Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le février 10, 2018, 17:00:35

Titre: [FireEye]A Detailed Examination of the Siesta Campaign
Posté par: igor51 le février 10, 2018, 17:00:35
A Detailed Examination of the Siesta Campaign

Executive Summary


 

FireEye recently looked deeper into the activity discussed in     href="http://blog.trendmicro.com/trendlabs-security-intelligence/the-siesta-campaign-a-new-targeted-attack-awakens/">TrendMicro’s
  blog and dubbed the “Siesta” campaign. The tools, modus operandi,
  and infrastructure used in the campaign present two possibilities:
  either the Chinese cyber-espionage unit   href="http://intelreport.mandiant.com/">APT1 is perpetrating this
  activity, or another group is using the same tactics and tools as the
  legacy APT1.


 

The Siesta campaign reinforces the fact that analysts and network
  defenders should remain on the lookout for known, public indicators
  and for shared attributes that allow security experts to detect
  multiple actors with one signature.


 


  Overview


 

On March 6, 2014 TrendMicro reported on the Siesta Campaign. Though
  not explicitly stated in this report, the tactics, techniques and
  procedures (TTPs) described in this report share a number of
  characteristics with historical activity we’ve attributed to APT1
  (also known as the “Comment Crew”).


 

We witnessed this same campaign targeting a customer in the
  telecommunications sector on Feb. 20, 2014, using a spear-phishing
  message with a link to ifuedit[.]net/Healthcare_Questionnaire.zip.
  This zip file contained a malicious executable with the following properties:


 
   
            class="c09_td">61249bf64fa270931570b8a5eba06afa
   
                class="c09_td">2014-02-20 02:28:21
   
            class="c09_td">39e9e4eac77a09b915626f315b963a4f
   
            class="c09_td">a126c8c7c50bf034f2d3ba4aa5bcab28
   
            class="c09_td">bb95154b5aeb13a4ff937afa2e7e4560
   
            class="c09_td">edf3a1e142fc212da11dc72698184ad5
   
            class="c09_td">20ff5087740eabff5bdbdf99d9fb6853
MD5
Compile Time
.text
.rdata
.data
.rsrc
Import Hash

 

 

This sample initiated a callback to
  www[.]microsofthomes[.]com/index.html.


 

This same import hash was seen in the following samples:


 
   
     
   
     
       
   
     
       
MD5         scope="col">Compile Time         scope="col">Command-and-Control (CnC) server

        68f73d81c814ab2f70eed02c0be3b67d       class="c09_td_value is-hidden-mml">68f73d81c814ab2f70eed02c0be3b67d
            2014-02-20 02:26:24           class="c09_td_value is-hidden-mml">2014-02-20
      02:26:24		           class="is-visible-mml">
        www[.]microsofthomes[.]com       class="c09_td_value is-hidden-mml">www[.]microsofthomes[.]com

        20b124baaaec1e8cbc3cd52e8e5ceebd       class="c09_td_value is-hidden-mml">20b124baaaec1e8cbc3cd52e8e5ceebd
            2014-02-20 02:26:24           class="c09_td_value is-hidden-mml">2014-02-20
      02:26:24		           class="is-visible-mml">
        www[.]microsofthomes[.]com       class="c09_td_value is-hidden-mml">www[.]microsofthomes[.]com

 


  Techniques, tactics, and procedures analysis


 

The TTPs described above are consistent with APT1. This group
  previously relied on establishing a foothold in targeted networks with
  following methods:


 
 


  Analysis of Related Samples


 

A related dropper listed in the TrendMicro report on the Siesta
  campaign is MD5 0f3031412d255336a102bbc1dcd43812. This sample had the
  following properties:


 
   
            class="c09_td">0f3031412d255336a102bbc1dcd43812
   
                class="c09_td">2014-02-19 09:29:04
   
            class="c09_td">a2e11e9c8b07888345d6cdf7d995b832
   
            class="c09_td">0203cc3bb607e9cfa296fa857b243468
   
            class="c09_td">7d281bd27bc1279428bd1798671eb57b
   
            class="c09_td">caa869fa01ddfee26156166a10c42944
   
            class="c09_td">0fefba40443edd57f816502035077e3e
MD5
Compile Time
.text
.rdata
.data
.rsrc
Import Hash

 

The import hash of 0fefba40443edd57f816502035077e3e is in other
  samples linked to the Siesta campaign including:


 
   
     
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        643654975b63a9bb6f597502e5cd8f49       class="c09_td_value is-hidden-mml">643654975b63a9bb6f597502e5cd8f49
            2014-01-14 04:38:30           class="c09_td_value is-hidden-mml">2014-01-14
      04:38:30		           class="is-visible-mml">
        www[.]cloudcominc[.]com       class="c09_td_value is-hidden-mml">www[.]cloudcominc[.]com

        0f3031412d255336a102bbc1dcd43812       class="c09_td_value is-hidden-mml">0f3031412d255336a102bbc1dcd43812
            2014-02-19 09:29:04           class="c09_td_value is-hidden-mml">2014-02-19
      09:29:04		           class="is-visible-mml">
        www[.]skyslisten[.]com       class="c09_td_value is-hidden-mml">www[.]skyslisten[.]com

 

The import hash from this dropper was also seen in a number of
  previous APT1 samples dating as far back as 2011 — well before the
  release of the APT1
  report. We previously discussed the value of tracking via import
  hashing   href="http://www.mandiant.com/blog/tracking-malware-import-hashing/">here.
  Other APT1 samples with this same import hash include (but are not
  limited to):


 
   
     
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        719453b4da6d3814604c84a28d4d1f4c       class="c09_td_value is-hidden-mml">719453b4da6d3814604c84a28d4d1f4c
            2011-06-16 12:54:20           class="c09_td_value is-hidden-mml">2011-06-16
      12:54:20		           class="is-visible-mml">
        www[.]stapharrest[.]com       class="c09_td_value is-hidden-mml">www[.]stapharrest[.]com

        93a6e9a26924a5cdab8ed47cadbe88d5       class="c09_td_value is-hidden-mml">93a6e9a26924a5cdab8ed47cadbe88d5
            2012-01-18 13:35:54           class="c09_td_value is-hidden-mml">2012-01-18
      13:35:54		           class="is-visible-mml">
        www[.]offerdahls[.]com       class="c09_td_value is-hidden-mml">www[.]offerdahls[.]com

        c2aadd6a69a775602d984af64eaeda96       class="c09_td_value is-hidden-mml">c2aadd6a69a775602d984af64eaeda96
            2012-05-15 09:02:25           class="c09_td_value is-hidden-mml">2012-05-15
      09:02:25		           class="is-visible-mml">
        www[.]bluecoate[.]com       class="c09_td_value is-hidden-mml">www[.]bluecoate[.]com

        1df0b937239473df0187063392dae028       class="c09_td_value is-hidden-mml">1df0b937239473df0187063392dae028
            2012-06-20 09:25:31           class="c09_td_value is-hidden-mml">2012-06-20
      09:25:31		           class="is-visible-mml">
        www[.]billyjoebobshow[.]com       class="c09_td_value is-hidden-mml">www[.]billyjoebobshow[.]com

        55065f1b341e5b095b6d453923d5654d       class="c09_td_value is-hidden-mml">55065f1b341e5b095b6d453923d5654d
            2012-07-12 09:21:17           class="c09_td_value is-hidden-mml">2012-07-12
      09:21:17		           class="is-visible-mml"> 184.82.164.104
                class="c09_td_value is-hidden-mml">184.82.164.104

        65502e91e3676cf30778a7078f1061de       class="c09_td_value is-hidden-mml">65502e91e3676cf30778a7078f1061de
            2012-07-19 09:31:42           class="c09_td_value is-hidden-mml">2012-07-19
      09:31:42		           class="is-visible-mml">
        www[.]billyjoebobshow[.]com       class="c09_td_value is-hidden-mml">www[.]billyjoebobshow[.]com

        287113e4423813efd242af8e6255f680       class="c09_td_value is-hidden-mml">287113e4423813efd242af8e6255f680
            2012-07-24 05:53:22           class="c09_td_value is-hidden-mml">2012-07-24
      05:53:22		           class="is-visible-mml">
        thales[.]myftp[.]info       class="c09_td_value is-hidden-mml">thales[.]myftp[.]info

        d613d40d5402f58d8952da2c24d1a769       class="c09_td_value is-hidden-mml">d613d40d5402f58d8952da2c24d1a769
            2012-09-27 12:46:20           class="c09_td_value is-hidden-mml">2012-09-27
      12:46:20		           class="is-visible-mml">
        www[.]billyjoebobshow[       class="c09_td_value is-hidden-mml">www[.]billyjoebobshow[

        57a4c6236b4ecf96d31258e5cc6f0ae4       class="c09_td_value is-hidden-mml">57a4c6236b4ecf96d31258e5cc6f0ae4
            2013-01-07 07:43:14           class="c09_td_value is-hidden-mml">2013-01-07
      07:43:14		           class="is-visible-mml">
        manslist[.]loopback[.]nu       class="c09_td_value is-hidden-mml">manslist[.]loopback[.]nu

        e5a4ec0519c471b5be093aee5c33b1ee       class="c09_td_value is-hidden-mml">e5a4ec0519c471b5be093aee5c33b1ee
            2013-01-08 07:34:59           class="c09_td_value is-hidden-mml">2013-01-08
      07:34:59		           class="is-visible-mml">
        www[.]whackcard[.]com       class="c09_td_value is-hidden-mml">www[.]whackcard[.]com

        f822a9e08b51c19a154dfb63ee9b8367       class="c09_td_value is-hidden-mml">f822a9e08b51c19a154dfb63ee9b8367
            2013-01-10 07:50:58           class="c09_td_value is-hidden-mml">2013-01-10
      07:50:58		           class="is-visible-mml">
        technology[.]acmetoy[.]com       class="c09_td_value is-hidden-mml">technology[.]acmetoy[.]com

 

Further, the 0f3031412d255336a102bbc1dcd43812 sample dropped a
  backdoor with the MD5 hash 185e930a19ad1a99c226d59ef563e28c. This
  implant was stored as a resource within the dropper, and it contained
  a custom base64 alphabet of
  oWXYZabcdefghijkl123456789ABCDEFGHIJKL+/MNOPQRSTUVmn0pqrstuvwxyz. This
  custom alphabet was used by the malware to decode commands issued by
  the attacker to the victim machine and to Base64 encode the reverse
  shell from the victims back to the CnC server.This same custom
  alphabet has been used in previous APT1 samples including (but not
  limited to):
 


 
   
     
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        736ebc9b8ece410aaf4e8b60615f065f       class="c09_td_value is-hidden-mml">736ebc9b8ece410aaf4e8b60615f065f
            2003-05-15 08:58:48           class="c09_td_value is-hidden-mml">2003-05-15
      08:58:48		           class="is-visible-mml">
        www[.]comtoway[.]com       class="c09_td_value is-hidden-mml">www[.]comtoway[.]com

        ac87816b9a371e72512d8fd82f61c737       class="c09_td_value is-hidden-mml">ac87816b9a371e72512d8fd82f61c737
            2006-09-14 02:28:46           class="c09_td_value is-hidden-mml">2006-09-14
      02:28:46		           class="is-visible-mml"> www[.]mwa[.]net
                class="c09_td_value is-hidden-mml">www[.]mwa[.]net

        173cd315008897e56fa812f2b2843f83       class="c09_td_value is-hidden-mml">173cd315008897e56fa812f2b2843f83
            2006-09-14 02:28:46           class="c09_td_value is-hidden-mml">2006-09-14
      02:28:46		           class="is-visible-mml">
        www[.]deebeedesigns[.]ca       class="c09_td_value is-hidden-mml">www[.]deebeedesigns[.]ca

        513644c57688b70860d0b9aa1b6cd0d7       class="c09_td_value is-hidden-mml">513644c57688b70860d0b9aa1b6cd0d7
            2010-12-17 03:24:13           class="c09_td_value is-hidden-mml">2010-12-17
      03:24:13		           class="is-visible-mml"> 69.90.65.240       class="c09_td_value is-hidden-mml">69.90.65.240

        fdf6bf1973af8ab130fbcaa0914b4b06       class="c09_td_value is-hidden-mml">fdf6bf1973af8ab130fbcaa0914b4b06
            2012-05-10 08:41:35           class="c09_td_value is-hidden-mml">2012-05-10
      08:41:35		           class="is-visible-mml">
        www[.]woodagency[.]com       class="c09_td_value is-hidden-mml">www[.]woodagency[.]com

        682bfed6332e210b4f3a91e5e8a1410b       class="c09_td_value is-hidden-mml">682bfed6332e210b4f3a91e5e8a1410b
            2012-05-15 03:17:04           class="c09_td_value is-hidden-mml">2012-05-15
      03:17:04		           class="is-visible-mml">
        www[.]oewarehouse[.]com       class="c09_td_value is-hidden-mml">www[.]oewarehouse[.]com

        fb7a74a88eead4d39a58cc7b6eede4ce       class="c09_td_value is-hidden-mml">fb7a74a88eead4d39a58cc7b6eede4ce
            2013-08-01 18:23:07           class="c09_td_value is-hidden-mml">2013-08-01
      18:23:07		           class="is-visible-mml"> www[.]mwa[.]net
                class="c09_td_value is-hidden-mml">www[.]mwa[.]net

 


  Executable (PE) resource with PDF icon Table


 
   
     
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        719453b4da6d3814604c84a28d4d1f4c       class="c09_td_value is-hidden-mml">719453b4da6d3814604c84a28d4d1f4c
            2011-06-16 12:54:20           class="c09_td_value is-hidden-mml">2011-06-16
      12:54:20		           class="is-visible-mml">
        www[.]drgeorges[.]com       class="c09_td_value is-hidden-mml">www[.]drgeorges[.]com

        854cb8ba3b2d3058239a7ba6a427944a       class="c09_td_value is-hidden-mml">854cb8ba3b2d3058239a7ba6a427944a
            2011-08-17 00:31:27           class="c09_td_value is-hidden-mml">2011-08-17
      00:31:27		           class="is-visible-mml">
        meeting[.]toh[.]info       class="c09_td_value is-hidden-mml">meeting[.]toh[.]info

        a049b8ec51c0255dec734c7ba5641af3       class="c09_td_value is-hidden-mml">a049b8ec51c0255dec734c7ba5641af3
            2011-08-17 00:31:27           class="c09_td_value is-hidden-mml">2011-08-17
      00:31:27		           class="is-visible-mml">
        meeting[.]toh[.]info       class="c09_td_value is-hidden-mml">meeting[.]toh[.]info

        0725a1819a58e988b939f06e53990254       class="c09_td_value is-hidden-mml">0725a1819a58e988b939f06e53990254
            2011-08-17 00:31:27           class="c09_td_value is-hidden-mml">2011-08-17
      00:31:27		           class="is-visible-mml"> google.ninth.biz
                class="c09_td_value is-hidden-mml">google.ninth.biz

        0fdffd4f5730bdd37f2f082bf396064a       class="c09_td_value is-hidden-mml">0fdffd4f5730bdd37f2f082bf396064a
            2011-08-11 09:35:24           class="c09_td_value is-hidden-mml">2011-08-11
      09:35:24		           class="is-visible-mml">
        homepage[.]longmusic[.]com       class="c09_td_value is-hidden-mml">homepage[.]longmusic[.]com

        e476e4a24f8b4ff4c8a0b260aa35fc9f       class="c09_td_value is-hidden-mml">e476e4a24f8b4ff4c8a0b260aa35fc9f
            2012-06-09 13:19:49           class="c09_td_value is-hidden-mml">2012-06-09
      13:19:49		           class="is-visible-mml">
        www[.]heliospartners[.]com       class="c09_td_value is-hidden-mml">www[.]heliospartners[.]com

        d613d40d5402f58d8952da2c24d1a769       class="c09_td_value is-hidden-mml">d613d40d5402f58d8952da2c24d1a769
            2012-09-27 12:46:20           class="c09_td_value is-hidden-mml">2012-09-27
      12:46:20		           class="is-visible-mml">
        www[.]billyjoebobshow[.]com       class="c09_td_value is-hidden-mml">www[.]billyjoebobshow[.]com

        f822a9e08b51c19a154dfb63ee9b8367       class="c09_td_value is-hidden-mml">f822a9e08b51c19a154dfb63ee9b8367
            2013-01-10 07:50:58           class="c09_td_value is-hidden-mml">2013-01-10
      07:50:58		           class="is-visible-mml">
        technology[.]acmetoy[.]com       class="c09_td_value is-hidden-mml">technology[.]acmetoy[.]com

 

Both 61249bf64fa270931570b8a5eba06afa and
  0f3031412d255336a102bbc1dcd43812 droppers also had a portable
  executable (PE) resource with the SHA256 of
  fb080cef60846528c409f60400f334100a16a5bd77b953c864b23a945fcf26fd. This
  PE resource contained the PDF icon used by the dropper to make the
  executable appear as though it was a PDF document rather than an
  executable. Previous APT1 samples also used this sample PE resource
  including (but not limited to):


 
   
     
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        1aab2040ed4f918e1823e2caf645a81d       class="c09_td_value is-hidden-mml">1aab2040ed4f918e1823e2caf645a81d
            2009-09-28 22:08:38           class="c09_td_value is-hidden-mml">2009-09-28
      22:08:38		           class="is-visible-mml">
        www[.]olmusic100[.]com       class="c09_td_value is-hidden-mml">www[.]olmusic100[.]com

        8ee2cf05746bb0a009981fdb90f1343e       class="c09_td_value is-hidden-mml">8ee2cf05746bb0a009981fdb90f1343e
            2010-03-15 11:46:31           class="c09_td_value is-hidden-mml">2010-03-15
      11:46:31		           class="is-visible-mml"> gogotrade[.]apple.org[.]ru

        tradeproject[.]rlogin[.]org           class="c09_td_value is-hidden-mml">gogotrade[.]apple.org[.]ru

      tradeproject[.]rlogin[.]org

        9c4617793984c4b08d75b00f1562cbda       class="c09_td_value is-hidden-mml">9c4617793984c4b08d75b00f1562cbda
            2010-08-31 03:27:55           class="c09_td_value is-hidden-mml">2010-08-31
      03:27:55		           class="is-visible-mml"> freetrade[.]allowed[.]org

        worldwide[.]chickenkiller[.]com           class="c09_td_value is-hidden-mml">freetrade[.]allowed[.]org

      worldwide[.]chickenkiller[.]com

        b584b48d401e98f404584c330489895c       class="c09_td_value is-hidden-mml">b584b48d401e98f404584c330489895c
            2010-08-31 07:52:17           class="c09_td_value is-hidden-mml">2010-08-31
      07:52:17		           class="is-visible-mml">
            worldwide[.]chickenkiller[.]com

        freetrade[.]allowed[.]org           class="c09_td_value is-hidden-mml">worldwide[.]chickenkiller[.]com

      freetrade[.]allowed[.]org

        b92a53fc409d175c768581978f1d3331       class="c09_td_value is-hidden-mml">b92a53fc409d175c768581978f1d3331
            2010-09-16 09:57:09           class="c09_td_value is-hidden-mml">2010-09-16
      09:57:09		           class="is-visible-mml">
        www[.]rbaparts[.]com       class="c09_td_value is-hidden-mml">www[.]rbaparts[.]com

        d6c19be4e9e1ae347ee269d15cb96a51       class="c09_td_value is-hidden-mml">d6c19be4e9e1ae347ee269d15cb96a51
            2010-10-25 01:59:00           class="c09_td_value is-hidden-mml">2010-10-25
      01:59:00		           class="is-visible-mml">
        www[.]kayauto[.]net       class="c09_td_value is-hidden-mml">www[.]kayauto[.]net

        d0a7cd5cd7da9024fb8bd594d37d7594       class="c09_td_value is-hidden-mml">d0a7cd5cd7da9024fb8bd594d37d7594
            2011-04-20 07:39:01           class="c09_td_value is-hidden-mml">2011-04-20
      07:39:01		           class="is-visible-mml">
        www[.]kayauto[.]net       class="c09_td_value is-hidden-mml">www[.]kayauto[.]net

        b19ef1134f54b4021f99cc45ae1bc270       class="c09_td_value is-hidden-mml">b19ef1134f54b4021f99cc45ae1bc270
            2011-06-13 06:56:04           class="c09_td_value is-hidden-mml">2011-06-13
      06:56:04		           class="is-visible-mml">
        www[.]kayauto[.]net       class="c09_td_value is-hidden-mml">www[.]kayauto[.]net

        b0a95c47d170baad8a5594e0f755e0c1       class="c09_td_value is-hidden-mml">b0a95c47d170baad8a5594e0f755e0c1
            2012-03-26 06:50:10           class="c09_td_value is-hidden-mml">2012-03-26
      06:50:10		           class="is-visible-mml">
        www[.]coachmotor[.]com       class="c09_td_value is-hidden-mml">www[.]coachmotor[.]com

        894ef915af830f38499d498342fdd8db       class="c09_td_value is-hidden-mml">894ef915af830f38499d498342fdd8db
            2012-03-26 07:13:36           class="c09_td_value is-hidden-mml">2012-03-26
      07:13:36		           class="is-visible-mml">
        www[.]rightnowautoparts[.]com       class="c09_td_value is-hidden-mml">www[.]rightnowautoparts[.]com

        c2aadd6a69a775602d984af64eaeda96       class="c09_td_value is-hidden-mml">c2aadd6a69a775602d984af64eaeda96
            2012-05-15 09:02:25           class="c09_td_value is-hidden-mml">2012-05-15
      09:02:25		           class="is-visible-mml">
        www[.]bluecoate[.]com       class="c09_td_value is-hidden-mml">www[.]bluecoate[.]com

 


  Links to other Activity


 

This same PE resource was also used in a number of other samples
  deployed by the “Menupass” group, which we have detailed in our     href="/content/fireeye-www/en_US/blog/threat-research/2013/08/pivy-assessing-damage-and-extracting-intel.html">Poison
    Ivy report. Previous Menupass samples with this same PE resource
  include (but are not limited to):


 
   
     
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
   
     
       
MD5         class="c09_td">Compile Time       class="c09_td">CnC

        392f15c431c00f049bb1282847d8967f       class="c09_td_value is-hidden-mml">392f15c431c00f049bb1282847d8967f
            2012-05-16 06:48:02           class="c09_td_value is-hidden-mml">2012-05-16
      06:48:02		           class="is-visible-mml"> army.xxuz.com
                class="c09_td_value is-hidden-mml">army.xxuz.com

        21567cce2c26e7543b977a205845ba77       class="c09_td_value is-hidden-mml">21567cce2c26e7543b977a205845ba77		 2012 06
            26 05:17:52           class="c09_td_value is-hidden-mml">2012 06 26
      05:17:52		           class="is-visible-mml"> nasa.xxuz.com
                class="c09_td_value is-hidden-mml">nasa.xxuz.com

        d4b7f99669a3efc94006e5fe9d84eb65       class="c09_td_value is-hidden-mml">d4b7f99669a3efc94006e5fe9d84eb65
            2012-07-03 09:33:46           class="c09_td_value is-hidden-mml">2012-07-03
      09:33:46		           class="is-visible-mml">
        tw.2012yearleft.com       class="c09_td_value is-hidden-mml">tw.2012yearleft.com

        df5bd411f080b55c578aeb9001a4287d       class="c09_td_value is-hidden-mml">df5bd411f080b55c578aeb9001a4287d
            2012-07-04 04:07:36           class="c09_td_value is-hidden-mml">2012-07-04
      04:07:36		           class="is-visible-mml">
        apple.cmdnetview.com       class="c09_td_value is-hidden-mml">apple.cmdnetview.com

        001b8f696b6576798517168cd0a0fb44       class="c09_td_value is-hidden-mml">001b8f696b6576798517168cd0a0fb44		 2012 11
            13 07:19:03           class="c09_td_value is-hidden-mml">2012 11 13
      07:19:03		           class="is-visible-mml">
        google.macforlinux.net       class="c09_td_value is-hidden-mml">google.macforlinux.net

        6a3b8d24c125f3a3c7cff526e63297f3       class="c09_td_value is-hidden-mml">6a3b8d24c125f3a3c7cff526e63297f3
            2013-02-25 05:31:41           class="c09_td_value is-hidden-mml">2013-02-25
      05:31:41		           class="is-visible-mml"> cvnx.zyns.com
                class="c09_td_value is-hidden-mml">cvnx.zyns.com

        a02610e760fa15c064931cfafb90a9e8       class="c09_td_value is-hidden-mml">a02610e760fa15c064931cfafb90a9e8
            2013-08-01 18:23:04           class="c09_td_value is-hidden-mml">2013-08-01
      18:23:04		           class="is-visible-mml"> cvnx.zyns.com
                class="c09_td_value is-hidden-mml">cvnx.zyns.com

        78a4fee0e7b471f733f00c6e7bca3d90       class="c09_td_value is-hidden-mml">78a4fee0e7b471f733f00c6e7bca3d90
            2013-08-01 18:23:05           class="c09_td_value is-hidden-mml">2013-08-01
      18:23:05		           class="is-visible-mml"> fbi.sexxxy.biz
                class="c09_td_value is-hidden-mml">fbi.sexxxy.biz

        6f3d15cf788e28ca504a6370c4ff6a1e       class="c09_td_value is-hidden-mml">6f3d15cf788e28ca504a6370c4ff6a1e
            2013-09-10 06:40:28           class="c09_td_value is-hidden-mml">2013-09-10
      06:40:28		           class="is-visible-mml"> scrlk.exprenum.com
                class="c09_td_value is-hidden-mml">scrlk.exprenum.com

 


  Shared Tools


 

This shared PE resource between what is believed to be two distinct
  groups (likely APT1, and Menupass) can be explained by either of the following:


 
 

It is unlikely that APT1 and Menupass represent the same group. We
  have observed no other overlaps in infrastructure or tools between
  these two groups. A more likely possibility is that the shared
  resource between APT1 and the Menupass group is a binder tool.


 

A binder tool enables a malicious actor to add an innocuous-looking
  icon, such as a PDF document icon, to a malicious dropper. This
  technique facilitates social engineering, presenting the end user with
  a file that looks like a PDF document rather than an executable.
  Figure 1 shows a builder that enables actors to bind a JPG image icon
  to a malicious executable.


 


        width="240" height="158"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/03/apt_icon_bind.png"
      alt="apt_icon_bind" class="alignnone size-full wp-image-4866 landscape-sm" />


 


 
    Figure 1: Binder tool for
      disguising executable files as JPGs


 


  Attribution


 

Based on the evidence provided, the following are possibilities:


 
 

Although we are not certain that APT1 is responsible for the Siesta
  activity, this current campaign shares a number of distinct
  characteristics with previous activity attributed to APT1.


 


  So What?


 

Regardless of which group is responsible for this campaign, our
  analysis highlights the importance of monitoring for known indicators.
  As shown above, monitoring for previously disclosed indicators of
  compromise (IOCs), even IOCs that are years old, can yield value.


 

Additionally, monitoring for IOCs and attributes of malware that are
  shared by multiple groups may also improve the effectiveness of your
  network defense operations. In this example, implementing detection
  for executables with a PE resource with a SHA256 hash of
  fb080cef60846528c409f60400f334100a16a5bd77b953c864b23a945fcf26fd would
  detect both Menupass and APT1 samples.


Source: A Detailed Examination of the Siesta Campaign (http://)