OPERATION HANGOVER Unveiling an Indian Cyberattack Infrastructure
OPERATION HANGOVER Unveiling an Indian Cyberattack Infrastructure APPENDIXES A: Telenor samples B: Some examples of installers C: Malware string indicators D: Paths extracted from executables E: Domain names F: IP addresses G: Sample MD5’s Operation Hangover: Unveiling an Indian Cyberattack Infrastructure 1 Appendixes Appendix A: Samples extracted from Telenor intrusion 00bd9447c13afbbb7140bef94e24b535, msupl.exe 02d6519b0330a34b72290845e7ed16ab, conhosts.exe 05c983831cad96da01a8a78882959d3e, svcohst.exe 10d8d691ec5c75be5dbab876d39501f1, cpyf.exe 1579467859b48085bdf99b0a1a8c1f86, splitter.exe 1676ded041404671bfb1fcfe9db34dcf, msspr.exe 21a52fedba7d5f4080a8070236f24a81, taskbase.exe 3eddb4a2c427ebba246ba2fa22dbdc50, vcmm.dll 61abb92f0fa605c62dab334c225ef770, winhost.exe 6367c72ef246798c2e8153dd9828e1fa, waulct.exe 82837a05f8e000245f06c35e9ddc3040, srsr.exe 85ce84970182be282436317ebc310c8e, msiep.exe 98ce593bfaeddbbbe056007525032e0d, msspr.exe 9d724c66844d52397816259abdf58cea, vmcc.dll a25d1e14498dd60535c5645ed9f6f488, oprs.exe bd52237db47ba7515b2b7220ca64704e, few important operational documents.doc.exe bfd2529e09932ac6ca18c3aaff55bd79, windwn.exe ca26ca59bafa3ae727560cd31a44b35d, winsvcr.exe ecc8b373e61a01d56f429b2bd9907e09, chrm.exe edc4bdfd659279da90fc7eab8a4c6de3, zfscu.dll f21ca71866a6484a54cd9651282572fd, vtlp.dll Operation Hangover: Unveiling an Indian Cyberattack Infrastructure 2 Appendixes Appendix B: Some related cases based on behaviour and malware similarity parameters. Name: “Pending_Electricity_Bill_(December-January).pdf.exe”,
[Show full text]