Back github.com

Tree Master Turla

github.com • November 10, 2026

Share: View original

Gazer Indicators of Compromise File names Registry keys Mutex C&C servers Samples Function names

Mosquito Indicators of Compromise ESET detection names Network indicators (C&C servers) Samples Windows artefacts

Network indicators (C&C servers)

Turla Outlook Indicators of Compromise Sample hashes Filenames Registry Keys YARA rules

LightNeuron Indicators of Compromise Sample hashes Filenames

Turla PowerShell Indicators of Compromise Sample hashes Filenames

Turla Watering Hole Armenia Sample hashes Compromised websites C&C servers

Turla ComRAT v4 Indicators of Compromise Sample hashes Paths Windows registry C&C servers

Turla Crutch Indicators of Compromise Sample hashes Paths C&C servers

To the Moon and back(doors): Lunar landing in diplomatic missions — Indicators of Compromise ESET detection names Files Network Indicators Paths Registry key Cryptographic keys

Gamaredon X Turla collab Indicators of Compromise Sample hashes Paths C&C servers

Exchange for breakfast: Turla’s Cereal tricks are not for kids - Indicators of Compromise Files

Carbon Indicators of Compromise

The blog post Carbon is available on WeLiveSecurity at

(hacked websites used as 1st level proxies)

soheylistore.ir:80:/modules/mod_feed/feed.php

tazohor.com:80:/wp-includes/feed-rss- .php

jucheafrica.com:80:/wp-includes/class-wp-edit.php

61paris.fr:80:/wp-includes/ms-set.php

doctorshand.org:80:/wp-content/ /

Communication library 3.62

Communication library 4.00

Gazer Indicators of Compromise

The white paper Gazer is available on WeLiveSecurity at .

A high level summary is also available as a blog post on WeLiveSecurity at .

%TEMP%\CVRG72B5.tmp.cvr

%TEMP%\CVRG1A6B.tmp.cvr

%TEMP%\CVRG38D9.tmp.cvr

%HOMEPATH%\ntuser.dat.LOG3

%HOMEPATH%\AppData\Local\Adobe\AdobeUpdater.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ScreenSaver

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Explorer\ScreenSaver

{531511FA-190D-5D85-8A4A-279F2F592CC7}

hxxp://daybreakhealthcare.co.uk/wp-includes/themees.php

hxxp://simplecreative.design/wp-content/plugins/calculated-fields-form/single.php

hxxp://169.255.137.203/rss_0.php

hxxp://outletpiumini.springwaterfeatures.com/wp-includes/pomo/settings.php

hxxp://zerogov.com/wp-content/plugins.deactivate/paypal-donations/src/PaypalDonations/SimpleSubsribe.php

hxxp://ales.ball-mill.es/ckfinder/core/connector/php/php4/CommandHandler/CommandHandler.php

hxxp://dyskurs.com.ua/wp-admin/includes/map- .php

hxxp://warrixmalaysia.com.my/wp-content/plugins/jetpack/modules/ -form/grunion-table-form.php

hxxp://217.171.86.137/config.php

hxxp://217.171.86.137/rss_0.php

hxxp://shinestars-lifestyle.com/old_shinstar/includes/old/front_footer.old.php

hxxp://

hxxp://baby.greenweb.co.il/wp-content/themes/san-kloud/admin.php

hxxp://soligro.com/wp-includes/pomo/db.php

hxxp://giadinhvabe.net/wp-content/themes/viettemp/out/css/class.php

hxxp://tekfordummies.com/wp-content/plugins/social-auto-poster/includes/libraries/delicious/Delicious.php

hxxp://kennynguyen.esy.es/wp-content/plugins/wp-statistics/vendor/maxmind-db/reader/tests/MaxMind/Db/test/Reader/BuildTest.php

hxxp://sonneteck.com/wp-content/plugins/yith-woocommerce-wishlist/plugin-fw/licence/templates/panel/activation/activation.php

hxxp://chagiocaxuanson.esy.es/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ngglegacy/admin/templates/manage_gallery/gallery_preview_page_field.old.php

hxxp://hotnews.16mb.com/wp-content/themes/twentysixteen/template-parts/content-header.php

hxxp://zszinhyosz.pe.hu/wp-content/themes/twentyfourteen/page-templates/full-hight.php

hxxp://weandcats.com/wp-content/plugins/broken-link-checker/modules/checkers/http-module.php`

35f205367e2e5f8a121925bbae6ff07626b526a7

[email protected] valid from 14/10/2015 to 14/10/2016

b151cd7c4f9e53a8dcbdeb7ce61ccdd146eb68ab

[email protected] valid from 14/10/2015 to 14/10/2016

e40bb5beec5678537e8fe537f872b2ad6b77e08a

[email protected] valid from 14/10/2015 to 14/10/2016

522e5f02c06ad215c9d0c23c5a6a523d34ae4e91

[email protected] valid from 14/10/2015 to 14/10/2016

c380038a57ffb8c064851b898f630312fabcbba7

[email protected] valid from 14/10/2015 to 14/10/2016

267f144d771b4e2832798485108decd505cb824a

[email protected] valid from 14/10/2015 to 14/10/2016

52f6d09cccdbc38d66c184521e7ccf6b28c4b4d9

[email protected] valid from 14/10/2015 to 14/10/2016

475c59744accb09724dae610763b7284646ab63f

[email protected] valid from 14/10/2015 to 14/10/2016

22542a3245d52b7bcdb3eaef5b8b2693f451f497

[email protected] valid from 14/10/2015 to 14/10/2016

2b9faa8b0fcadac710c7b2b93d492ff1028b5291

[email protected] valid from 14/10/2015 to 14/10/2016

e05ab6978c17724b7c874f44f8a6cbfb1c56418d

[email protected] valid from 14/10/2015 to 14/10/2016

6dec3438d212b67356200bbac5ec7fa41c716d86

[email protected] valid from 14/10/2015 to 14/10/2016

b548863df838069455a76d2a63327434c02d0d9d

c3e6511377dfe85a34e19b33575870dda8884c3c

[email protected] valid from 16/12/2015 to 16/12/2017

9ff4f59ca26388c37d0b1f0e0b22322d926e294a

[email protected] valid from 16/12/2015 to 16/12/2017

029aa51549d0b9222db49a53d2604d79ad1c1e59

[email protected] valid from 16/12/2015 to 16/12/2017

cecc70f2b2d50269191336219a8f893d45f5e979

[email protected] valid from 16/12/2015 to 16/12/2017

7fac4fc130637afab31c56ce0a01e555d5dea40d

[email protected] valid from 16/12/2015 to 16/12/2017

5838A51426CA6095B1C92B87E1BE22276C21A044

[email protected] valid from 16/12/2015 to 16/12/2017

3944253F6B7019EED496FAD756F4651BE0E282B4

[email protected] valid from 16/12/2015 to 16/12/2017

228da957a9ed661e17e00efba8e923fd17fae054

Gazer orchestrator x32

295d142a7bdced124fdcc8edfe49b9f3acceab8a

Gazer orchestrator x32

0f97f599fab7f8057424340c246d3a836c141782

Gazer orchestrator x32

dbb185e493a0fdc959763533d86d73f986409f1b

Gazer orchestrator x32

4701828dee543b994ed2578b9e0d3991f22bd827

Gazer orchestrator x64

6fd611667ba19691958b5b72673b9b802edd7ff8

Gazer orchestrator x64

fcabeb735c51e2b8eb6fb07bda8b95401d069bd8

Gazer orchestrator x64

75831df9cbcfd7bf812511148d2a0f117324a75f

Gazer orchestrator x32

bae3ae65c32838fb52a0f5ad2cde8659d2bff9f3

Gazer orchestrator x32

37ff6841419adc51eeb8756660b2fb46f3eb24ed

Gazer orchestrator x64

9e6de3577b463451b7afce24ab646ef62ad6c2bd

Gazer orchestrator x64

795c6ee27b147ff0a05c0477f70477e315916e0e

Gazer orchestrator x64

8184ad9d6bbd03e99a397f8e925fa66cfbe5cf1b

Gazer orchestrator x64

7ced96b08d7593e28fee616eccbc6338896517cf

Gazer orchestrator x64

63c534630c2ce0070ad203f9704f1526e83ae586

Gazer orchestrator x64

23f1e3be3175d49e7b262cd88cfd517694dcba18

Gazer orchestrator x64

7a6f1486269abdc1d658db618dc3c6f2ac85a4a7

Gazer orchestrator x64

11B35320FB1CF21D2E57770D8D8B237EB4330EAA

Gazer orchestrator x64

E8A2BAD87027F2BF3ECAE477F805DE13FCCC0181

Gazer orchestrator x32

950F0B0C7701835C5FBDB6C5698A04B8AFE068E6

Gazer orchestrator x64

a5eec8c6aadf784994bf68d9d937bb7af3684d5c

[email protected] valid from 14/10/2015 to 14/10/2016

411ef895fe8dd4e040e8bf4048f4327f917e5724

[email protected] valid from 14/10/2015 to 14/10/2016

c1288df9022bcd2c0a217b1536dfa83928768d06

4b6ef62d5d59f2fe7f245dd3042dc7b83e3cc923

7f54f9f2a6909062988ae87c1337f3cf38d68d35

[email protected] valid from 14/10/2015 to 14/10/2016

27FA78DE705EBAA4B11C4B5FE7277F91906B3F92

There are few samples of Gazer that use the current function name as first parameter for the log function. Here is a list of some function names used in Gazer:

AutorunManager Class AutorunManager::~AutorunManger AutorunManager::Init AutorunManger::ReInit AutorunManager::BuildAutorunSettings AutorunManager::FreeAutorunsSettings AutorunManager::FullCheck AutorunManager::StartAutorunEx AutorunManager::FullStart

AutorunManager::~AutorunManger

AutorunManger::ReInit

AutorunManager::BuildAutorunSettings

AutorunManager::FreeAutorunsSettings

AutorunManager::FullCheck

AutorunManager::StartAutorunEx

AutorunManager::FullStart

HiddenTaskAutorun Class HiddenTaskAutorun::IsPathsEqual

HiddenTaskAutorun Class

HiddenTaskAutorun::IsPathsEqual

LinkAutorun Class LinkAutorunClass::InfectLnkFile LinkAutorunClass::ClearLnkFile LinkAutorunClass::CheckLnkFile

LinkAutorunClass::InfectLnkFile

LinkAutorunClass::ClearLnkFile

LinkAutorunClass::CheckLnkFile

RemoteImport32 Class RemoteImport32::RemoteImport32 RemoteImport32::GetRemoteProcAddress RemoteImport32::GetRemoteModuleHandle

RemoteImport32::RemoteImport32

RemoteImport32::GetRemoteProcAddress

RemoteImport32::GetRemoteModuleHandle

ScreenSaverAutorun Class ScreenSaverAutorun::ChangeScreenSaver ScreenSaverAutorun::WndProc1 ScreenSaverAutorun::GetMessageThreadProc ScreenSaverAutorun::CreateHiddenWindow ScreenSaverAutorun::CloseHiddenWindow

ScreenSaverAutorun Class

ScreenSaverAutorun::ChangeScreenSaver

ScreenSaverAutorun::WndProc1

ScreenSaverAutorun::GetMessageThreadProc

ScreenSaverAutorun::CreateHiddenWindow

ScreenSaverAutorun::CloseHiddenWindow

ShellAutorun Class ShellAutorun::AutorunInstallEx ShellAutorun::AutorunUninstallEx ShellAutorun::AutorunCheckEx ShellAutorun::IsPathsEqual

ShellAutorun::AutorunInstallEx

ShellAutorun::AutorunUninstallEx

ShellAutorun::AutorunCheckEx

ShellAutorun::IsPathsEqual

StartupAutorun Class StartupAutorun::AutorunInstallEx StartupAutorun::AutorunUninstallEx StartupAutorun::AutorunCheckEx StartupAutorun::IsPathsEqual

StartupAutorun::AutorunInstallEx

StartupAutorun::AutorunUninstallEx

StartupAutorun::AutorunCheckEx

StartupAutorun::IsPathsEqual

TaskScheduler20Autorun Class TaskScheduler20Autorun::Init TaskScheduler20Autorun::AutorunCheckEx TaskScheduler20Autorun::AutorunInstallEx TaskScheduler20Autorun::AutorunUninstallEx TaskScheduler20Autorun::IsPathsEqual

TaskScheduler20Autorun Class

TaskScheduler20Autorun::Init

TaskScheduler20Autorun::AutorunCheckEx

TaskScheduler20Autorun::AutorunInstallEx

TaskScheduler20Autorun::AutorunUninstallEx

TaskScheduler20Autorun::IsPathsEqual

DllInjector Class DllInjector::LoadDllToProcess DllInjector::GetProcHandle DllInjector::CheckDllAndSetPlatform DllInjector::CopyDllFromBuffer DllInjector::MapLibrary DllInjector::Map86Library_tox64 DllInjector::CallEntryPoint DllInjector::FindDllImageBase DllInjector::WindowInject

DllInjector::LoadDllToProcess

DllInjector::GetProcHandle

DllInjector::CheckDllAndSetPlatform

DllInjector::CopyDllFromBuffer

DllInjector::MapLibrary

DllInjector::Map86Library_tox64

DllInjector::CallEntryPoint

DllInjector::FindDllImageBase

DllInjector::WindowInject

InjectManager Class InjectManager::~InjectManager InjectManager::BuildInjectSettingsList InjectManager::FreeInjectSettingsList InjectManager::Stop InjectManager::DetachAll InjectManager::FindAndInjectInVictim InjectManager::FindProcessSimple2 InjectManager::LoadNtdll InjectManager::UnLoadNtdll InjectManager::LoadWinsta InjectManager::UnLoadWinsta InjectManager::SetStatusTransportDll InjectManager::GetTransportState InjectManager::DestroyManuallyCreatedVictim InjectManager::VictimManualCreateIE

InjectManager::~InjectManager

InjectManager::BuildInjectSettingsList

InjectManager::FreeInjectSettingsList

InjectManager::DetachAll

InjectManager::FindAndInjectInVictim

InjectManager::FindProcessSimple2

InjectManager::LoadNtdll

InjectManager::UnLoadNtdll

InjectManager::LoadWinsta

InjectManager::UnLoadWinsta

InjectManager::SetStatusTransportDll

InjectManager::GetTransportState

InjectManager::DestroyManuallyCreatedVictim

InjectManager::VictimManualCreateIE

NPTransport Class TNPTransport::Init TNPTransport::ReInit TNPTransport::~TNPTransport TNPTransport::Receive TNPTransport::RunServer TNPTransport::ServerProc

TNPTransport::~TNPTransport

TNPTransport::Receive

TNPTransport::RunServer

TNPTransport::ServerProc

ExeStorage Class ExeStorage::Migrate ExeStorage::SecureHeapFree

ExeStorage::SecureHeapFree

FSStorage Class FSStorage::~FSStorage FSStorage::Init FSStorage::GetBlock FSStorage::GetListBlock FSStorage::Migrate FSStorage::SecureHeapFree FSStorage::Update FSStorage::Empty

FSStorage::~FSStorage

FSStorage::GetListBlock

FSStorage::SecureHeapFree

RegStorage Class RegStorage::~RegStorage RegStorage::Init RegStorage::FreeList RegStorage::GetListBlock RegStorage::DeleteListBlock RegStorage::Migrate RegStorage::SecureHeapFree RegStorage::Update RegStorage::Empty

RegStorage::~RegStorage

RegStorage::GetListBlock

RegStorage::DeleteListBlock

RegStorage::SecureHeapFree

ResultQueue Class ResultQueue::~ResultQueue ResultQueue::DumpQueueToStorage ResultQueue::RestoreFromStorage ResultQueue::ClearQueue ResultQueue::RemoveResult ResultQueue::GetNextResultToSendWithModule ResultQueue::SetPredeterminedResult ResultQueue::print

ResultQueue::~ResultQueue

ResultQueue::DumpQueueToStorage

ResultQueue::RestoreFromStorage

ResultQueue::ClearQueue

ResultQueue::RemoveResult

ResultQueue::GetNextResultToSendWithModule

ResultQueue::SetPredeterminedResult

TaskQueue Class TaskQueue::~TaskQueue TaskQueue::DumpQueueToStorage TaskQueue::RestoreFromStorage TaskQueue::ClearQueue TaskQueue::RemoveCompletedTasks TaskQueue::print

TaskQueue::~TaskQueue

TaskQueue::DumpQueueToStorage

TaskQueue::RestoreFromStorage

TaskQueue::ClearQueue

TaskQueue::RemoveCompletedTasks

CExecutionSubsystem Class CExecutionSubsystem::~CExecutionSubsystem CExecutionSubsystem::Stop CExecutionSubsystem::TaskExecusion CExecutionSubsystem::TaskConfigure CExecutionSubsystem::TaskUpload CExecutionSubsystem::TaskDownload CExecutionSubsystem::TaskReplacement CExecutionSubsystem::TaskDelete CExecutionSubsystem::TaskPacketLocalTransport CExecutionSubsystem::FinishTask CExecutionSubsystem::PushTaskResult CExecutionSubsystem::UpdateStorage

CExecutionSubsystem Class

CExecutionSubsystem::~CExecutionSubsystem

CExecutionSubsystem::Stop

CExecutionSubsystem::TaskExecusion

CExecutionSubsystem::TaskConfigure

CExecutionSubsystem::TaskUpload

CExecutionSubsystem::TaskDownload

CExecutionSubsystem::TaskReplacement

CExecutionSubsystem::TaskDelete

CExecutionSubsystem::TaskPacketLocalTransport

CExecutionSubsystem::FinishTask

CExecutionSubsystem::PushTaskResult

CExecutionSubsystem::UpdateStorage

CMessageProcessingSystem Class CMessageProcessingSystem::~CMessageProcessing CMessageProcessingSystem::ListenerCallBack CMessageProcessingSystem::WaitShutdownModule CMessageProcessingSystem::SetCompulsorySMC CMessageProcessingSystem::UnSetCompulsorySMC CMessageProcessingSystem::IsCompulsorySMC CMessageProcessingSystem::GetCompulsorySMC CMessageProcessingSystem::Receive_TAKE_NOP CMessageProcessingSystem::Receive_GIVE_SETTINGS CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK CMessageProcessingSystem::Receive_GIVE_CACHE CMessageProcessingSystem::Receive_TAKE_CACHE CMessageProcessingSystem::Receive_TAKE_TASK CMessageProcessingSystem::Receive_GIVE_RESULT CMessageProcessingSystem::Receive_TAKE_CONFIRM_RESULT CMessageProcessingSystem::Receive_TAKE_LOADER_BODY CMessageProcessingSystem::Receive_TAKE_UNINSTALL CMessageProcessingSystem::Receive_NO_CONNECT_TO_Gazer CMessageProcessingSystem::Receive_TAKE_LAST_CONNECTION CMessageProcessingSystem::Send_TAKE_FIN CMessageProcessingSystem::Send_TAKE_SHUTDOWN CMessageProcessingSystem::Send_TAKE_SETTINGS CMessageProcessingSystem::Send_TAKE_RESULT

CMessageProcessingSystem Class

CMessageProcessingSystem::~CMessageProcessing

CMessageProcessingSystem::ListenerCallBack

CMessageProcessingSystem::WaitShutdownModule

CMessageProcessingSystem::SetCompulsorySMC

CMessageProcessingSystem::UnSetCompulsorySMC

CMessageProcessingSystem::IsCompulsorySMC

CMessageProcessingSystem::GetCompulsorySMC

CMessageProcessingSystem::Receive_TAKE_NOP

CMessageProcessingSystem::Receive_GIVE_SETTINGS

CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK

CMessageProcessingSystem::Receive_GIVE_CACHE

CMessageProcessingSystem::Receive_TAKE_CACHE

CMessageProcessingSystem::Receive_TAKE_TASK

CMessageProcessingSystem::Receive_GIVE_RESULT

CMessageProcessingSystem::Receive_TAKE_CONFIRM_RESULT

CMessageProcessingSystem::Receive_TAKE_LOADER_BODY

CMessageProcessingSystem::Receive_TAKE_UNINSTALL

CMessageProcessingSystem::Receive_NO_CONNECT_TO_Gazer

CMessageProcessingSystem::Receive_TAKE_LAST_CONNECTION

CMessageProcessingSystem::Send_TAKE_FIN

CMessageProcessingSystem::Send_TAKE_SHUTDOWN

CMessageProcessingSystem::Send_TAKE_SETTINGS

CMessageProcessingSystem::Send_TAKE_RESULT

Crypto Class Crypto::GetPublicKey Crypto::EncryptRSA Crypto::Sign Crypto::EncryptAndSignBufferRSAEx Crypto::DecryptRSA Crypto::Verify Crypto::DecryptAndVerifyBufferRSAEx Crypto::EncryptAndSignBufferRSA1 Crypto::EncryptAndSignBufferRSAC Crypto::DecryptAndVerifyBufferRSA0 Crypto::DecryptAndVerifyBufferRSA1 Crypto::DecryptAndVerifyBufferRSAL Crypto::VerifyLoaderFile Crypto::VerifyLoader Crypto::CompressBuffer Crypto::DecompressBuffer

Crypto::EncryptAndSignBufferRSAEx

Crypto::DecryptAndVerifyBufferRSAEx

Crypto::EncryptAndSignBufferRSA1

Crypto::EncryptAndSignBufferRSAC

Crypto::DecryptAndVerifyBufferRSA0

Crypto::DecryptAndVerifyBufferRSA1

Crypto::DecryptAndVerifyBufferRSAL

Crypto::VerifyLoaderFile

Crypto::CompressBuffer

Crypto::DecompressBuffer

LTManager Class LTManager::~LTManager LTManager::Init LTManager::GetResultFromQueue LTManager::SetResultToCache LTManager::GetTaskFromCache LTManager::SetTaskToQueue LTManager::IsSendPacketFurtherOnRoute LTManager::SendPacketNextRouteUnit LTManager::SetCache LTManager::SetPacket LTManager::DumpCacheToStorage LTManager::DeSerializeCache LTManager::DeSerializePacket LTManager::DeSerializeRoute LTManager::DeSerializeTask LTManager::DeSerializeResult LTManager::SerializeCache LTManager::SerializePacket LTManager::SerialiazeRoute LTManager::SerializeTask LTManager::SerializeResult LTManager::ClearCache LTManager::ClearPacket LTManager::ClearRoute LTManager::ClearTask LTManager::ClearResult LTManager::PrintCache LTManager::CreateEvents LTManager::SetEvents LTManager::ResetEvents LTManager::WaitEvents LTManager::DeleteEvents

LTManager::~LTManager

LTManager::GetResultFromQueue

LTManager::SetResultToCache

LTManager::GetTaskFromCache

LTManager::SetTaskToQueue

LTManager::IsSendPacketFurtherOnRoute

LTManager::SendPacketNextRouteUnit

LTManager::DumpCacheToStorage

LTManager::DeSerializeCache

LTManager::DeSerializePacket

LTManager::DeSerializeRoute

LTManager::DeSerializeTask

LTManager::DeSerializeResult

LTManager::SerializeCache

LTManager::SerializePacket

LTManager::SerialiazeRoute

LTManager::SerializeTask

LTManager::SerializeResult

LTManager::ClearCache

LTManager::ClearPacket

LTManager::ClearRoute

LTManager::ClearResult

LTManager::PrintCache

LTManager::CreateEvents

LTManager::ResetEvents

LTManager::WaitEvents

LTManager::DeleteEvents

LTMessageProcessing Class LTMessageProcessing::ListenerCallBack LTMessageProcessing::Send_TAKE_OK LTMessageProcessing::Send_TAKE_ERROR_CRYPT LTMessageProcessing::Send_TAKE_ERROR_UNKNOWN

LTMessageProcessing Class

LTMessageProcessing::ListenerCallBack

LTMessageProcessing::Send_TAKE_OK

LTMessageProcessing::Send_TAKE_ERROR_CRYPT

LTMessageProcessing::Send_TAKE_ERROR_UNKNOWN

LTNamedPipe Class LTNamedPipe::ReInit LTNamedPipe::BuildLocalTransportSettings LTNamedPipe::~LTNamedPipe LTNamedPipe::Receive LTNamedPipe::RunServer LTNamedPipe::Stop LTNamedPipe::CreateNewNPInstance LTNamedPipe::ServerProc LTNamedPipe::ClientCommunication

LTNamedPipe::BuildLocalTransportSettings

LTNamedPipe::~LTNamedPipe

LTNamedPipe::RunServer

LTNamedPipe::CreateNewNPInstance

LTNamedPipe::ServerProc

LTNamedPipe::ClientCommunication

Mosquito Indicators of Compromise

The blog post Mosquito is available on WeLiveSecurity at .

Win32/TrojanDownloader.CAM

Win32/TrojanDownloader.DMU

JS/TrojanDownloader.Agent.REG

Network indicators (C&C servers)

adstore.twilightparadox[.]com

ebay-global.publicvm[.]com

psychology-blog.ezua[.]com

auberdine.etowns[.]net

officebuild.4irc[.]com

sendmessage.mooo[.]com

tellmemore.4irc[.]com

Win32 Backdoor ( .pdb )

{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}

{08244EE6-92F0-47F2-9FC9-929BAA2E7235}

{4E14FBA2-2E22-11D1-9964-00C04FBBB345}

{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}

{603D3801-BD81-11D0-A3A5-00C04FD706EC}

{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}

{9207D8C7-E7C8-412E-87F8-2E61171BD291}

{A3B3C46C-05D8-429B-BF66-87068B4CE563}

{0997898B-0713-11D2-A4AA-00C04F8EEB3E}

{603D3801-BD81-11D0-A3A5-00C04FD706EC}

{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}

Three files with the same name but a different extension ( .tlb , .pdb and .tnl ) in a folder of %APPDATA%

%APPDATA%\kb6867.bin (simplified log file)

%APPDATA%\Microsoft\local_update_checker.js (JScript backdoor)

%APPDATA%\Microsoft\google_update_checker.js (JScript backdoor)

Turla Outlook Indicators of Compromise

The white paper Turla Outlook is available on WeLiveSecurity at . A high level summary is also available as a blog post on WeLiveSecurity at .

The MISP event is available at .

8A7E2399A61EC025C15D06ECDD9B7B37D6245EC2

F992ABE8A67120667A01B88CD5BF11CA39D491A0

CF943895684C6FF8D1E922A76B71A188CFB371D7

851DFFA6CD611DC70C9A0D5B487FF00BC3853F30

%APPDATA%/Microsoft/Windows/scawrdot.db

%APPDATA%/Microsoft/Windows/flobcsnd.dat

HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\ZonePolicy\

HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066}

HKCU\Software\Classes\CLSID\{84DA0A92-25E0-11D3-B9F7-00C04F4C8F5D}

LightNeuron Indicators of Compromise

The white paper Turla LightNeuron is available on WeLiveSecurity at . A high level summary is also available as a blog post on WeLiveSecurity at .

The MISP event is available in misp-turla-lightneuron-event.json .

3C851E239FBF67A03E0DAE8F63EEE702B330DB6C

76EE1802A6C920CBEB3A1053A4EC03C71B7E46F8

FF28B53B55BC77A5B4626F9DB856E67AC598C787

C1FF6804FDB8656AB08928D187837D28060A552F

F9D52BB5A30B42FC2D1763BE586CEE8A57424732

0A9F10925AF42DF94925D07112F303D57392C908

A4D1A34FE5EFFD90CCB6897679586DDC07FBC5CD

C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\msmocf.xml

C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\msmodl.dat

C:\Windows\serviceprofiles\networkservice\appdata\Roaming\Microsoft\Windows\814ad43-58ab-2cd3-3e68-b82a8f402fd0

C:\Windows\serviceprofiles\networkservice\appdata\Roaming\Microsoft\Windows\42cf8a1-6e20-8c24-d35f-82c46d8b70ba

C:\Windows\serviceprofiles\networkservice\appdata\Roaming\Microsoft\Windows\36b1f4a-82b9-eb06-7c1e-90b4b2d5c27d

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\thumbcache_idx.db

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\thumbcache_32.db

Turla PowerShell Indicators of Compromise

The blog post Turla PowerShell scripts is available on WeLiveSecurity at

The MISP event is available in misp-turla-powershell-event.json .

50C0BF9479EFC93FA9CF1AA99BDCA923273B71A1

PowerShell loader with encrypted payload

EC54EF8D79BF30B63C5249AF7A8A3C652595B923

RPC backdoor (client)

9CDF6D5878FC3AECF10761FD72371A2877F270D0

RPC backdoor (server)

D3DF3F32716042404798E3E9D691ACED2F78BDD5

File exfiltration RPC plugin

9D1C563E5228B2572F5CA14F0EC33CA0DEDA3D57

RPCSpoofServerInstaller

B948E25D061039D64115CFDE74D2FF4372E83765

RPC interface patcher

%PUBLIC%\iCore.dat (log file, one-byte XOR 0x55)

\\pipe\\atctl (named pipe)

C:\Users\Public\Documents\desktop.db

Turla Watering Hole Armenia

The blog post the Turla Watering Hole campaign in Armenia is available on WeLiveSecurity at

The MISP event is available in misp-turla-wateringhole-armenia-event.json .

973620A7AB28A2CBA82DC2A613CD24ED43734381

B6567F988C9ACC5DF3CBD72409FC70D54EA412BB

9F81710B85AA7088505C1EECCE9DA94A39A2DC06

32430B11E42EDEB63A11E721927FFBABE7C9CFEA

620A669EC0451C9F079FB4731F254AC577902E5E

Skipper communication DLL

Turla ComRAT v4 Indicators of Compromise

The white paper Turla ComRAT v4 is available on WeLiveSecurity at . A high level summary is also available as a blog post on WeLiveSecurity at .

The MISP event is available in misp-turla-comrat-v4-event.json .

4D8B1F4ACC638080054FFBB4CEF2559583A22DC6

DD7006D16D8E121FCE8F2905433474ECCED75CC0

0139818441431C72A1935E7F740A1CC458A63452

0AB87F7BDF7D9E54BA33FE715C11E275D5DCCE15

%TEMP%\FXSAPIDebugTrace.txt

(HKLM|HKCU)\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-80C5-5595FE6B30EE}

HKLM\SOFTWARE\Microsoft\SQMClient\Windows.WSqmCons

Turla Crutch Indicators of Compromise

The blogpost Turla Crutch is available on WeLiveSecurity at .

The MISP event is available in misp-turla-crutch-event.json .

A010D5449D29A1916827FDB443E3C84C405CB2A5

Crutch dropper similar to Gazer

2FABCF0FCE7F733F45E73B432F413E564B92D651

Crutch v3 backdoor (packed)

A4AFF23B9A58B598524A71F09AA67994083A9C83

Crutch v3 backdoor (unpacked)

778AA3A58F5C76E537B5FE287912CC53469A6078

C:\Intel\~intel_upd.exe

C:\Program Files (x86)\Google\Chrome\Application\dwmapi.dll

C:\Program Files (x86)\Mozilla Firefox\rasadhlp.dll

%LOCALAPPDATA%\Microsoft\OneDrive\dwmapi.dll

hotspot.accesscam[.]org

highcolumn.webredirect[.]org

theguardian.webredirect[.]org

To the Moon and back(doors): Lunar landing in diplomatic missions — Indicators of Compromise

The blog post on Lunar toolset is available on WeLiveSecurity at

VBA/TrojanDownloader.Agent.ZJC

9CEC3972FA35C88DE87BD66950E18B3E0A6DF77C

VBA/TrojanDownloader.Agent.ZJC

Malicious Word macro that installs LunarMail.

DE83C2C3FE68CB1BF96173E9EE3EA6161DCFB24A

Compiled version of ASP.NET web page that installs LunarWeb.

2ED792E39F7D56DE52BDF4AED96AFC898478BFDF

LunarLoader (x64) used to load LunarMail.

F09E36553E48EBD42E60D9B25A390C0F57FF8DE0

LunarLoader (x86) used to load LunarMail.

795C4127D42FE8DFAF4510B406B52BA5BEDE8D3A

LunarLoader (x64) used to load LunarWeb.

94A4CE9C75BC847E7BE59B96C4133D677D909414

LunarLoader (x64) used to load LunarWeb.

00006B30806F915911349D82BEEB1AEB9025ADB4

LunarLoader (x64); a trojanized AdmPwd, used to load LunarWeb.

19D86CF2ED82EAE23E019706FAE8DAFC60552E85

LunarLoader (x64); a trojanized AdmPwd, used to load LunarWeb.

FCAE66F6D95C78DC829688CC0F4C39BB5A57828B

LunarMail backdoor (x64).

67C6AEC8D129E610378EF52F8BF934886587932F

LunarMail backdoor (x86).

754FB657156643FD09A68EC9FC124528578CAB0C

LunarWeb backdoor (x86).

4C84110F1B10DF5FDD612759E210E44B0F0505EF

LunarWeb backdoor (x64).

5D3975E57BDCB630A00FEBE5D405EEFB6D119D86

LunarWeb backdoor (x64).

5EF771AFC96C24371D367448627609CFACB34A57

LunarWeb backdoor (x64).

512E4FA7D6119270FF44A3B2A2359EE8825392EF

LunarWeb backdoor (x64).

thedarktower.av.master.dns-cloud[.]net

Domain (Free DNS) pinged by malicious Word macro.

Akamai Connected Cloud