS). Image parsing is an easily accessible attack surface, and a vulnerability that may lead to remote code...

Detecting Microsoft 365 and Azure Active Directory Backdoors

0
Mandiant has seen an uptick in incidents involving Microsoft 365 (M365) and Azure Active Directory (Azure AD). Most of these incidents are the result of a phishing email coercing...