2019.03.04.APT40

2024-11-06 16:55:28 +00:00 · 2019-03-05 12:14:21 +08:00 · 2019-03-05 12:14:21 +08:00 · 396957f8b1
commit 396957f8b1
parent 84bd3af17f
3 changed files with 3 additions and 0 deletions
--- a/2019/2019.03.04.APT40/APT40
+++ b/2019/2019.03.04.APT40/APT40
--- a/2019/2019.03.04.APT40/possible_IoC.txt
+++ b/2019/2019.03.04.APT40/possible_IoC.txt
@ -0,0 +1 @@
+00f952c54f1189bf9583d9fb066be54a 055bc765a78da9cc759d1ba7ac7ac05e 0cb26112cb09d268ccbfe10ac59765df 0dfed59e581c181baeabb5d936c902ce 10c6029fbc0a2770b9686cf31d58067a 166694d13ac463ea1c2bed64fbbb7207 17dbbda8cd63c255d647ab7c423367e5 1c35a87f61953baace605fff1a2d0921 1c6ef040cd7121915245677eef5a3180 2366918da9a484735ec3a9808296aab8 25fc656f3756c7d58aa15aa7e9fae2dc 2754975fb01c931f070d880b224eaee7 2a38ff33240e20caabfc53524a840dfd 2bf998d954a88b12dbec1ee96b072cb9 302003a7ee0d848c98df4bb2b7c720cd 35b82e945de3c49d52283f2caea979f5 36db1bad238251aee8a7aed3d6611ee0 388ba6c81f1a1a9272501e75cf4f0004 3cc6ac12134842539b5e09666953d636 3d1488a737aa2dbfbfe27bb4f471dbb5 3de2a22babb69e480db11c3c15197586 3e169f4fafaf7183d969c89509eb5323 3eb6f85ac046a96204096ab65bbd3e7e 3fefa55daeb167931975c22df3eca20a 40528e368d323db0ac5c3f5e1efe4889 494de66128649e8a0402f832f59e2461 4b18b1b56b468c7c782700dd02d621f4 4bfe05f182aa273e113db6ed7dae4bb8 4ca03bc4fe19c40726fdf2522fdf99e2 4e143cd287cd32901959db9a2a1caf6c 4fc312db8fe933dac24f6d442154f4d0 51da8bd4728d910304c87d992a54cd8a 51e21a697aec4cc01e57264b8bfaf978 52d55e7c2fe820278c7e65e67bce06dd 552c0ee63dbab148688d2cc8644b41f0 593bc6a2e29ec3dde3571c3b8422a11c 5e6e4581613bb5938f3b7eb84724aa2a 5ef4eff48da3d64d5bf598f3279e463b 6051a9adad0df05f858ef18bd567d182 62fb42f4697c206f1338cee8b0ea00c7 65225397c292e5a0e049776ed352158c 681b98d0135ff6358b1cf019825a2919 6d250a11f68b1fd4ed0505fb2965b6f7 6e843ef4856336fe3ef4ed27a4c792b1 6f4d0bdc31f082f770eae395216eef08 71aeeaba2f5cfd80fb98a2df06bdad23 72a7fd2b3d1b829a9f01db312fdd1cd7 758d572af84e6a098b995191fa713cf3 7691ae0369ba3b17198c98ba7059c26a 7d34caa19b129f44b48b9497a4970e2a 7dedb394533f86fe97eddaf0a193baf4 7ed9b4031473ebbe8694d4d712ff46f5 824c92e4b27026c113d766c0816428a0 85862c262c087dd4470bb3b055ef8ea5 955af7983ab57c1e2f760405fe56e607 97326e72e700ba4912459b64ded9cdcf 99d8ea34d18432588622ae564114971d 9a643c7f7483c5a30815431943075522 9c1bd3fdd7541c770da2824f1fcf3b1c 9e035ad76bfe8bde87e5ee362af5dc63 a23d7b6a81dc0b460294e8be829f564d a29f3abada0199ddd6cde01ba50a3063 a545a710b0acf3a4c83d3b9e57f22515 a91c9a2b1bc4020514c6c49c5ff84298 a9ad68065f85b28c87cf6df1657dff81 a9e7539c1ebe857bae6efceefaa9dd16 aa4d99ec6913b048d60ddcd1f17e3dba aa8c545a312597c7469f6555cad2dbbb ab2756872719b7f7878a1bc4b062b056 ab37ed19d7300e673e66dbd4fec990b1 ac073ad83555f3748d481bcf796e1993 adc669c40dc71b8d1138e16d9343baae b5678e77398b2bae81b15c603b70fb14 b7499525634a4099d2e19b330e0910d1 b7e7186d962d562af6a5d10a25d19b02 b86b6cc96d587a65afb266eedec0b695 baf296853822e8d984e1fee586bb4927 bd9e4c82bf12c4e7a58221fc52fed705 bf6d3f52ab8176122be858ddccc22148 c0b31a090a263d67de958e7ccb68ebe3 c0e85b34697c8561452a149a0b123435 c1c5634c515303440062d962ce3e4960 c52464e9df8b3d08fc612a0f11fe53b2 c8594dbe90041eb901c7a0aae280415e d1d254d1460e1e3c5339f20c78c78173 d2fb01629fa2a994fbd1b18e475c9f23 d452c1a73a281b772386f0ca70b1ac5e da5596183958529c95626a6c9dc875a1 db72397c05e31456718c732514531df5 ddbd64b7f6588a47d242c8f12d62af96 df9f8cc805dc67c16227f46f573da6d7 e1123a77b36c8dde7bd2e778fba6ecda e4944351000afc07ccecd9929251d744 e72583654007eaadc90eb7dc4a7baecc e82622e08bb27b63ea82de8017b18079 e890fa6fd8a98fec7812d60f65bf1762 ee8d2f20877f77f39814454d40a4e295 f74ccb013edd82b25fd1726b17b670e5 fa7f84fad695c1aa93458071e0b27f6e fd402446609261a8071ef298c9d1d660 fe07da37643ed789c48f85d636abcf66
--- a/README.md
+++ b/README.md
@ -23,6 +23,8 @@ Please fire issue to me if any lost APT/Malware events/campaigns.
 * [APTSimulator](https://github.com/NextronSystems/APTSimulator)

 ## 2019
+* Mar 04 - [[FireEye] APT40: Examining a China-Nexus Espionage Actor
+](https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html) | [Local](../../blob/master/2019/2019.03.04.APT40)
 * Feb 14 - [[360] Suspected Molerats' New Attack in the Middle East](https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east-en/) | [Local](../../blob/master/2019/2019.02.14.Molerats_APT)
 * Feb 06 - [[Recorded Future] APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign](https://www.recordedfuture.com/apt10-cyberespionage-campaign/) | [Local](../../blob/master/2019/2019.02.06.APT10_Sustained_Campaign)
 * Feb 05 - [[Anomali Labs] Analyzing Digital Quartermasters in Asia – Do Chinese and Indian APTs Have a Shared Supply Chain?](https://www.anomali.com/blog/analyzing-digital-quartermasters-in-asia-do-chinese-and-indian-apts-have-a-shared-supply-chain) | [Local](../../blob/master/2019/2019.02.05.China_India_APT_shared)
				`@ -0,0 +1 @@`
				00f952c54f1189bf9583d9fb066be54a 055bc765a78da9cc759d1ba7ac7ac05e 0cb26112cb09d268ccbfe10ac59765df 0dfed59e581c181baeabb5d936c902ce 10c6029fbc0a2770b9686cf31d58067a 166694d13ac463ea1c2bed64fbbb7207 17dbbda8cd63c255d647ab7c423367e5 1c35a87f61953baace605fff1a2d0921 1c6ef040cd7121915245677eef5a3180 2366918da9a484735ec3a9808296aab8 25fc656f3756c7d58aa15aa7e9fae2dc 2754975fb01c931f070d880b224eaee7 2a38ff33240e20caabfc53524a840dfd 2bf998d954a88b12dbec1ee96b072cb9 302003a7ee0d848c98df4bb2b7c720cd 35b82e945de3c49d52283f2caea979f5 36db1bad238251aee8a7aed3d6611ee0 388ba6c81f1a1a9272501e75cf4f0004 3cc6ac12134842539b5e09666953d636 3d1488a737aa2dbfbfe27bb4f471dbb5 3de2a22babb69e480db11c3c15197586 3e169f4fafaf7183d969c89509eb5323 3eb6f85ac046a96204096ab65bbd3e7e 3fefa55daeb167931975c22df3eca20a 40528e368d323db0ac5c3f5e1efe4889 494de66128649e8a0402f832f59e2461 4b18b1b56b468c7c782700dd02d621f4 4bfe05f182aa273e113db6ed7dae4bb8 4ca03bc4fe19c40726fdf2522fdf99e2 4e143cd287cd32901959db9a2a1caf6c 4fc312db8fe933dac24f6d442154f4d0 51da8bd4728d910304c87d992a54cd8a 51e21a697aec4cc01e57264b8bfaf978 52d55e7c2fe820278c7e65e67bce06dd 552c0ee63dbab148688d2cc8644b41f0 593bc6a2e29ec3dde3571c3b8422a11c 5e6e4581613bb5938f3b7eb84724aa2a 5ef4eff48da3d64d5bf598f3279e463b 6051a9adad0df05f858ef18bd567d182 62fb42f4697c206f1338cee8b0ea00c7 65225397c292e5a0e049776ed352158c 681b98d0135ff6358b1cf019825a2919 6d250a11f68b1fd4ed0505fb2965b6f7 6e843ef4856336fe3ef4ed27a4c792b1 6f4d0bdc31f082f770eae395216eef08 71aeeaba2f5cfd80fb98a2df06bdad23 72a7fd2b3d1b829a9f01db312fdd1cd7 758d572af84e6a098b995191fa713cf3 7691ae0369ba3b17198c98ba7059c26a 7d34caa19b129f44b48b9497a4970e2a 7dedb394533f86fe97eddaf0a193baf4 7ed9b4031473ebbe8694d4d712ff46f5 824c92e4b27026c113d766c0816428a0 85862c262c087dd4470bb3b055ef8ea5 955af7983ab57c1e2f760405fe56e607 97326e72e700ba4912459b64ded9cdcf 99d8ea34d18432588622ae564114971d 9a643c7f7483c5a30815431943075522 9c1bd3fdd7541c770da2824f1fcf3b1c 9e035ad76bfe8bde87e5ee362af5dc63 a23d7b6a81dc0b460294e8be829f564d a29f3abada0199ddd6cde01ba50a3063 a545a710b0acf3a4c83d3b9e57f22515 a91c9a2b1bc4020514c6c49c5ff84298 a9ad68065f85b28c87cf6df1657dff81 a9e7539c1ebe857bae6efceefaa9dd16 aa4d99ec6913b048d60ddcd1f17e3dba aa8c545a312597c7469f6555cad2dbbb ab2756872719b7f7878a1bc4b062b056 ab37ed19d7300e673e66dbd4fec990b1 ac073ad83555f3748d481bcf796e1993 adc669c40dc71b8d1138e16d9343baae b5678e77398b2bae81b15c603b70fb14 b7499525634a4099d2e19b330e0910d1 b7e7186d962d562af6a5d10a25d19b02 b86b6cc96d587a65afb266eedec0b695 baf296853822e8d984e1fee586bb4927 bd9e4c82bf12c4e7a58221fc52fed705 bf6d3f52ab8176122be858ddccc22148 c0b31a090a263d67de958e7ccb68ebe3 c0e85b34697c8561452a149a0b123435 c1c5634c515303440062d962ce3e4960 c52464e9df8b3d08fc612a0f11fe53b2 c8594dbe90041eb901c7a0aae280415e d1d254d1460e1e3c5339f20c78c78173 d2fb01629fa2a994fbd1b18e475c9f23 d452c1a73a281b772386f0ca70b1ac5e da5596183958529c95626a6c9dc875a1 db72397c05e31456718c732514531df5 ddbd64b7f6588a47d242c8f12d62af96 df9f8cc805dc67c16227f46f573da6d7 e1123a77b36c8dde7bd2e778fba6ecda e4944351000afc07ccecd9929251d744 e72583654007eaadc90eb7dc4a7baecc e82622e08bb27b63ea82de8017b18079 e890fa6fd8a98fec7812d60f65bf1762 ee8d2f20877f77f39814454d40a4e295 f74ccb013edd82b25fd1726b17b670e5 fa7f84fad695c1aa93458071e0b27f6e fd402446609261a8071ef298c9d1d660 fe07da37643ed789c48f85d636abcf66