出典: https://securelist.com/gaza-cybergang-updated-2017-activity/82765/
【ニュース】
◆Gaza Cybergang – updated activity in 2017: (SECURELIST, 2017/10/30)
New targets, use of MS Access Macros and CVE 2017-0199, and possible mobile espionage
https://securelist.com/gaza-cybergang-updated-2017-activity/82765/
【インディケータ情報】
■ハッシュ情報とファイル名・通信先
| MD5 | ファイル名 | 通信先 |
|---|---|---|
| 552796e71f7ff304f91b39f5da46499b | nvStView.exe | upgrade.newshelpyou.com |
| 6fba58b9f9496cc52e78379de9f7f24e | صور خاصة.exe | |
| eb521caebcf03df561443194c37911a5 | صور خاصة.exe | |
| 66f144be4d4ef9c83bea528a4cd3baf3 | تصريح لأمير قطر واتهام الإمارات في اختراق وكالة الأنباء.exe | moreoffer.life |
| 3ff60c100b67697163291690e0c2c2b7 | MOM.InstallProxy.exe | |
| b7390bc8c8a9a71a69ce4cc0c928153b | تعرف على المنقبة التي أساءت للسعودية | |
| f43188accfb6923d62fe265d6d9c0940 | Gcc-Ksa-uae.exe | |
| 056d83c1c1b5f905d18b3c5d58ff5342 | مراسلة بخصوص اجتماع رؤساء البعثات.exe | |
| 87a67371770fda4c2650564cbb00934d | hamas.doc | 138.68.242.68 |
| نقاط اتفاق حماس وتيار فتح الاصلاحي.doc | ||
| محضر اجتماع مركزية فتح الليلة.doc | ||
| سلفة أم راتب للموظفين يوم الثلاثاء المقبل؟.doc | ||
| 4f3b1a2088e473c7d2373849deb4536f | Notepad.exe | lol.mynetav.org |
| attachment.scr | ||
| 7d3426d8eb70e4486e803afb3eeac14f | Ramallah.exe | signup.updatesforme.club |
| 0ee4757ab9040a95e035a667457e4bc6 | 27-4-2017 Fateh Gaza plo.exe | |
| b68fcf8feb35a00362758fc0f92f7c2e | hxxp://download.data-server.cloudns[.]club/indexer.exe | ping.topsite.life |
| 7bef124131ffc2ef3db349b980e52847 | الأخ اسماعيل هنية -نائب رئيس المكتب السياسي .exe | |
| d87c872869023911494305ef4acbd966 | hxxp://download.data-server.cloudns[.]club/wordindexer.exe | |
| a3de096598e3c9c8f3ab194edc4caa76 | viewimages.exe | |
| c078743eac33df15af2d9a4f24159500 | viewimages.exe | |
| 70d03e34cadb0f1e1bc6f4bf8486e4e8 | download-file.duckdns[.]org/send/Egyptian_agreement_with_President_Mahmoud_Abbas.exe | |
| 67f48fd24bae3e63b29edccc524f4096 | hxxp://alasra-paper.duckdns.org/send/رسالة_وفد_الرئيس ابومازن_لحماس_في قطاع_غزة.rar | |
| 7b536c348a21c309605fa2cd2860a41d | hxxp://alasra-paper.duckdns.org/send/ورقة_الاسرى_المقدمة_لفك_الاضراب .rar | |
| hxxp://alasra-paper.duckdns[.]org/send/%D9%88%ket-Edition-1.04_ApkHouse.com/Dont-Starve-Pocket-Edition-1.04_ApkHouse.com.apk | alasra-paper.duckdns.org | |
| cf9d89061917e9f48481db80e674f0e9 | وثائق تنشر لأول مره عن حكم حماس لقطاع غزه .exe | hamas-wathaq.duckdns.org |
| 86a89693a273d6962825cf1846c3b6ce | SQLiteDatabaseBrowserPortable.exe | manual.newphoneapp.com |
| 3f67231f30fa742138e713085e1279a6 | SQLiteDatabaseBrowserPortable.exe |
※ 出典: https://securelist.com/gaza-cybergang-updated-2017-activity/82765/
■ハッシュ情報(MD5)
- 87a67371770fda4c2650564cbb00934d
- 4f3b1a2088e473c7d2373849deb4536f
- c078743eac33df15af2d9a4f24159500
- 3ff60c100b67697163291690e0c2c2b7
- a3de096598e3c9c8f3ab194edc4caa76
- 7d3426d8eb70e4486e803afb3eeac14f
- 3f67231f30fa742138e713085e1279a6
- 552796e71f7ff304f91b39f5da46499b
- 6fba58b9f9496cc52e78379de9f7f24e
- eb521caebcf03df561443194c37911a5
- b68fcf8feb35a00362758fc0f92f7c2e
- d87c872869023911494305ef4acbd966
- 66f144be4d4ef9c83bea528a4cd3baf3
- B7390bc8c8a9a71a69ce4cc0c928153b
- F43188accfb6923d62fe265d6d9c0940
- 056d83c1c1b5f905d18b3c5d58ff5342
- 0ee4757ab9040a95e035a667457e4bc6
- 7bef124131ffc2ef3db349b980e52847
- 70d03e34cadb0f1e1bc6f4bf8486e4e8
- 67f48fd24bae3e63b29edccc524f4096
- 7b536c348a21c309605fa2cd2860a41d
- cf9d89061917e9f48481db80e674f0e9
- 6d6f34f7cfcb64e44d67638a2f33d619
- 86a89693a273d6962825cf1846c3b6ce
- 5472d0554a0188c0ecebd065eddb9485
■ハッシュ情報(Sha256)
- 0b6fe466a3ba36895208e754b155a193780c79ba8b5c1c9f02c4f7e479116e5f
- 0c4aa50c95c990d5c5c55345626155b87625986881a2c066ce032af6871c426a
- 0d235478ae9cc87b7b907181ccd151b618d74955716ba2dbc40a74dc1cdfc4aa
- 1f2b128d26a58a572ea1faee2c4d9dc759eb8add16d9ad0547b3f0305fea212a
- 205f32cc717c2d82baeff9ff5aa9fc31967b6ae5cde22fafe14aec9c9ec62acc
- 284af7a2fafdbff3bbc28b9075f469d2352758b62d182b0e056d29ee74688126
- 344dc6ece5a6dacce9050a65305d4b34865756051a6f414477b6fa381e1c1b63
- 42e4298f5162aba825309673187e27121e3f918238e81f3a6e021c03f3455154
- 44a8d0561a9cc6e24d6935ff4c35b7b7db50c4001eb01c48ea1cfd13253bc694
- 57a12f20c6bbd69b93e76d6d5a31d720046b498aa880b95b85a4f3fda28aac4f
- 72b039550d31afaeee11dedf7d80333aeda5c504272d426ae0d91bc0cd82c5b0
- 72d2ad8f38e60c23c96698149507fc627664a5706a4431b96014fbf25495b529
- 788f7fd06030f87d411c61efbc52a3efca03359570353da209b2ce4ccf5b4b70
- 7fcac2f18a8844e4af9f923891cfb6f637a99195a457b6cdb916926d709c6a04
- 84adba3c81ad1c2a8285c31d1171f6f671492d9f3ed5ee2c7af326a9a8dc5278
- 852ccc491204f227c3da58a00f53846296454d124b23021bdb168798c8eee2fb
- 86bd78b4c8c94c046d927fb29ae0b944bf2a8513a378b51b3977b77e59a52806
- 9347a47d63b29c96a4f39b201537d844e249ac50ded388d66f47adc4e0880c7e
- b597d7b5b9c2f1962257f912e911961ad0da4c28fc6a90a0b7db4e242aa007d8
- bfb88878a22c23138a67cc25872e82d77e54036b846067ddc43e988c50379915
- c23f715c8588c8d8725352ed515749389d898996107132b2d25749a4efc82a90
- c47bc2c15f08655d158bb8c9d5254c804c9b6faded526be6879fa94ea4a64f72
- db53b35c80e8ec3f8782c4d34c83389e8e9b837a6b3cc700c1b566e4e4450ec2
- dd9debe517717552d7422b08a477faa01badbcc4074830c080a1a1c763e1a544
- b800d29d6e1f2f85c5bc036e927c1dae745a3c646389599b0754592d76b5564b
■ドメイン名
- 138.68.242.68
- 185.86.149.168
- 185.11.146.68
- 45.32.84.66
- 45.32.71.95
- 107.161.27.158
- 46.246.87.74
