【インディケータ情報】
■ハッシュ情報(Sha256) - app.js -
f36db81d384e3c821b496c8faf35a61446635f38a57d04bde0b3dfd19b674587
f71a3a772f4316ab3c940f94aab3d52eabe7ee9da311b112a12eacfcadddb85e
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■ハッシュ情報(Sha256) - node.exe -
ea9399e1f9eafaf6be6608f1401ebb84cf7444ffadabf0b80ba2c186cf7028fa
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■ハッシュ情報(Sha256) - getProxy.exe -
c6cf0ad6d1e687b185407ee450a5b8e9a8ab60461f5c051251badb245df6245f
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■ハッシュ情報(Sha256) - uninstaller.exe -
d1617e7ec278484920c05476eabf783d399d6c03e8d8ab69e2f1fcb6a76417b4
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■ハッシュ情報(Sha256) - Datper -
6530f94ac6d5b7b1da6b881aeb5df078fcc3ebffd3e2ba37585a37b881cde7d3
e38d3a7a86a72517b6ebea89cfd312db0f433385a33d87f2ec8bf83a62396bb3
d91894e366bb1a8362f62c243b8d6e4055a465a7f59327089fa041fe8e65ce30
a7adfd0258e40d4df8cbc2ad7a660fd1c73f8dc2b9a4becc585a712cb5cfa9f1
569ceec6ff588ef343d6cb667acf0379b8bc2d510eda11416a9d3589ff184189
517b2695bbf7164bfb9cab0a133bb0b1aeb387cbb7f30aa01bf5d6f89cca4214
c2e87e5c0ed40806949628ab7d66caaf4be06cab997b78a46f096e53a6f49ffc
4d4ad53fd47c2cc7338fab0de5bbba7cf45ee3d1d947a1942a93045317ed7b49
4dc63bc7bd8bcc758a75f48d573bcea62444db41f6d3bce7c1202265340ab577
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■FQDN
www.rakutenline.com
menu.rakutenline.com
www.sa-guard.com
menu.sa-guard.com
www.han-game.com
menu.han-game.com
www.aromatictree.co.kr
rp.thumbbay.com
www.amamihanahana.com
www.kdcnet.co.kr
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
■IPアドレス
211.233.81.242
110.45.203.133
61.106.60.47
(以上は JPCERT/CC の情報: 引用元は https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html )
【検索】
■app.js
google: f36db81d384e3c821b496c8faf35a61446635f38a57d04bde0b3dfd19b674587
google: f71a3a772f4316ab3c940f94aab3d52eabe7ee9da311b112a12eacfcadddb85e
■node.exe
google: ea9399e1f9eafaf6be6608f1401ebb84cf7444ffadabf0b80ba2c186cf7028fa
■getProxy.exe
google: c6cf0ad6d1e687b185407ee450a5b8e9a8ab60461f5c051251badb245df6245f
■uninstaller.exe
google: d1617e7ec278484920c05476eabf783d399d6c03e8d8ab69e2f1fcb6a76417b4
■Datper
google: 6530f94ac6d5b7b1da6b881aeb5df078fcc3ebffd3e2ba37585a37b881cde7d3
google: e38d3a7a86a72517b6ebea89cfd312db0f433385a33d87f2ec8bf83a62396bb3
google: d91894e366bb1a8362f62c243b8d6e4055a465a7f59327089fa041fe8e65ce30
google: a7adfd0258e40d4df8cbc2ad7a660fd1c73f8dc2b9a4becc585a712cb5cfa9f1
google: 569ceec6ff588ef343d6cb667acf0379b8bc2d510eda11416a9d3589ff184189
google: 517b2695bbf7164bfb9cab0a133bb0b1aeb387cbb7f30aa01bf5d6f89cca4214
google: c2e87e5c0ed40806949628ab7d66caaf4be06cab997b78a46f096e53a6f49ffc
google: 4d4ad53fd47c2cc7338fab0de5bbba7cf45ee3d1d947a1942a93045317ed7b49
google: 4dc63bc7bd8bcc758a75f48d573bcea62444db41f6d3bce7c1202265340ab577
【VT検索】
■app.js
https://www.virustotal.com/gui/file/f36db81d384e3c821b496c8faf35a61446635f38a57d04bde0b3dfd19b674587
https://www.virustotal.com/gui/file/f71a3a772f4316ab3c940f94aab3d52eabe7ee9da311b112a12eacfcadddb85e
■node.exe
https://www.virustotal.com/gui/file/ea9399e1f9eafaf6be6608f1401ebb84cf7444ffadabf0b80ba2c186cf7028fa
■getProxy.exe
https://www.virustotal.com/gui/file/c6cf0ad6d1e687b185407ee450a5b8e9a8ab60461f5c051251badb245df6245f
■uninstaller.exe
https://www.virustotal.com/gui/file/d1617e7ec278484920c05476eabf783d399d6c03e8d8ab69e2f1fcb6a76417b4
■Datper
https://www.virustotal.com/gui/file/6530f94ac6d5b7b1da6b881aeb5df078fcc3ebffd3e2ba37585a37b881cde7d3
https://www.virustotal.com/gui/file/e38d3a7a86a72517b6ebea89cfd312db0f433385a33d87f2ec8bf83a62396bb3
https://www.virustotal.com/gui/file/d91894e366bb1a8362f62c243b8d6e4055a465a7f59327089fa041fe8e65ce30
https://www.virustotal.com/gui/file/a7adfd0258e40d4df8cbc2ad7a660fd1c73f8dc2b9a4becc585a712cb5cfa9f1
https://www.virustotal.com/gui/file/569ceec6ff588ef343d6cb667acf0379b8bc2d510eda11416a9d3589ff184189
https://www.virustotal.com/gui/file/517b2695bbf7164bfb9cab0a133bb0b1aeb387cbb7f30aa01bf5d6f89cca4214
https://www.virustotal.com/gui/file/c2e87e5c0ed40806949628ab7d66caaf4be06cab997b78a46f096e53a6f49ffc
https://www.virustotal.com/gui/file/4d4ad53fd47c2cc7338fab0de5bbba7cf45ee3d1d947a1942a93045317ed7b49
https://www.virustotal.com/gui/file/4dc63bc7bd8bcc758a75f48d573bcea62444db41f6d3bce7c1202265340ab577
【公開情報】
◆攻撃グループTickによる日本の組織をターゲットにした攻撃活動 (JPCERT/CC, 2019/02/19)
https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
