【インディケータ情報】
■IPアドレス -Sandworm-
95.216.13.196
103.94.157.5
(以上は NSA の情報: 引用元は https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf )
■FQDN -Sandworm-
hostapp.be
(以上は NSA の情報: 引用元は https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf )
【VT検索】
https://www.virustotal.com/gui/ip-address/95.216.13.196
https://www.virustotal.com/gui/ip-address/103.94.157.5
https://www.virustotal.com/gui/domain/hostapp.be
【公開情報】
◆SANDWORM ACTORS EXPLOITING VULNERABILITY IN EXIM MAIL TRANSFER AGENT (NSA, 2020/05/28)
https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf
⇒ https://malware-log.hatenablog.com/entry/2020/05/28/000000_4
