Malware
XCSSET
Indicators of Compromise 80
Domain accapple[.]ru Domain adschecks[.]ru Domain adsmobi[.]ru Domain adsmorein[.]in Domain adsmoreme[.]in Domain amdcdn[.]ru Domain amzndev[.]in Domain amzndev[.]ru Domain amznprod[.]in Domain applecdn[.]ru Domain appledisk[.]ru Domain appledns[.]ru Domain appletime[.]in Domain bulksec[.]ru Domain cdnamz[.]in Domain cdnamz[.]ru Domain cdnapple[.]in Domain cdnatapple[.]ru Domain cdnroute[.]ru Domain checkcdn[.]ru Domain chromeads[.]ru Domain cnmag[.]ru Domain devnetaps[.]ru Domain dnsapple[.]ru Domain dnsrelays[.]ru Domain explorecdn[.]ru Domain fiddlejoy[.]ru Domain figmacat[.]ru Domain figmanets[.]in Domain funchats[.]ru Domain gironetcdn[.]ru Domain goalmate[.]ru Domain googlenets[.]ru Domain greencn[.]ru Domain icloudsnet[.]ru Domain imails[.]ru Domain legalads[.]in Domain littleads[.]in Domain littledns[.]ru Domain maganet[.]ru Domain mindelgate[.]ru Domain netapsdev[.]ru Domain netcdnads[.]in Domain netcdndev[.]in Domain netcdndev[.]ru Domain netcorps[.]ru Domain netsprot[.]in Domain netsproto[.]in Domain networkads[.]in Domain rigacdn[.]in Domain rigmajoys[.]in Domain rigmanet[.]ru Domain rigmanets[.]in Domain sahusuzuki[.]in Domain stuffdns[.]in Domain testjoys[.]ru Domain timewebnet[.]in Domain vigmanet[.]ru Domain whitead[.]in Domain whiteads[.]ru Domain wincdn[.]ru Domain windsecure[.]ru Filename .tr Filename .tr_map Filename Telegram.app Filename base_tr_file.txt Filename base_tr_map.txt Filename chrome_remote Filename zw_sfp64 GitHub Repo Xcode project on GitHub SHA-1 6e480d648fa1b70612f5d198a66875e28847547d IP 151[.]243[.]109[.]188 IP 178[.]208[.]92[.]129 IP 178[.]208[.]92[.]168 IP 91[.]108[.]106[.]229 IP 95[.]142[.]35[.]206 IP 95[.]142[.]35[.]34 IP 95[.]142[.]37[.]159 Registry User mpirv_eahpi_apm Registry User ychax_muwch_ucy
MITRE ATT&CK TTPs 14
T1001 T1012 T1027 T1057 T1059.004 T1070.004 T1070.006 T1071.001 T1082 T1083 T1090 T1112 T1497 T1548
Data Obfuscation
Command And Control
Query Registry
Discovery
Obfuscated Files or Information
Defense Evasion
Process Discovery
Discovery
Unix Shell
Execution
File Deletion
Defense Evasion
Timestomp
Defense Evasion
Web Protocols
Command And Control
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Proxy
Command And Control
Modify Registry
Defense Evasion
Virtualization/Sandbox Evasion
Defense Evasion
Abuse Elevation Control Mechanism
Privilege Escalation