PH
C
-cynika_
HTML:
<DOCTYPE HTML>
<html>
<head>
<title>
china espionage
</title>
</head>
<body>
<p>
ALERT: State-Sponsored APT / Cyber Espionage ATTACK
Reference:
https://blogs.blackberry.com/en/2020/04/decade-of-the-rats
IT ADMINS AND INFOSEC TEAM SCAN, BLOCK, AND FLAG THE DATA LISTED BELOW:
email
wuyu@tide(.)org
coleen(.)designate(.)56580956@gmail(.)com
void_2k@qq(.)com
hostname
sdfaswaed2(.)nokiadns(.)com
us(.)btmods(.)net
linux(.)css2(.)com
mi(.)btmods(.)net
serconsole(.)vicp(.)cc
ios(.)0pengl(.)com
symante(.)nortonvirus(.)org
bot2(.)googlerenewals(.)net
b(.)zabbixx(.)com
l3wpk9kmumodtkr8(.)ibmassist(.)com
tab(.)dellrescue(.)com
cdn(.)googletoolservices(.)com
yum(.)nortonvirus(.)org
ssl(.)360antivirus(.)org
zabbix(.)symanteprotection(.)com
wsus(.)kasperskyantivirus(.)net
gs(.)gw688(.)org
kdwontyraqdswlqm(.)ossrescue(.)com
y3dx36f6(.)love6d(.)com
cachecdn(.)moegoo(.)com
ark(.)aeriagames(.)us
norton(.)nortonvirus(.)org
linux(.)unitys3d(.)com
dhcp(.)godaddydns(.)com
update(.)fortinetantivirus(.)com
orabbix(.)zabbixmonitor(.)net
www(.)alidnx(.)com
ns6(.)0pendns(.)org
linux(.)cocoss2d(.)com
yum(.)anydesk(.)me
linux2(.)googlerenewals(.)net
dns(.)0pengl(.)com
app(.)aqmobi(.)com
bht(.)aqmobi(.)com
app(.)appleadwords(.)net
URL
http(:)//app(.)appleadwords(.)net/s2/
http(:)//app(.)appleadwords(.)net/s1/
domain
moeskin(.)com
010sec(.)com
o5team(.)com
youfunv(.)com
heixbai(.)com
orzk(.)net
akibaol(.)com
psserviceonline(.)com
FileHash-SHA1
86a83efa5a3221565a76adbefe17fe26db52b38a
4645d593b9f9577a95673f65c626fd5c0ba5170a
9020e5010a916c6187597e9932402ed29098371c
77d5b40bd860f545e0895fe7c3eff47c6ea62985
c1480c4033f008be0d6da8bd8a6d5825e22550a9
ce52808fbf36a1f08c80c313c689115212459717
2e80926d67ea68acb1df441be5ee1f2d86e7f92b
fb7b32ca62bb38a2595523c9acf4232cdd4a64eb
b755fee8bd712eff556ec327be7706f86374ef47
bc11d82e4a554c5565363a50e7d7e5af973d1a10
dbeb0c5356d0d4a978d64c34a3e4734d9e96acd3
3e68e247892f193ebfec96c23066bb249be42637
c602290cb2cd1d2ca5c9c8571868495fe7518d9c
21298f73598bb73d04c7cbcb723fa757f2839ebf
e7aa4538f450b8b16fe2f0fa8c562a3d7af89cb2
fb86cc9d8be66642c3c397e59fdc5ed88bc6ec33
920769fd7e2f82eeeb7c424313e94484c4d6d586
0cc9333b089a881fc8f1765709208fd73f211cf1
0f92ace99ca39bba6e00356d578bece59a14becb
2d96dc86b768a2c50e533908cc97e6d363847c5f
6bfabe6eea3be2e59bc52bd69c64be7706e7a391
0fdd5871a46e6ade2e38c02546975ec902a11123
79516000514fc147a7e59a1f0d09e34b1524ce7e
06290633c9652f9bb8d28082d0e183f67c4aec86
fa53f09cd22b46b554762dc1a12c99dd692ec681
32673104c8c9b8bce00c6095215b7de93c070b58
c1e5e73cabe795e592ba2feea519ab4077655042
b40ebdc2e0e6c00c263e17c0060b073ef4f54b8a
91806bc687b30f1260c168c5e68e48b0ddba9da0
FileHash-MD5
b7994283974ae70b802be129a10a0c72
e13ac456425a7d8e576c528d81cf3695
ece1186d17238b65a24ecd62708a6efd
2f694eb18672db441b4f12b74dbafd9d
39a7ee48739db13bda5b02f174317784
ae9c39e0d9a0c0ae48a72cb10521d2f3
956c44a4ec1ba56c75cb4558ed3a653e
d501da9056d57b99d99b59668e673f12
9484f3d747a6377cef7812a3abfdbc71
74f2d00936df60cc12edfa4fd1edc90a
ea78869555018cdab3699e2df5d7e7f8
1b2d75f9c7717f377100924cdbdb10b1
0e3b41da52382744e5b2c1c38be00f04
94a609539f97ac9d1087c5affc8155e8
96fb28626f2db5e378cf48960230f712
b464b3517bd1668ac2b34186a3256a25
a50079038ed23142898fe606d7b37cae
28558fd3777eb7123fc3a436addd5b79
5282af098c6eb008f0b0664861b4bdce
72d6d2d0026152197df0ae86bc4644f1
a9c2ff438c73e865624eeb0763235a14
d0372ae97d4c9264b5dc7ecc744d41ca
b7f958f93e2f297e717cffc2fe43f2e9
62bcbfae5276064615d0d45b895fdff2
dfd2cf91627783e7128c373e91c089f3
5916bfcb29ad3f4f8204141bbc26390b
931017406b4718d81d2c776165e6ddf0
382e1eb5eb4028584e802420612977cb
5096b87a9dec78f9027dec76a726546d
FileHash-SHA256
e2d2761fc2535d99527df2f7cffd8dddccd504dc0096f6d6f7fe7a4bbc032473
1ff2743e1b20f9f98e4e02dd5eb9b293e72b6dab769272c194cef11adfbfd5d0
2f4b48457d8465347d1d40b040fa246f3b8b657531304238231c8b1e92100e78
fc3cacb2103adedc11720c34a243de58085c1a7283ba3577b52a9fc9ab36301c
71f188e26d6ecda3462da3bfa81b956de71e05fd045a7f66d0b5528a9d7aca36
e1be51b7e59518bcae7232291fda614033eba56e8cb4578dcbf721f80bb8da37
fbe294910ef833e1c9b2c8663c06b6ef99c13b2bc5eb01e87defb798c8066f0b
ce3424524fd1f482a0339a3f92e440532cff97c104769837fa6ae52869013558
ac546bd38ad2e56b42fd3e35f27048ca9c86203153868944188e6fb6822d9f63
be801280934ccb73d4ed8469ffacc9ed760ce1db25b891283c91333a15bf70d7
7fbf5efd35ca300537949c16d9ce68b7f7b98e82bba1f95a265b8d46324d7f2c
736324637ec2f43e3ec196b4674b38955de2cbf13988e269581933cf806ba8cc
a340af9b766b922dc0a0253784df59ca99bcaff1db33eb205faeb4c1072bdd3e
83125b051e1f31051e58041597573ab8743c81cce61b4da8025a1cfcff4e6e80
1ea23560b820917b4b2d9ad8cc9cfd46d22a5bed5356702e9edb699bae1c0e5d
57be4485c43dc461b4a8f43fb7fb0d7a4550da130148f8634dca88bd9366de53
2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc
42eab05c611bf24d86bb6c985caa2ad7380ed7d98340c7f08de9361be14dc244
64cc74de6455c387218f2c09f5c1d2e149ae0c295960e9c61586c428e375ec4b
dbd03093e58c2d60f4f47b720691cd3e6310f0566403ee0a34c2d59db9fc58d2
c2229a463637433451a3a50ccf3c888da8202058f5022ffd2b00fc411b395b79
726ebf8743295a7facc6626a780069b3e0c82d594f8f2417a80fb679f4e7d325
1cc3978d3764c421a4ac810978f3d9e3f606c8ee7c79a7395d49b33aae16a601
28924b6329f5410a5cca30f3530a3fb8a97c23c9509a192f2092cbdf139a91d8
08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e
d07af16c19a467fbac0a5173b0aa4c4a85863335ac9bb3f60d1bf2638b7ccc7d
af30d617dd0edb4f4107457674951cec28a276215c92b8fc64112ccdbbd32445
266ea3df14b4a3e42ef47800ea1a70c89d184c96f9ab27059ef273176736b592
0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b
3628efd2a0e4c28c13233dbd8353ad825865312f39cfbaff1e259f37b2dd08b5
9d6677826890c037e6066ec2e25c5ca56b6c8a75b1ed70b5c68c1642800429fd
fe61dc240c8854614bc57f0ef5a4ffcaf3852a4c9d64d759bed41f990f7dcc99
dfb39fabb3a3a8d7edb1ec3f2b90de02c5122e222a0df4260bdb6d31d898e4fe
36b872251991609e951aa426a24731b835a3e2a7b16f83f11ac2462439837a64
503d9e4be006218902c5eeada66f2bf76c6efb0cb5d06300fc9246dda668007a
8674c76583c13c60fcb6dc344bae4a5149cce35a85bb600f0a6af5e769b98585
d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a
0d132fddc55941caeca2b2777cd555ebac728a6e0fcc3fe3a07d4a6376f57691
7929af1c8e1c1c575f807b617e60586393bd3be1922cc4541fdd69975f90fc5b
ef049339f1eb091cda335b51939f91e784e1ab1e006056d5a6bb526743b6cbc7
57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300
a37574387a4bacfb69e7369d6ac8749603038a1b232d9a482bbcd2dce0c091b0
b28c024db80cf3e7d5b24ccc9342014de19be990efe154ba9a7d17d9e158eecb
9b7c1e37d5f56cc0b5e5e22ce9805e237a189297e78405b9c392a0953b6e0321
43d66c7aad578950d8c58e4a82d32db86a67584ab09399d4c1108e7481cd92f4
12c02b62f14cf5675e2453cbc4e884735a7c25d6288551152a0e8545b70f936a
e416ad91acbc386bf67dc551fb36b9d95a195d8b656cfe4001325b8bf507624e
65d21c3374e332e2bfeedd3ec7ab0df67b57b676dd2d52a2e2c389f844aa7a18
5455af6789342055aa04055934cca7d1873cbddf735e771130e40a9431a7c656
08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75
64424a7c5f0d8e1c5d64c4c6fa9bdc2987dbdcf1bafdb6f45df9e783712c5187
a3fc3ca178175fa8d767d865bc983ef40ced5aaf721750c6279a1ef7faa418ac
</p>
</body>
</html>
</DOCTYPE>