TT Malware Log

マルウェア / サイバー攻撃 / 解析技術 に関する「個人」の調査・研究ログ

BRONZE BUTLER Targets Japanese Enterprises

f:id:tanigawa:20171015163525p:plain
出典: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses


【ブログ】

◆BRONZE BUTLER Targets Japanese Enterprises (SecureWorks, 2017/10/12)
https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses


【関連まとめ記事】

◆Tick / Bronze Butler (まとめ)
http://malware-log.hatenablog.com/entry/Tick


【インディケータ情報】

■ハッシュ情報(Sha256)

795327de450e7f1e371a019a3d43673b60df4b7bf91138afa9ddc3913384f913 MSGet downloader
c043c28ea0d767055a8f8d4e94a9acdf62a81927b0ae63b8a9f16288f92cd093 MSGet downloader
4d7ce20a8d5bc05b7d4b1e147174f486033805260db1edbbc2516fced7558bcc MSGet downloader
1ca3b1b259681bca70956139d25a559ccd0b0c04d4f45f08fb954e569aabf9ae MSGet downloader
08e49c1d476aefb4c590cf135229d6da7981c7425e547d4f2877d79c1a1ab601 VBE downloader
6a63cb7089480fa76b784ca7043e147332768bccc39b84249af11f05b0dde66f VBE downloader
026f5c37f0d633ab27b83082dd0e818edbd80c27f86ba12b5cf32b425edb92d0 VBE downloader
21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd Daserf (Visual C)
15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92 Daserf (Visual C)
2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c Daserf (Visual C)
85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439 Daserf (Visual C)
f8f31f73157bf049b318429c1d60ad7ff2851e62535d95cf8d121216b95c8602 Daserf (Visual C)
b1690facbce9bcc66ebf18f138dbbc10c3662a2034c211e0c414e47c7e208b4a Daserf (Visual C)
e620c9d19d7d1f609e0bb08465e4c58db97fd0158fb286d938542fc1f03a2302 Daserf (Visual C)
2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162 Daserf (Visual C)
a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05 Daserf (Visual C)
dab557bae0eb93475c2c2639f186fd717dd57d8d6354232838f44ba6b6a07172 Daserf (Visual C)
db6a6a4f675cba87405c9c7b016713d3e65b052ffc6c8963764a3d3788f432fa Daserf (Visual C)
4b8ca82e6f407792cfb51de881f06b86bd4b59f85746b29c3287aee0015b1683 Daserf (Visual C)
db8b494de8d897976288c8ccee707ff7b7967fb48caef99d75687584191c2411 Daserf (Visual C)
e2fd17445d81df89f7a9c1ff1c69c9b382215f597db5e4730f5c76557a6fd1f9 Daserf (Visual C)
0a031665d05e82038d620facf9d4a86a89e78544f2f770f579c980dae2e252bf Daserf (Visual C)
fa9a3341649e798bbc340ce9b2fe69791fe733aa9e46da666ce13b8cf7ca8f4d Daserf (Visual C)
f06b440052bd2c2eb127c33c35a80c4eca34a06360d3ee1bb37348d6029dc955 Daserf (Visual C)
2a39372dea901665ab9429d2f15b3f4fb10706423e177226539047ee1ac3e4a3 Daserf (Visual)
4e15392553ca8e7d06f9f592eb04cf6dbfed18c98c56afc0ccd132465b270e12 Daserf (Delphi)
89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64 Daserf (Delphi)
b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b Daserf (Delphi)
22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43 Daserf (Delphi)
b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a Daserf (Delphi)
67e32df3a460f005e7aec83b903f6d47d5533ff3843a97d186ad02316dff9fa9 Daserf (Delphi)
2c449b562dfce53cf98acaddf37286cfb2d1e9da1536511a08bbd24ed93624a6 Daserf (Delphi)
236848e301d71cab6e17a0503fb268f25412838eccb5fb17e78580d2d0a3a31d Daserf (Delphi)
b0966e89eae36a309d89a0c15c8a07677f58130fdc76bc98c16968376ec80626 Daserf (Delphi)
68e5013a8147e77e892dcd06687e5e815c3837fb83fbff16bac442c65b2f3e73 Daserf (Delphi)
e2f174f8368b46054e6ec2feec00b878b63e331ba3628374d584b238a95fd770 Daserf (Delphi)
7afb8082822bf3e55c6639ed2e272846c6be0e5c1fd40402b8b0f69e37402461 Daserf (Delphi)
630aa710bb7080143498d7fafbb152bbfe581bf690d9bfad041e4e285f152de2 Daserf (Delphi)
efa68fcbd455a72276062fb513b71547ea11fedf4db10a476cc6c9a2fa4f67f7 Datper
90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2 Datper
331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b Datper
12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f Datper
303b75a7c350d26116fe341d77105a33c8cb1da3dc82424c3eac401820e868dd Datper
340906b6b3a4149875dea37221843cb8b67c51eb4520b39956cb6761ef0a3c5d Datper
b3cc83978bbc4f5603e93ec8c687a7007a3f7dbfbae01bff0a30332b06ea44d9 Datper
18e896a7547aacb33aa3941ab1b61659ed099c0f6fbb924068f81b4289b05f12 xxmm
4d208c86c8331b7f1f6dd53f83af9ee4ec700a74792b419f663a3ce105d15d1c xxmm
28894a78bc00d6774d1242925787d35c5c2ae2563f5f7f1ff38dc0b441a15812 xxmm
747041d73b3eb29dde5c9e31efdd5e675f16f182c23999ed5613be0e9be12351 xxmm
15b4c1d29b41531b255e41d39d194a52bdc98a3b65a13771d8caf92372b324ce xxmm
ac501bb7e9e1bc57dd027d152f4a7c473f108e37023aae4bad64117241963b5c xxmm
7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73 xxmm
fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192 xxmm
e94a7e835c657dd8a82dab5705db0ec279d1de97a3524f0e25e1e3d78f0561b8 xxmm
09df0591a885b8d16767820c9eac51a5dd8099a4b17a46bffe38b315a6e29d0b xxmm
7333f4601379d5877ec1416e4d82654d312210d5bcf4d628b98207a737bdb654 xxmm
425616f2958ba176662eb9bd66259fb38ca513b5831f0a07956b22839d915306 xxmm
46eae3931334468246c728a7e0ab3bbfafe40c9f73f80bf0544b8aa649227d60 xxmm
de18ebedc5b29d66244773dda80b22ecf2c453cdbeaa85149c4ff0e96bdc4478 xxmm downloader
70ef2e2fa3ac2c44a34963aca5dfe79e2b4f51795181374cca63bbf789f8a7f0 xxmm downloader
b11941e0510e02283e7732a72f853027ea9271a2d4dc87d736ae33275eab2806 xxmm downloader
bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6 DGet
0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4 RarStar

以上出典: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses


■URL

hxxp://airsteel.co.jp/cgi-bin/search/02/06_cgi.php Datper C2 server
hxxp://gigasolar.jp/images/blog/20131011news-3.php Datper C2 server
hxxp://www.atnet-photo.com/japan/themes/default/themes.php Datper C2 server
hxxp://www.primeob.com/include/mpage/store.php Datper C2 server
hxxp://baby.ests.jp/Templates/themes.php Datper C2 server
hxxp://www.kamomeza.net/coppermine/images/thumb_dom.php xxmm C2 server
hxxp://noukankyo.org/images/about/soshikizu.php xxmm C2 server
hxxp://jmta.co.jp/module/Template/Plugin/Math.php xxmm C2 server
hxxp://i-frontierasia.com/shiryoku/link.php xxmm C2 server
hxxp://leadoffnet.com/img/top/top_12.php xxmm C2 server
hxxp://www.concierge.com.cn/public_html/wp-content/themes/comment.php xxmm C2 server
hxxp://www.wco-kyousai.com/ex-engine/themes/xe_default/conf/info.php xxmm C2 server
hxxp://angelbaby.jpn.cm/html/images/deleteComments.php xxmm C2 server
hxxp://www.infomiracle.info/TwitterQuest/image/ser.dat Used by BRONZE BUTLER to host tools
hxxp://160.16.243.147/images/CUI.jpg Used by BRONZE BUTLER to host tools
hxxp://160.16.243.147/images/ns.jpg Used by BRONZE BUTLER to host tools
hxxp://oan.jp/photo/logo_new.jpg Used by BRONZE BUTLER to host tools
hxxp://oan.jp/photo/logo_old.jpg Used by BRONZE BUTLER to host tools
hxxp://s-city.net/sport/pic1612.jpg Used by BRONZE BUTLER to host tools
hxxp://sha-sigma.com/led/aa.dat Used by BRONZE BUTLER to host tools
hxxp://www.s-city.net/images/beach6.jpg Used by BRONZE BUTLER to host tools
hxxp://www.stylmartin.co.jp/bdflashinfo/ns12.jpg Used by BRONZE BUTLER to host tools
hxxp://www.stylmartin.co.jp/bdflashinfo/pageicons/6.jpg Used by BRONZE BUTLER to host tools
hxxp://www.slvcx.com/t.rar Used by BRONZE BUTLER to host tools
hxxp://www.sinwa-jp.com/works/logo-unix.php BRONZE BUTLER exfiltration point
hxxp://www.baiya.jp/2014dressnumber/images/logo-unix.php BRONZE BUTLER exfiltration point

以上出典: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses


■IPアドレス

115.144.166.240 Daserf (Delphi) C2 server
203.111.252.40 Daserf (Delphi) C2 server
27.255.69.209 Daserf (Delphi) C2 server
27.255.91.238 Daserf (Delphi) C2 server
106.184.5.30 Daserf (Delphi) C2 server

以上出典: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses


Copyright (C) 谷川哲司 (Tetsuji Tanigawa) 1997 - 2019