IoC (TT Malware Log)

Malware の IoC(Indicator)情報

◆注意◆ マルウェア解析専析家向けサイト

     FQDN, URL,IPアドレス等はそのまま掲載しています


** Caution ** Malware expert site

                    FQDN, URL, IP address etc. are posted as they are

AcidBox (2020/06/17)

【インディケータ情報】

■ハッシュ情報(Sha256) - Main worker DLL -

eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5

(以上は Paloalto の情報: 引用元は https://unit42.paloaltonetworks.com/acidbox-rare-malware/ )


■ハッシュ情報(Sha256) - Kernelmode driver -

3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d

(以上は Paloalto の情報: 引用元は https://unit42.paloaltonetworks.com/acidbox-rare-malware/ )


■ハッシュ情報(Sha256) - SSP DLL modules -

003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9
b3166c417d49e94f3d9eab9b1e8ab853b58ba59f734f774b5de75ee631a9b66d
3ad20ca49a979e5ea4a5e154962e7caff17e4ca4f00bec7f3ab89275fcc8f58c

(以上は Paloalto の情報: 引用元は https://unit42.paloaltonetworks.com/acidbox-rare-malware/ )



■ハッシュ情報(Sha256) - Benign VirtualBox VBoxDrv.sys driver v2.2.0 (signed by “Sun Microsystems, Inc.”) -

78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f

(以上は Paloalto の情報: 引用元は https://unit42.paloaltonetworks.com/acidbox-rare-malware/ )


■Mutex

Global\BFE_Event_{xxxxxxxxxxxx–xxxx-xxxxxxxx-xxxxxxxx}
Global\{xxxxxxxxxxxx–xxxx-xxxxxxxx-xxxxxxxx}


■レジストリ

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0003\DriverData (REG_BINARY type)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0000\DriverData (REG_BINARY type)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\0000\DriverData (REG_BINARY type)


【検索】

google: eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5
google: 3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d
google: 003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9
google: b3166c417d49e94f3d9eab9b1e8ab853b58ba59f734f774b5de75ee631a9b66d
google: 3ad20ca49a979e5ea4a5e154962e7caff17e4ca4f00bec7f3ab89275fcc8f58c
google: 78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f


【VT検索】

https://www.virustotal.com/gui/file/eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5
https://www.virustotal.com/gui/file/3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d
https://www.virustotal.com/gui/file/003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9
https://www.virustotal.com/gui/file/b3166c417d49e94f3d9eab9b1e8ab853b58ba59f734f774b5de75ee631a9b66d
https://www.virustotal.com/gui/file/3ad20ca49a979e5ea4a5e154962e7caff17e4ca4f00bec7f3ab89275fcc8f58c
https://www.virustotal.com/gui/file/78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f




【ブログ】

◆AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations (Paloalto, 2020/06/17)
https://unit42.paloaltonetworks.com/acidbox-rare-malware/