Skip to content

Latest commit

 

History

History
548 lines (537 loc) · 33.5 KB

OpBlueRaven.md

File metadata and controls

548 lines (537 loc) · 33.5 KB

OpBlueRaven Indicators of Compromise (IOC)

Part 1

These IOCs were released as part of our threat intelligence research on the Fin7/Carbanak cybercrime group. The full report is available here: https://threatintel.blog/OPBlueRaven-Part1/

File Hashes

SHA256
fdc0ec0cc895f5b0440d942c0ab60eedeb6e6dca64a93cecb6f1685c0a7b99ae
e7d89d1f23c2c31e2cd188042436ce6d83dac571a5f30e76cbbcdfaf51e30ad9
429adaf706bd0829e1a8de7bf0ea544a41b01a383dab3db26a14cc4a287b6881
db486e0cb94cf2bbe38173b7ce0eb02731ad9a435a04899a03d57b06cecddc4d
3bf8610241a808e85e6ebaac2bb92ba4ae92c3ec1a6e56e21937efec71ea5425
39b545c7cd26258a9e45923053a5a64c9461470c3d7bfce3be1c776b287e8a95
40ce820df679b59476f5d277350dca43e3b3f8cac7ec47ad638371aaa646c315
ecf3679f659c5a1393b4a8b7d7cca615c33c21ab525952f8417c2a828697116a
0d3f1696aae8472145400d6858b1c44ba7532362be5850dae2edbd4a40f36aa5
d470da028679ca8038b062f9f629d89a994c79d1afc4862104611bb36326d0c8
0054a0229740f14f9b9425c1a40b3bf31075a70237d18a054b481ff605b7c94a
00bce4a794d4e36ffbffb89f0c985daa85b47ebae686fc82e79f0f5f7c1c55b3
0244ca1c91f9a71e5b2927333edbd7713e988f226a01e0b6cb68ae5fdd336fa9
024787688d9cf2f3f868f7bc5115949724b6870ecf1d0e6e018a83fac534f9e6
025881262408232e50e6ebd0bec079fc9190d8b66fdca619f071e6017b33dc33
03402fa2054644b95d250213c83874b4696315c160b3bc9109a51ad8d8d70e5e
050df8a00623c84f1653dae10dd78bbbd59df2de95cdd3a56f4b2ca10f32a95c
05f572ee9e0b4cbdfdccfd16ad74043d8df3dec0aefeb1e8d9dfca12e8e5e463
068bdad2bb535fc18e1fd466e8670385ffea526b3cadde5f7bc9c4c2d9d47e91
08882b5291c69796c7d8af47e1a0baf3772bcd6b5c0cd5724cc6f17c887b4ced
0899f0a3696e717dc46958c1079f263c9ba413051235e6bb1beb8b77f2dc6278
09c62bdb7826eb20401d64ebc6c391e9633cb32ecd2be88bb47d5d5efb78b1ee
0c9529991b74cc536d8e6efe196baaa10486de88c4fd6715c1e839caf508b5f8
0d4985db6ba5a4e0da96ac51cb7c84a2059b7534357d68b978f78d01b82d082d
0e328c44f84840fd5f8294d84aca3867b6f206fe7642ee17d087fd7036e35cae
0e3f9ec7c1cc5e7034a19500c851c720d0be213cfb29e788856b0e4743f68116
0f083aac77fb734a8e81fb9dff218f0414ac6c4c9a23b2832837fbc2c7e2031d
0f329a2b75d850dd952b84f64c16ee1109c6724a9a3bb5f5ee55c0ca6d7d4069
0f5c87a075b2807aa14f71c042278378e3cda49e0945bd9d2f643c38bc805cad
0f622acdd066ebba14487cc31ac2cd3eea44f97530b0e406e637ea05ff3b175b
0f93f8a91f68b66a5610501f568bc08fe1c71edc3fc1d6e02ec0fb587d3ad163
1044de4d6b180e02425e0213f6735f9726fc26c2da28ca90251d78f118dc1742
10c3eae3f61088b11d54f0d658be3bbaa3bb266e1dd021986fcc93feb00cd246
113a0233bde9933a49580eb8a4899df110b92a614bb01d6791a7cc9719482260
119eeeaad3adadc371257bf974060059ee6e82646180841e3e3385c99b2b6f46
11b78a2ec73395e8be95ab6152e0f6d24cf16d44021f6177cd9e6c819046dfea
1250e7bb1f6293dbf3ea3d6d83fdb52edfb5dc1ab006806c0ebcaaaca120f538
12798a2e9abead453c3b38d4b35f3ae563b06863307760d94b75b80d640c0b29
1354201421799881f53610ac76d9f1d4084402d5dede3bb5c6bf838bb8aa8295
13ab4d332d3c7d47c752a8a837773b34197777924744c4a1c87ac2a3d7ec7e7e
14594347ba25148ed456d4f7f3025f08f9d109b71b65a7ed9cc3eacaafdd9057
147aefbd27ff72eb0e77a4aa49cf5ab975046b400a682221363601ca82150f4d
15415f9ea39b5831f189e620850180a9dd1533b26e471bd074d58f9dd187813d
15c400234dc00e48d0cb628f8a13ccfcf87d030fc8d796526526d6ed2a251fce
1672bfef3a4efd12a83644988246a3aaa8c6b8e02d5e271ec975c30acb386d56
16d7d7d323fbe9c7c327e6681a76639936a7547d68cf80cd8c9ba8eccbd077d4
17b76c8f3a13e5a1c55873470c2e22e319b43dddca2cb6fb6056216154d6ccd3
18be5b03b8d4c7f21762029e5d82e7cbc924a7512b7357227e51ee0d0cdbba30
18fc5d8c809d2cdfc6527553874695ae91c8f0a4f107fb3316b37956acbd26ed
19365048cfeddcea2688161a988e27b4925ab611c32707fe5721c14125a8b92b
19803af78925cdd30079a3f60955aafc6c9150b86198247a0ce3e838f2898544
1a717fa2ecbb83b13a4dd1c779aa6acb2a0ddd15c083971788eaf3eeb4e5ddfc
1ad11ed7906ff3d76b3b31dd25f9169b2a58f1a8ef0c1606180379113aac5e36
1c5598e3c9f5e4657f871a674ea24159990d6686fe615646a0eb1feed701597a
1caa8424e7d9e8f6af0ae704894dd7e47bd03fab0314cf23264c4f23f00c89dd
1cb246b76add81b74ff746e5a9cda1a370ed21b187a59f97afde65534f6eb3f9
1d8bcae02db0a1629bc214221866fa9a78ed250dc4fe7f4ad54087a2da0ba1ea
1d9b6d69de1bc5bd146c0a3c8096ba0c465c3a9fb5de6348c847c127bac0bca4
1ff83b202645157f782ddc286b48b56040122461b6383bafb94a7b4607c58c80
202b65602ce8de4bebbdf5a0d62e636fa7ffa55295b877a9ea2a3d720687db64
207265a56acb83509593e9887c93392cd0c92eba5b81abffa1c0a7a18c7b2537
20781fd463d711dd770bf42317f9f1add12f8c18c1837081974e47c9c71e873d
21b06f6218981b2aa4125e72b6c24caea81ea9cb338d4d27cfb21de110f13d21
21fef058e0ee94b35d5ba6df522e4f2c598c3abbb4670e1d5fb894b638f3fefa
22ab0c3ca7657895822547ee2f54008a05826353d5922f5f5dcfb24aa0c0e3d2
246742073b5709b71403874bc9793285f164f08a3a9804e19deace75899b642a
24a54a13af7b5f2d4c2919a5c82bc3e6435e336658e1ca8faa45b000c7c1b936
24b31ce7cf44cb9acc92280d24545fdbbf42b3d6c76ea62d244ca22084943879
24f95d3344214d2b294a8109152db8fb3ac9c2f791ee4176d2583588f18bc7a6
256a8b8349d2ba5b88e03f9f45e756e9985bcb66a84ee085e981e532cfffd949
26fee19777b6ade97ba4188631e938662004d46d414753908d7b04b36ab3b5e5
2798ac3fb0579b79c23de52ef5a31511537136886fae102fb22ed8b8da89481c
27a68a1b23f1f81b5161ef4a545c0e79a27e89909db3fb4aa041e739d737a9da
27ccaf8c1df69b6d697ce45a9fece088174000fec8e6de5744df641a4f1942a8
27fcc51784188ac1d95cb8a381726aec7f3b9bd3535227bd7bffad98bb6f32e2
29d59490522bb7e8cdf7bd1f8f54be546d406e5ccafbddc8c69d12db358c2c44
2aa125ddbe80c116a4b69525ef59a500ce74ed2ebeaa9e3964bed4ad3077d09d
2af0cfa4bb381ad39654fe01d07097c6df7c38445f08691b2e69619fb14fd3ea
2b0c11491e81aead7b851926ca81ff953858fe23572cfe2337cece62734d2cfc
2b17facb60abdfb2cbd2a8792223dbee104a1bf9178cdca9cc59f0330344f612
2b6b10cb6273e51df7933f3dc3d63acf1187737ff61a6619250051ab9a6ba6b3
2c90e73be1282692375533797f1df617bde67f2ec9ec2a6c8adcc56ccdef3d10
2d58b6d0713d066e7e992e522b66677760b64b60cfc3b34a52bd700e742351e1
2e60c421a1ba850c823143a5fc083764f9c5f52f5387d97df99f28b04bcdac67
2eb862bb69b0d6bd217fe07deb17229a61328c4598a5e33dccb4e64dbc7093c7
2fced321520002318248b4f5db71a42ff031e865675cb3b116517bc645f4258a
30b4ff64f7b7c2654d49e0f8c676c90481dcc5756368435993f21f57a2bed975
30b9e0efbf48fabfd1932508f336b8443a444701a2eba1ad4a4110fb207c10b8
313aec1711acd5b12ddb832555fb007675d6d6a5b3986abf0cf5cdb127839a50
31e00424ede2b38899768686d44cc0ab4ff5808cb9996ce32d5d281a701a62bb
3343b1a0bea48de21e3360b4d6af4fb46e4ddd4e1fda52061094a9253044e116
334608ba592c06df1886000b26fbee3a49a77a93228288f9833634d117d3ad24
347b8a2e973a94db80620ddccd85bf9bff58782c2c0e88e8b77a0679e0384232
34a0d78ba235d2af4c2b4a59034320f39cf47606fbb8e9b6d1c90a15e82d9e18
351c749e573655ed9e40ac373b532d508ff2eedc7c832ef0a052cef1286df075
35baf2890b78ce8c250bfabe44f0ecb336df0053dbd408ecec7bff1996045e18
3692f0aa117fd3184cf25be8f8519c2f369f35e4f455d1d38b2cd6c9044bf501
377f4676bdf3c5fccae0065f828e3d774354c8f2ad3ca6401de9a89a1a22889e
378b7a23e5cf262a1f8244c2358094c9d329383c1538ac089f7bd59654de2048
37cb9f0548735a00233a6a8c9910fd330712ccd57475c3110eb73ec998a3a091
3905c3e429b5b576ac16933232a947af12334d41873a3cb16830c35b1385c0c1
3907619eb7bed88c607ee9d5636376fbe7eccfb008e3f44d7471a49ec8b36553
393c60ec0c21efa34ac9e39da51df9476466d321dbba73fa268712f80e304f23
3a25efd518eca9da2e31e45d9f8b59c35537b72bf3f3fb384c1c8f5bdeea0708
3a5ffe222cb620a3c94e4dc9f10810366374866d79c3b44d94d3ae9f4da7497c
3c36444de4c6df85ec9158b7136df7f458ba9239acfacb60b8b0d273133824af
3c87406df35f5fd264634d60deda9f1a32b66f22b5a56a2245129883d91c32f4
3cef9148453492e898f8748f0ef9c64ae4b7f6ecd7552947f2f1861ef62ac546
3ec1602b1ef9d4ac7b35171ccf7b465bb2645b66efac159125c3850660bf83e4
3fb04f5606bb8d556a86c5a4fe87dee200bb7a731ce226c537d318b2c493041a
3fc4a0fd7438b980357278a964417f10527fec4886643eb17d04d66aafb9753c
400a7f53fdf558ca285c144560279f3c07b5d7cae646e88c64cbe0d54ea38ea9
406e436984cd87d2279ffc3dd3e3ae236849c1757ec855549bf97deb97ea1c59
40b0ef69d89e93a11c3432899282ebc5cf703f2dd4bde69cb43ace1a2e44f4c4
40b31680d6c39a451d73b833ce5c8b06d88698b2f50093788b59717d471a175e
40e29b626e7656b7fc0719de41582964079170e201147c19e20afae17bdcecdc
41a066027ac5732981e938371c31efe22b87da485f7bd4648142db782367cf6f
435411bd94e1df52558f9d50d4444d1998aca6b49c65126bba74b717a182b923
440c9c47e970637cc74d30f5bd24d97343d3dd7c10e4b8119fa787c07d53ddef
444e8919a4c9bb545fcf87a412a1f1b35aa5a3b863ff378ed32bbb095b66e8d1
4456e63515001edb92dc4db8c62daf28fd9e2c783a97bd368c2f35147c0c98dd
453b507b3da272149f284a58dd51dfb29182a14427cba5413802d8a79aca3691
457e4f0131e9a463c497a9c1437cb57e37c7a81990ad10effad167a6c6570518
45d2c9af3f593031d5d95177a39c2ae1b277d36cac922c4bda6d16ad1ad5562e
460790a048e137abb42138d3a107849dbcfe084d3dbd758a85b7d91a3f43e2b1
462ba8eaf373bbf18d0253aebed50b68c61695edcf1b15bf32346039756bae80
467386a30d4382552cccb7ffb82fed645e202520b432c407188bea3d02c750a6
473dc233ab490092fae41055527316b9b239b15e612317f755adba21d8a9e8ec
479bce9f24cf62ffc8c4e901ddf00ecbd2e5c41735988e2db76e63611a8364b0
491d4c0a6f9d00196d1cbd8dd0426274ac964a33a146273d3be3c4465c02908e
49d39aa19239973c3341b7ce566edcd1dfbe327a0d0cec62b4b5f59c8bfb59b3
4b0484265a5d7b7864bff1de53b48d880fe6688677240de7202236d3c5a22e87
4b11137ba8cd9a413af4b0ea148944966cbc0c69cb62df201f4edd2dd8b32d10
4b2c34cdd97265de505dccbc772011745624c4bc54ffd05dc66b0c9ef64df800
4b5a14eb9f847324a300e80ab3380f1713e0dd79ed051b9a4988ff1f7864788c
4be965090778b6ffd25700b3c2978a8380d91ceb888280e49542ba32ce1a24b1
4c5fb53e0787ebc0bbc99d8dc079e99cfcb111ddfb040abcf8b4cb56898db7e7
4c64fcaaec9547a72016f57f05948d3f5e5f0e28e0c9e11cf813d647f0e19d4f
4d4302a58e918ab13319bd6df75ff83ff91b698f8955a62bdb2ed421dd867327
4dd732120f265e0c430d437a3a5eac426baee3a272e18683bf45ff17ad680cbc
4eab4e8517f57624a0cf50bb064c26930ed0bfbe0b1ed9cab55dbe8721aeb6ad
4eb4b601b0da4ad1e83a7df5d35fb852c2a57cb12bf4c618456bb70684dc3683
4eef954d91a2dea4242ec8c6d898250ae46d252a06f93a3b49b86d86e0d71674
4f23c4ab8dd949e186825af99912419c7ba20f68efbc881f63ea4a227fccabf2
5010d230e315e3333cdc639d8fa4caed602c6073cda7a52702c148091592c3b8
50cfe82ea58c6c2ea1ee9d2e4599406826ce4d90b8cf8018e9e4120fbaa69999
50df2192220c6d9752b5cc68b44012d414441a282af72689fdcb83a779988d8d
511bdd5879616127e5e98ca4661ccf63998035be7c08159000d672564654fd66
512a42c56b5a07c627d577c766db83c64c8db5732b52f0d742305f10f7b9eea9
519e63285fc68c5ca51fc82b7a4100b47450aadce38a5f1dbdab3ac11f07827c
51ac92206031f4e228333d6065e26737d707487f32e8b8b5d165220f6f4a64ce
529b564769560ae0658b894c8def738b05d6c46c8ffe74ec092c47e87aa0478c
52e993c8c84c496964f7b474a0e86ce0a4ffff8ab429b872f0dfde5e5d2ff849
52f2b660ee5767c84b96dd8e11892c5476bfec9111b1f985550ca40afb0a6d50
53052fb10c499104239082e9cd4acd9d5488164b4efb1214e84ea32fe4dfcb50
536470340ce15739b40be1944a6b020fbd0c4d02fec75a799e3056e74470a69b
54e64a211b499d1a1b8dac65867abd9f54fbedd014364299e7c442a4b25bc97a
5579e036f5769d82eca99823844bbc60ad8cf5b0e6c6a03c596c11cccc8faf34
5706c62f57186739cde0b2d30cdef60dc366dfd24d7b36be26e2437d932c5b17
575e9d1dda2e1dfec81c5a1c3b182d114f2ebac9aa91e304d5ae6dc26319f8ea
57ae9b4859e6d79b86ae19d0a184bb91fed6b536e0ed94e5389bd81c4f14ea8b
58131ec474018c26b8c90ea8903c3b117c9f4a79bea3e1f3f442383d069b0291
5869719fbbaf5b78c8b6ddc26624d0d1af082c8fac0593531e8fcd52f04331a3
5a4819c75ddcf63ddb87bdf51c7ea6124600adcebf8eaed5b8a60d91c595d77c
5b2a26f64ff0eaf611adf7818266c38e5d29f45693ff6a64dca727c87e1bbefa
5b90d64969bc653a9f16e4af35425e639a1a4293083dcef0659102924abe116d
5bd60312a55982e5476be1aa328b1d5182784f3dddb76507ef246940ff1ec234
5cc7e55514418118f68d067a15d9496cfe867817bf0b5dfd4a061fa5851e2cca
5ccf66192ea9d2b6395fbb4a058d0af8409040d6d38b82b7fa1bf120371e9538
5ce10299e8da54195412431333d28527d69a50ce0610d81e5c7ea985c5b3e286
5d17ae29d48a4d885fc3ab6e85a552c2e689183b4f33ec9249e6b3b2ea496ca3
5d2606d99ff01e7ec0918abc54b4547d15710804d9d096ed5c814a4bf19fc55a
5e0140d7337b78f3681883cd22dcb6bfdccba5514f5a9a9d00fa9fb78a154cc4
5e5461699a62ea26a9eef814145b404e36a51dc5b2d378615f182a7e6a33f003
5e789c36ca91b053414ceae81493079427f6acf1675e953b5a5f2c01a560b252
5f98f19cc7f2fc98bb2da3e37a001ce13441fd766f5a2660ac732f4f59a2ae99
605c668359f47e5c6c31abf00913902b916e20ab531d72c244cdda2705362b8d
6080b5e008db8efe14df0385c7f82322b3f439052456541ab3a26b00574f3e53
6090150a462137ea2bfd898c40b2b486c1131f9948bd753273782a0f9c8346e4
613d95b734a457c126aefb7279e80a787827752771ccfab671edb00a2709b4b8
62b4cf54427087befe44a4081a044e9ab30f111256922730ae5b31fe5635995c
631ad2aa7eb0c084c7fada0ce774532934e7091c8bb29a4bc1ba417a6d51121c
631eede285051fa475c6d1f47a3ae359578820c38ec6ac50e63fb43fbf7ace65
637088917ade8b341de5bf12647af49c1c97228ef05fb0cce4cfa42d09119d1e
638f1a33c211ec8902b65191e1a5094a2c85248deba67e165c93f36138c1202a
63d4e9f7f3b6f4358b616c5b4b81fb97e92239a116eff169c2975e392f31c508
646742e088a692eaa876dc5a0012d67c93bbb0041382a05da2f3726ba6a18640
650c5e498a8a4353b249c013ac6b796c5283ae92f9f18eaba716c8274df94ec8
652ecd4ffb0214b353ce9d1dd3ffc241cc232b49d982c99be2faef1275beccf7
65fccab509ea9727f7cd009ca977fbbb6e19371f45c63eae927cf04e99cfca53
66168b2214552bd108c526f30c9a117ad5e91f764e81af9ffe640e5c8697169d
66d6e79e84b0e403f80619176ce3f25f3468e826fda79b485adc8bdc09ca7e46
67e210540a9803d990b08d9367891dbb121bcea82b7d11748594daf8f60fac78
6816856ba860f777af24dde0bde7ba7e3eec404ba27f9569b687fb4d7246a4f0
687aee5b9dbca6b29bf4627e806a6e7c7f4eae238651b3bbcc2fc78347e63111
691ab88ba5e20accfb5341711754b5718034d301eaa5dc1844beb11539c57321
697e4b1518031a3c679514888d80492126f5ca1ff9c99db2bf239847aa74301d
6b39806052e0fe6281fdbc834797fe15693f76f3c2f7dcdc0d833654361afd39
6c3402b0f6a98f7eac34de8b17196d12083a5664c1fbdda009a9e95fd111ed66
6e2e5a5a531ec1be09805a9719730934ea9a5f3f79c8dcbf988e0cb6c2e5d243
6e6aeb7fe377f3ab27f0bb640063212a6f60d55415eb0e105e92cac62e28ea8b
6ec14b500f26be023726f1d02b71876e9ae4354043705713c2cb8137daf433fc
6ff6118ab47d5ea7dadd42347a56c570347470da103415db69ce57b993f1939e
704181ce63a9d614bb7278cd5a608149b7bd10f8c29dece262ab986516daf9dc
7084693dc234e3135f5254f3dc86ee8a689455aa953632c61a9f820d72554740
72330db6e1fdd69316e30342f67a2dc6df443b9d9e19fef72dd4f05b6aa24939
74b1e90de2b538b173f4c933e66f697d6ff92b5a1f5b4e621972d3d8a929abb3
75f7e5b674c0540cecd4055f3b68911055512acb451398c1eeb422fbd1ae8793
76edd43b63a834a8bd3992f2529e41696fe69cef169898bc8fc70144ef50c14a
774b4861996a0d8f45353d7e99043da8b6f2e7447d02701958f15654a3d0622b
774e1e0d26cc823b86c23cfe67151b32944ebecad0647fa899be902e17a1d923
78a744a64d3afec117a9f5f11a9926d45d0064c5a46e3c0df5204476a1650099
7962a224a76d93c2105ad19b4a5c062ed70f419915b27f14acc7c0bdc5a56eb6
796757e7d0dc99f9544c7664628a3458778afe7e5db1a7d703933216d28ff637
798144bf051cb0fb3d5926a29f9e6ce93375e1bb1b259853392f72f5a1beb93b
79bcdc6a013d38c67272428b6a2a82d12937ff55894917a167662cb992007115
79ca14825c7cd1156bab6ae0e11074d34f5747737970f2917a1fe5e578c9a687
7aa7f1cd6ba6eccee13244d93effa7281762a173071fbd360082993d9a9ea833
7b7e5edb15df68b6616cd0ea497e5f3137d8f0c5b0cd72c8becaebf085b6f0f8
7cb610b584b0df9aed32031a367dce0b806f6e9c89aa9e0a56b46ef67b33905e
7d4774b1731200d9ae879eede8da712b4088d591d2fea6681f0adc255c1f8bfd
7e3a6309ef9f3268945b5c1c738a2a24d94b421332632387ca37f0a668e97340
7efa90c80c564d6041cfa896708549a7a5c0311056f90e512c22b11fda7292fd
8327a3633ff79e1eb890d5b9b0c57e37c61f364090eb06d9d4d68492489e9e5b
83a09a26b44648a79d771026e4f302785987fc933bbe7ac9691d51da6bceeada
8424b92697034b3c491a2752732430f6b6b1e5e958e6f676c6511135694a4443
84db02ab8e55dccd00c4c8d59f04b53ba9cc06739f14fe373fd3508468368b0b
85117b8ec3750659ae1ec02d94fc938b29d05b1155fa8b60f68abc95fd833cd7
85597933194ed483941f3e349f332850f7f6aed2b162686a1c9335131de88d02
8574d51a4bad21304283c2b8b624220657d2cfe7a26e0c072a61a74754b130aa
85f6e72ea4473f01b8d1b0457b685dd5e2fdad9f9c1164b90be1394def531229
86af5b326928b2c1ff88a7a840e7ab2a556caf29004ecb780be2f365e2141f3d
8870b41577a45f6fd708e449c32cf8fbaf18596f2d596f94a1e7a885bffe94c2
88b8c8d8071a726a88f706371207fcdaa940fda12d7a4248c4e247125d39b7d2
89841ad57036bc1687845785f3bba7395ea81505c0ffa3f30feb714af97331db
89897c2321b28b57055d88b033edeba813db8b6365350f1fdaad503ba3886fd2
89f2442d402f1f6bb2cd250e15c69edf2ebfd35bbf835b4c4bc652595b32b055
8a0bbc6e69da175d4b686b415b2900744ce232528ea8deeeab25c6488b8515bd
8abe1cffc094e93258939d65bc08bcd58ea3003acce79390dd9fd4bb3b817a17
8b121f75715948313f44b4fea6275dffc823a95cf4e5a1ed6e234e35197d9024
8ba9a670d69008553833388475722346e05b77d533491eeeb9e91b66b29d8e91
8cdb26386b6aa3ab8629afc3378f9dac5ecb92695f679955f438ddb4a8495f61
8d94ad0626f20832623ab4213ec18372a80ba41d9191ff4a83dd0fb2717e389d
8dd435678c48eea256052c7edb3eb6f63e12684d811798bb07cde868d7ba3ecd
8e3115e5a52f5404bf5dc594306eb78af484529dc817efdbf0c10d22ef4d5cf1
8eab86fc3b472b4255690af822fa20d966638f5448f47f1af2a1eadc51ac212c
8f55483eeaf397df04fbca11f84c1e6b0f9248c62d78f072d25bb37501651510
914071d19e23b14b4febdb7c6c2954a8e41e197e8c90cdda072df8669284457e
919eab603bc421554d2b2dab153b91be83d669e2abd2fbfc917c2a36df467dd0
91afcb55c390f47459fa872e4539380dee4e05cd2f7d0e57371e8221ca485903
91c5c33d3458ec7c51ecb5dfb218cee8ea949a821c7dcfcb0de65e50063f42dd
91dfb93ecc9f382ec9a47680431bc53a93c7aac68081f477c13c634b1d8659c8
9216600c7556122bef667ac48702d936a618a271bd76d6de586befbabff4b931
934b3042342d40bb3099532e8333bed35f83c587cb8780092451d25466f4242b
94317a69ab6531f3ec83a2d9b63d0fdd0d7d9b70a787d3ef77270cb668bdbf97
94eed665061b2326d056232663212cba8044d97dbbb707cf5599af229d6337f3
95f3ba0bf5927dd9f23597474715b256951af3dac13aad614d79773182e2c121
962e1fcf0889ab4e6a8fa7ba81b8e255039a745c32d159d73fdbf8dc217bc7e3
9686d5dd1d54e46dd4845e895b49afe36b5936ad33a7f6ab8c567b1e3a7bdc20
969fc4bd967b9c056382186b031e89244f07af645b2bffe007179e0ee8f2008b
96ac0f6a7e4abd572c63207b235b0f8157a899e3df3a58e0bb31b53b48d4e553
9766dca93376a8c520a6341db941783213b62596b0e0f0cde231e5894ab02210
97763566a162b1114a0f31753144188e40b5ea4efb03762e3bcfa2befc03d19b
9847b71a4a5fe4f6749ba80d403a67e06e65a9feeb244a8af19e7bf5370e9eee
987e84a12c0a8de359ba1e92eb0c8cffa882eb87b1e5da6d922a2e6c41807755
99ff087943d873c8d7d4db71ceec04b0060af3eca89331d6488aaa526f06a255
9a4cba0790add63151036475cbdfbf9f13b1f02270e50e92b37b83decea3ddbc
9a5ed033c0a119e0460b6055ea175d2fe09be3d4642ce1bdbbc5f2a1d309c97b
9b0bf01be4f88168c152f51f7936a819ef3abe8e0fee35389936bd43bb4f326d
9b20ff202aec14fad727bbbeb152dcbb0c95ca660090cdd5e291c08154d08fa0
9b51eca8947765e4da56111fd23dc531e7dbf85c564af2c74b7f00054116f270
9b8af8b48f229c79aae80013b56c83da9dd4edebc6f0fd33fb46936925737d1e
9ba1f64b6841210d5368912fcae656b5f228085f7074a82606f6257ba339d1f6
9ccb3dd2e872e138b7772f0d200bfa2fffe967bb509346a36aa1e179eb7d2638
9dcdcc31fa4a6dee035d46b20094294bef6d58a8a1dbd9baba297e29dab1f55a
9e489d6e0ff151bd7ea30083edc84b49bab7d01da4c497ac201f9e7e202d6eb6
9e781302daf58ab3651be2dceda6487ad8e3a947bc2913476276c55da579973c
9f43c445ed205831c7f80f19e7c30321777100d58b9ab4f5b9aa60d9715296d1
9f4578c75551deddcfc85411b0e8a9db2632ad497741a32ba019c162e43328f3
9f834177faa76ebb8d9bcf36054298492d91bcdfcec74714e76e79ffc9fc6bd9
a0c40ea3c2b9c8477fe9acb1b976984422b9af669e2fe45ea9245bda1da4139e
a0ce29f46b8e2c510be43a50635c4e44dbf8f7fb91ee479fc307ee0013300072
a18a2babf5018ab59d1b13dca56f764ccfd277bd212fbedbbc57dcf18a61c9eb
a1b7f000f7312a8499258743e701d9cac497a7446ed1f698e3feb62513007c6b
a1faa1d5635f74de61adf15e4a6fdd4c9308fa34e5f053630b8457d75323f71c
a2cbf90e781461674a053940930e3648c092f62463d7f1b67af72dc93e8462d8
a363d894152190e080cbe864ccec82c55c0273e846d6157d453ad315c048f530
a41087242ae98024385a6f70576a1b6fa0496d1eb824250cd878d7d36fd17877
a4c662865e328b2b1283a237ba0fcc40ec237e59ce9d48d4e2f2c0414650a6e3
a4caa895822b7c0699d0ae357400b2c55fdda5333987f2ca45da441b21cf4627
a4e8dc2aa224f0d0c1370763b8b390ea8284aaadf70683f7ee9078abd1d44f3d
a5c85435d59c10c59f719017d578e616953d36881c5f8d8c2b09ff307ff731af
a647ceb1e89cf55cee2f750ba4ce39fb19ad30ea5ae04d271e401e2947e04c2e
a656e54d21e2d1885cb3497be0c3cc9afa52017a3378863ee3b3ae0e098626b5
a787ee441ae60f802d16a5bdb15d3242452c5a905c74b0e8329b8bc39f81d783
a908652607eb9952765e20a80df6ce2c4071f7e17562c298f1111676ad7d59b8
aa5283ad2df29a710037708f397837e3d4e04207128564aa43adf0b3fe008009
aab2c0444ee1bb854c26ed23c0a1a75b34a197c18de8cbec125a2ca6662d27a0
abdbad63fb5df46b18557faba588727b3a47a4deef48735be7f7d9d050ac1098
ac8034c69fcca5bcca41e0a4b4ffdf7ba3173d10b6c0ab02ada63ddd273a6d48
ad5d94193684febda4ee007977037fee065de7f6da214af3d3756a6de5979f4b
ad8e0d42a6b90507ca33ad40d1130ca04f2903481d3163a5558f810e48663750
adef9c57dffeef4657bb1c24c3778e1b43b69d073142024b864b40b915984878
af4aa778a7f34506d384cc16896b6e5edd6fc0bf00cd2e6d6aaea582c7cae5b1
af69b84b19aef2b4459d926487fb8be696cce2cd858766741459f8b55371866d
afc871178d0b8a97772012d51f344c64c1584d8119dd4620dc38c1d50638dcc8
b1aa8669eeb8e63e72d703f82a91aaa83b7925ee5004c7325abdddc4f8085ced
b2cf9afff6acb1f820ad0ff086d6f69245c1eb4a2085767af542fd4852126989
b2f2261c846a456151daf1246d80b0c103fce5f090b9147f692507096c58e68e
b324a08d0cb1a8c6d0087fc5d5dd45649d5b05adb6ece931656143d39facaae1
b3dfa4a6eaad37f976a2f9da11a9b5fe9d10758f53bf2a4bccc8feb449558bdd
b4177ec0ffaa3c295d56cadf8cde58d143b26d30dac97fcd28f103965d7938f2
b4982619ebf1ae4924e1a46d4c84f69e6a5dcce7948c7a742c4f798008f21bad
b4fc1e6794d0711626979796de3ffeac453a91c8e3c9f81793354700236baa98
b5592558cbfe39d3328669314ca04467c9ebbaf15e73180a662c912995595495
b5b971d7cc05b8938d4fc8e77ca1a7bd0f1fe31ff65b85b3d8db8c3d2856ba37
b6ea99c3a102cdaf9ffc245fa6ad09ea10b94627b3e7880fbc357f122577ddd6
b8c9ff2c2543b5860211f0b86be9a5e0b66566247f27d1802ad06a184114995c
b980c1f84e39fc0f0036bfc93b6792cb0927e0c916883638d0d6a15aa9ac4c0f
b9fef960f1cef1713883f55f9ba22e34f007004eea3aa3d012e76268ef457c51
ba670531918c0d91a4192b36975e0a56cb870a196ed6433d53bf101642fc1511
ba732adf2e205992f61d81e5f1185ecdd92dc349c434a4a3839ad6f464c46873
ba7426e6999b3f0f32fb627c4f232f169e3a6339a04283d74ef1bb45a6caab09
ba7f61f994d1bca7fa8174a66aaa6733b522ff7ba7b97e2a92ea9f501d70f615
bad56fd5b56c7a3ed63932bfa25bd50923d1a01e5bd875981da38f8d2e22f4c7
bb10276cc6e85ff02d0dde90d20e78f4b4a3c60e01dd8c27d39e4b6fdca6227e
bc64c2337e68afa7bf406ffeae2c30f3bd657ad0257af1bf5ae4199abe99c41f
bca0805ef3daf759cd14693e46bce298793d1d036decf6599076b955e3b61359
bf0a72eaa43ec0b955dcd963f553c440667cb9eadb4d8f0d14c26f19be435017
c0ad18fdcaef9eb8a4241e4e4de3a2ee5136cde685f37e988048b59aa72f6a01
c0db2f876d69538a235e8136ec668eb778f319e33df23d6ed0ca19da366e5769
c1a557ae03a36b62780ea4fc18d8d8101ff2706d955c74e84d025f36e698c478
c1b48f5d30110b1fe7ba732a14885f85355012ac0be4b71b64743885f7ac7b0d
c227da36153e9bee948477b85f109f213b003f1be506a5e6ee6e39c652683e8b
c2b5fe6600757f1c4ac9ec89cd7333bc69333f1d5d585d44a898e777f1a33c90
c32aa65e33abdade72478576695a0c9cb0fe3ee9ec2d7906b6188127c6ce4744
c3e110076db06dcacc41b1ee9a8fa0cf703b09a1bed397de7dd74a724f57e1da
c3ef935b44dac3538b022cb4d23fc52c08381cb0a911b9211f811dd6268fe7f2
c4a10dd3942c294236230759bb59a7f2382ea1eff160a6331c06e2c347f1423f
c5829363549cdb24180e8d14359e1551953280da667e1bf02c26813e264062d7
c5d70c00ded0ccdc3760205601dec94fd9ee3c8b0a04b9e845d53c8557e44e42
c648e3bab34ac1911f4755b0025eb21e12a15235243f824baf866fc18f849018
c6aefb3fea0ee52fd927dec7e72574273f211ae84dbcc7f15093281efce44b80
c6b1e76b7d830624a1e1aa502f251357798bbe13906a481bd60d726fce8c4b99
c6bdcfc229ba855cde5dd91043c50a8adb5b39be2db10de8b0913b260e82d467
c6de227d06044ee65a1e434d7371d845d8b2a744dd1911fb200caa0252d395c8
c6e79054bf3e8a837eaabb102f3a506bcaedbf666b8a79167e49f2483ec1c2a1
c759d267e666543ab4e0e4fb6bf272fcd9b48e2220ded134d7c39bba8a627d89
c845c7cb042d683a327234963eb58664695501671fef2de40c440b4f9d3c16ea
c9d1c530da61f5a6d728f3a73a22e64971c80aaaaef5a6c66034fd6feaef3573
cafebe9e7d998927dbbe5ea8a6be85921d45f72ca7c1a17b2ef9468f5078338b
cb238291bb451c30f25b74f7a9400699f27f8c50eb8f0def138c22dadab41593
cb9a64d0365104448b2de39b3f0a049a80cd41fdd437a909eca1c63f23530437
cba28043f7791aa5aa05a723b72bd6dded213a991070eeda5e7c2ce6f53fc17a
cc0c5b39889d0ff1106aa0570943b9b22ca9274e8187f4394f59572944d1f515
cc8b4ff54af0ffce29d061622c8f02220c8f874e08015ab1063b6df82f16aaca
cd174fe31ef8f99e291fc4556bbd645244b02a6a34cac617fb60ca67125c4595
cd89163f0da49de1da3bd88068b417d6955cfb863bb2169e4742fa6e2613dc1b
cd8b580ac8e24c525793e537fb86e3feb6f6e946e3ce44209054df3db9ef4df9
cdeb7d66af20f4026d9f7463dc02e4c6b3ea8f317a744be135af55c03902f2ff
ce1ca0cdffd7dae574a0dca90cc61d41391f8a2dcdb4b6ed4963ed1a4ca5dc63
cfec2c71cc82479348c310c0a0b2b2d88e9496f7fab98528e300a7167ce787c3
cff41c53068b0eaa8823ae17f288a7fc8b90475b7a39625cff034ed965d86d92
d0ac3ee7a8493c15fee8122f292db57b648ca511f969026df244fd7a70b475b9
d0e32a204a06ea1571393af7ee62031c07676f368b23b223d34e54e296910d3d
d1b4be056ed8d012884b99b280ddf767cc7f7e10a370938efa20cac0e5bacfe2
d41ee5bfeda26eedef14b23efb42497f096c5faf34882d8ff427b66b5afdbc16
d44c4247b7516b030f5c3b5c6f18246933700447a6462531d31b06c4f0ab9112
d44d33bf0e9f3db5072febc5975381cd39ea2ef1530ae7aac11542a7a17bdd13
d4c56e13b91b49874cc3935602950b7f3affaa359285c308d137aa5dced4cacd
d4fb00b1c35891cfdd44c277492d6bf2d0c25dd235cc4a4234aed1eff87efb6a
d6223cc31ca3c8f5a56d4000cbd8210e0d005c3b46004f569362ec6237bb015b
d69eb816f58acde34921c2ae17ae15eba9d1852b650de3b78f5031c0f7ea7399
d6c4994dd1e52ded5df26ff0cae0be5cdeba71e4dfeb5df869d05d177fe48d0c
d73c9baedc0028945244a304367fbc2359b6284dfa7aa6943330946d4b1f8bb9
d75288cfd42992a8126d7a52157b33a3a482c7ede04941849295d0fb66fd087b
da1cd0853f8c5a172390799492c284308f7cda3211e3168065ea1038b34dccc1
db1bd207f730ff3a246b7f10dbbcadabfdbb106268bb3fc5cc6baf7812290c28
db948713cfb22c42848b95849da274d6163d62ee98906a8611fcc28be3e9f8e3
dc436c5e9db37e1e49e3879a2d48c9006604736a79d2f1adcbafa6610a6bcf0a
dc86948425b5a64d37563eb67aecea5376f92183de4514b0522db096e3775bf5
dc9442838b464e96281a32705c9b5958e4f45dbefd1ef4a885fac9898af0a4b7
dd7c9855f75cee6375304a44ce2926110568e75386b91fab4eca438d9ffbb0ce
dd973ca09e8aeeb3207831b7b3e4bd9a2edfa6958bd3ead562bf944d462bb960
dedbcced35c4c94589d7961fe117252114c3d4e00fe916921eded551c620daee
df5f0805a5ee576d99e03270f4dd2199425ca296541908cb352f0a9cfdfc2028
e05d8f00288862a37ace7fc1858593af571e18bbd58047859bd0db40d2613577
e0a7c3d27dbd8b8be9dcb9530ef896fede4d772d1b400b1621c1bc201402ff5d
e1283c59b22173590c75fbd1e5d5049ce6a07d17511f331d207155b5ce23ec8e
e14b70dac1d6a17922efab57437a030ff100e1bddfd15705a3f658285c0345e2
e1de2d0013841b5608101ba981b7f248eb70b121d0c60f228fae2f7ea05c6671
e36230f9940559c423079bfcfef8665e32f83bdc7c3fb952085f006afc4dc059
e37dd7d2315ec6f30e5575269031314987540ad1c6b66a68f886b718fd86aa5b
e384e0a8095a585f2b1158dc0cca26f367e826aeb9b4b278139be4584353fa81
e39bbbc90ba2ec98e790f5f5ae35070b106b1d61bd63864e5f54ca6577837222
e5cc04252abd9020021aaa1ada4e277ac72abe6564912ccd7605675afab50f2e
e5ea544c0d2a64ddfe823a3573ca2f5c2d4b819818406cce105b64f9442e5a3c
e61b87ce6761b31e63f734372711eabd90480e34a5ceb50d05ff8c6722e6b3bb
e7f1549ed75bbfa46c266109a25a80e7ec7ff9c06f8f1bc9e3fc785c48b686c1
e99035f2cd88a9964697141c0c7dcae666cdb6d090fade6384938849052f4779
e9e1f3ea6b9bebdfcd57f0ed19164fcdd3ef150bf964664b7b949367c38ebbfb
ea130eca17a5ca678e505703acc692e92e667fc9e1fa5f3ee8c5649265c4bf60
ea1c2bb7f64055855b5e279c9a310cf77feafdef495221275873d1a6d772ab99
ea86418e2c41330e6abacfc4f3bcfba63dd51141242bdd40035fdbb94d7d044a
eb015ba9d6aaa4c26242fb38216d0ed89f98f95af9bbfde9dcf0d6ba247a3cc8
eb1bc05557ff7ee9b43ef5f139fb91e6b27cd37f8d0301ca80212a906cf0e3f2
eb95f84f22cb823fb85e81585db43fcaa1d15d9d3ab7e8f66e52f6cc52ce2b1c
ebea7e50e11c6b84b4f6a24654eb3d8200384902c0c0adaccb7d519e01f5c3b2
ec14cff253550df51a3a56c8eb24e17f78a6418161f58611e4b70033e58e0d3a
ec8f8ea18e02d818db8bbf426deb07582a3d9cff81d0c362412ad3e9073fe757
ed0ac275306f9ba56f8bdc680e64508f664a06f27b967d0c741eb1725fd7b262
ee504ae4cef55bb0da834ee7e3e529a96f6629dbc252e30e20f699387210250f
ee6ea5d2756058e830268aa7f8c128281b475a67f8132ff65944c8a4ee418123
f01cb4ca5446dbfac3746df36c28aa6436550a6ad92b3a05f8e655cce2433652
f09e5233b2f96a285bda898622d5cfadd4e7b3099946f3816797fd4ad207f68f
f115f66bfd7c3cea973f733107bc8b7e6e6475da8eb6146fb9faa8dc911c495b
f1b3f36898f435f9ee44b7f6fd4c955b9b251d278beb5495163224e57626acbb
f1e0573998367560e7789aff4e7281e8e2bc33b23a7534ec6dc4d648560d9285
f2be4f603293b9133e5e75be8bac8542748c880255de3fe9b2fb88b0b653a395
f4b55d90a856e8c3ebab3f63ba523f0f649e307d6026d95ff4100a05ea352a10
f5074719c820da2234185fd9ac0f8ed504744f268b75d59fcd197dc7c8dfb84d
f6117ae09962bc1a3147b7b7ce26ccdbf78ace1eeb3df8d19bc1a5c67acc259a
f66cda08b58e96e1d39f7e548b1aa3564d80da805ba4582c5cd424545a8b472a
f820a10e0024790f966e0d20936b44998ed3096f8a77691412fe0e66d5f28821
f87813c2572eefdf225f075aaf0a19794273ff6904a2ec5e4df296bfc9ec6809
f93a9ef3a09721ecec6a8410888c3639d3bc2a21dbc9e301785bc94b1ddd82bf
fa10e61e168c579058406f63bc93880f85f67333f319636623414fffd78627f1
fa47c0ce66e2fe5985810a077917dcc4e0df0c22225ccd98b83d852bc4cdb8e6
fa6c75cf3d534ddb5d7fe6ce32c124c612bba2d42fa68fa58705a715c02e10b7
fada19f4454d94e8c6f1183fc0d9ca99b192cfd4755493438abba4b9191106cc
fae83e06fec634925268b335d302a32feb609205fd98cd0a7f7ecd7f43a22452
fb1de4609557bcb0c9168a5b0f7e5e743643ff7ae2c9a50c7ee1a2ab8e153125
fb5664e1757c8064e2e36cb89b6f91c7eb49f5e9ce72d765ec9aa467bc330374
fc1279f2c325a19cfb2a68144833336a1b4a8cc5c2b90d901e46698f1c8481b5
fc836fa83e057e97b0d310807265749258a375e16362c909410986312454523f
fc8ed37fad888c59abc53e301f7975b2eb36102ccf135869d98d28dbe3979539
fccea170be81b068ea2bbe7cbd8a2884d770394cd5390d472c4b962703ac8c3d
fd53f704861e9b2e0ebf161c6db302479f2b0ae3e6b175edb548abcdbde98023
fd638aa195d9c92f40b64175a68e6b037c07d29ddcef7c5033edbe57c1b91c56
fe8fcf2e3e5f77ced294f0794441e48f29d80bc76b9b0043d339fc41a342a395
ff5c24c4c98957d98eba19066fae53dbc3319efc9e390cb1832c84bceb772901

YARA Rule List

Rule Names
apt_Fin7_Carbanak_keylogplugin
apt_Fin7_Carbanak_procmonplugin
apt_Fin7_Carbanak_hdplugin
apt_Fin7_Carbanak_hvncplugin
apt_Fin7_Carbanak_vncplugin
apt_Fin7_Carbanak_rdpplugin
apt_Fin7_Carbanak_switcherplugin
apt_Fin7_Tirion_plugins
apt_Fin7_Tirion_PswInfoGrabber
apt_Fin7_Tirion_loader

Part 2

These IOCs were released as part of our threat intelligence research on the Fin7/Carbanak cybercrime group. The full report is available here: https://threatintel.blog/OPBlueRaven-Part2/

C&C servers (hostnames and IPs)
hawrickday.com
landscapesboxdesign9.com
milkmovemoney.com
moviedvdpower.com
mozillaupdate.com
tableofcolorize.com
vmware-cdn.com
softowii.com
colorpickerdesk.com
expressdesign9.com
untypicaldesign9.com
digitalsoundmaker99.com
untypicaldesign9.com
digitalsoundmaker99.com
hong-security.com
fgfotr.com
nattplot.com
uoplotr.com
193.187.175.213
172.86.75.175
108.170.20.91
138.124.180.193
138.124.180.84
138.124.183.153
138.124.183.85
138.124.183.90
172.86.75.133
176.103.63.104
178.33.111.73
184.95.51.182
184.95.57.98
185.158.248.14
185.158.248.87
185.161.209.161
185.162.131.42
185.174.100.137
185.174.100.223
185.174.102.183
185.33.85.45
193.178.169.177
194.58.112.174
194.9.178.18
195.123.240.169
195.2.71.90
195.2.93.23
204.155.30.85
23.83.133.119
37.1.211.239
37.1.215.4
37.1.215.72
37.252.4.131
45.133.216.194
45.133.216.25
45.133.216.89
45.142.213.189
45.142.213.56
45.142.215.132
45.147.228.239
45.77.204.130
45.77.60.230
45.87.152.64
5.252.177.23
5.252.177.37
51.254.149.31
54.38.123.229
68.183.98.50
74.118.139.13
79.141.160.25
94.158.244.18
94.158.244.33
94.158.244.91
94.158.245.141
95.142.44.139