APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat

【概要】

• コマンド
  • sc create CorWrTool binPath= "\"C:\Windows\vss\vixDiskMountServer.exe\"" start= auto displayname= "Corel Writing Tools Utility" type= own
  • sc description CorWrTool "Corel Graphics Corporation Applications."
  • ping -a [Redacted]
  • psexec.exe d.exe
  • net view /domain:[Redacted]
  • proxyconnect - "port": 3389, "server": "[IP Address Redacted]"

【ブログ】

◆APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat (FireEye, 2017/04/06)
https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html

【関連まとめ記事】

◆APT10 / MenuPass (まとめ)
http://malware-log.hatenablog.com/entry/APT10

◆RedLeaves (まとめ)
http://malware-log.hatenablog.com/entry/RedLeaves

◆Quasar RAT (まとめ)
https://malware-log.hatenablog.com/entry/Quasar_RAT

【インディケータ情報】

■ハッシュ情報(MD5)

20f0dde824193a7367b9fd36ff998908
8f6d35989ee1d8adbdc120b1fe5671ef
36cb01a7c598ed2048a0eed95c14d5da

(以上は PWCの情報。 引用元は https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html)