← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor
WHITE APT41 AlienVault 2021-09-10 Modified: 2024-08-16
76
IOCs
HIGH VOLUME
An APT group known as Earth Baku has updated its arsenal of malware tools to target companies in the Indo-Pacific region. Earth Baku, a cyberespionage and cybercriminal group, was charged by the US Department of Justice in August 2020 with computer intrusion offenses related to data theft, ransomware, and cryptocurrency mining attacks.
cobalt strikestealthmutantscramblecrossstealthvectorapt41eath baku
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
StealthMutant ScrambleCross StealthVector Cobalt Strike - S0154
Indicators of Compromise (76)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2021-26855 — 2021-09-10
FileHash-MD5 083eae61806f710ba2fa8fb368f7e998 MD5 of 02378f64fd1083491cf5558397aae763ff047a5fa9fcaf624d1710b86f440777 2021-09-10
FileHash-MD5 167b224e00ea4cc7e793b01c85659e70 MD5 of 24ac3cc305576493beefab026d1cb7cce84f3bfcbcc51cdb5e612c290499390a 2021-09-10
FileHash-MD5 1e750c5cf5c68443b17c15f4aac4d794 MD5 of 477882b41e10aef0fcd0d5d33715dfb4eb7f8f3277057978ac77d3ec5914c6f9 2021-09-10
FileHash-MD5 420c09296ae836a853c5968a2a554f96 MD5 of 98f6be546c5191b67014e3d0f7f8df86715d970aa326a6a438d0be234daf8841 2021-09-10
FileHash-MD5 432e0676db09997f78e133263737b401 MD5 of 560a96e4577d09eb13416e5c4d649c346ca11a2459f09c8a3495d7c377c1f31d 2021-09-10
FileHash-MD5 5251b3f47b1ae8feb79642011b3a925b MD5 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c MD5 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c 2021-09-10
FileHash-MD5 644236a17aaec2687b09583082e4f74e MD5 of 8284c44f87ab8471918da564152ffcc28348a671e3a9316876b075cdf03c3607 2021-09-10
FileHash-MD5 6e17ee7ca6fddf28a47cc07d5524ce5c MD5 of 9e178bb966f101e8c8ed020fbb2fb5878e2a969f7eaf47bc990f0472e85a3533 2021-09-10
FileHash-MD5 6fb64677980d2cae622e9ed6e4f4c449 MD5 of ce16e9a2d3722bb5f5b3636f307bd386ed24abafea72aeb6dd002d51eeca16df 2021-09-10
FileHash-MD5 955f71062d06ebca0c9852ae3ec2965b MD5 of bf34dfb4140c00d23554b03ebb986b2734a2c396877681d526e2ac80b372268a 2021-09-10
FileHash-MD5 b4a8d94fa763a7bcae92b500535bf131 MD5 of 8da88951322fa7f464c13cb4a173d0c178f5e34a57957c9117b393133dd19925 2021-09-10
FileHash-MD5 c629ae2af8689989fc14b26405761d03 MD5 of 9269dc68d46630c0d534bf62a299037fd3a124a6459d97692c25ffb89ccd1f08 2021-09-10
FileHash-MD5 c86d9e9f1fab81bcddd93932d1858499 MD5 of e2ae201bd6a7397dcc5036260122e7d67046569b90c4f1b79ef8e34914729888 2021-09-10
FileHash-MD5 cde90ac52c964a6c6b4326347822c561 MD5 of 34f95e0307959a376df28bc648190f72bccc5b25e0e00e45777730d26abb5316 2021-09-10
FileHash-MD5 f5158addf976243ffc19449e74c4bbad MD5 of d9d269a199ca0841fc71fef045c3dc5701a5042bea46d05a657b6db43fe55acc 2021-09-10
FileHash-MD5 f61dbac694d34c96830f184658610261 MD5 of 49e338c5ae9489556ae8f120a74960f3383381c91b8f03061ee588f6ad97e74c 2021-09-10
FileHash-MD5 fef94f9977f6c9da0d8e006a5fefc5c1 MD5 of 62d9e8f6e8ade53c6756f66beaaf4b9d93da6d390bf6f3ae1340389178a2fa29 2021-09-10
FileHash-SHA1 09ffe37a54bc4ebebd8d56098e4c76232f35d821 SHA1 of 9e178bb966f101e8c8ed020fbb2fb5878e2a969f7eaf47bc990f0472e85a3533 2021-09-10
FileHash-SHA1 0f853e919a6d3d1ac7cc77534aa5c52fd1b16bf5 SHA1 of 24ac3cc305576493beefab026d1cb7cce84f3bfcbcc51cdb5e612c290499390a 2021-09-10
FileHash-SHA1 1077a3dc0d9ccfbb73bd9f2e6b72bc67addcf2ab SHA1 of 34f95e0307959a376df28bc648190f72bccc5b25e0e00e45777730d26abb5316 2021-09-10
FileHash-SHA1 32ad4408adab44547bee230dc87bdc713b40b164 SHA1 of d9d269a199ca0841fc71fef045c3dc5701a5042bea46d05a657b6db43fe55acc 2021-09-10
FileHash-SHA1 4c8194c94e25d51a062fab3e0a3edcec349fe914 SHA1 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c SHA1 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c 2021-09-10
FileHash-SHA1 4cec7cdc78d95c70555a153963064f216dae8799 SHA1 of 8da88951322fa7f464c13cb4a173d0c178f5e34a57957c9117b393133dd19925 2021-09-10
FileHash-SHA1 7185bb6f1dddca0e6b5a07b357529e2397cdee44 SHA1 of 49e338c5ae9489556ae8f120a74960f3383381c91b8f03061ee588f6ad97e74c 2021-09-10
FileHash-SHA1 89626c89f1e96bad8a8b1e427efb4821a1cb68e9 SHA1 of e2ae201bd6a7397dcc5036260122e7d67046569b90c4f1b79ef8e34914729888 2021-09-10
FileHash-SHA1 9a0fd1e3c2341976f3ecefe896f3de6e6c199ca7 SHA1 of 02378f64fd1083491cf5558397aae763ff047a5fa9fcaf624d1710b86f440777 2021-09-10
FileHash-SHA1 aa5b5f24bdfb049ef51bbb6246cb56cec89752bf SHA1 of 9269dc68d46630c0d534bf62a299037fd3a124a6459d97692c25ffb89ccd1f08 2021-09-10
FileHash-SHA1 afaee2608bbdf1c469bb9f74b1013d86c5667898 SHA1 of 560a96e4577d09eb13416e5c4d649c346ca11a2459f09c8a3495d7c377c1f31d 2021-09-10
FileHash-SHA1 c00d036b84502948fb55a6ff89a46b4a5b2cb02b SHA1 of 8284c44f87ab8471918da564152ffcc28348a671e3a9316876b075cdf03c3607 2021-09-10
FileHash-SHA1 ce2ceafa512bff34fdf4c84a0e9b59511270db5c SHA1 of 62d9e8f6e8ade53c6756f66beaaf4b9d93da6d390bf6f3ae1340389178a2fa29 2021-09-10
FileHash-SHA1 daa2168731838ca2d926e7d52498582765918a96 SHA1 of 98f6be546c5191b67014e3d0f7f8df86715d970aa326a6a438d0be234daf8841 2021-09-10
FileHash-SHA1 e15c9eb75f69a9d5ce601201cf09ea9f54e7b4bb SHA1 of 477882b41e10aef0fcd0d5d33715dfb4eb7f8f3277057978ac77d3ec5914c6f9 2021-09-10
FileHash-SHA1 ea44e9fbdbe5906a7fc469a988d83587e8e4b20d SHA1 of ce16e9a2d3722bb5f5b3636f307bd386ed24abafea72aeb6dd002d51eeca16df 2021-09-10
FileHash-SHA1 f83714dd633913a33701f47345964216aa172915 SHA1 of bf34dfb4140c00d23554b03ebb986b2734a2c396877681d526e2ac80b372268a 2021-09-10
FileHash-SHA256 02378f64fd1083491cf5558397aae763ff047a5fa9fcaf624d1710b86f440777 — 2021-09-10
FileHash-SHA256 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c — 2021-09-10
FileHash-SHA256 209521bc350e7f5b28decba46bad81090a13f42eed396db3ca9a97eaf7902fe8 — 2021-09-10
FileHash-SHA256 24ac3cc305576493beefab026d1cb7cce84f3bfcbcc51cdb5e612c290499390a — 2021-09-10
FileHash-SHA256 34f95e0307959a376df28bc648190f72bccc5b25e0e00e45777730d26abb5316 — 2021-09-10
FileHash-SHA256 477882b41e10aef0fcd0d5d33715dfb4eb7f8f3277057978ac77d3ec5914c6f9 — 2021-09-10
FileHash-SHA256 49e338c5ae9489556ae8f120a74960f3383381c91b8f03061ee588f6ad97e74c — 2021-09-10
FileHash-SHA256 560a96e4577d09eb13416e5c4d649c346ca11a2459f09c8a3495d7c377c1f31d — 2021-09-10
FileHash-SHA256 59fa89a19aa236aec216f0c8e8d59292b8d4e1b3c8b5f94038851cc5396d6513 — 2021-09-10
FileHash-SHA256 62d9e8f6e8ade53c6756f66beaaf4b9d93da6d390bf6f3ae1340389178a2fa29 — 2021-09-10
FileHash-SHA256 6c5192a478bd7eca95f83ab3ebf036d4c1ffcc81e0354fa05f02f5fe4e8bfdf5 — 2021-09-10
FileHash-SHA256 730f4d8c1e774406105bbaad3cb4b466c27e0a50cf8345c236b42a80b437e2a8 — 2021-09-10
FileHash-SHA256 8284c44f87ab8471918da564152ffcc28348a671e3a9316876b075cdf03c3607 — 2021-09-10
FileHash-SHA256 8da88951322fa7f464c13cb4a173d0c178f5e34a57957c9117b393133dd19925 — 2021-09-10
FileHash-SHA256 91aa05e3666c7e2443fc1f0f0142f1829f5ec51e289c95b10811531da50eb2b3 — 2021-09-10
FileHash-SHA256 9269dc68d46630c0d534bf62a299037fd3a124a6459d97692c25ffb89ccd1f08 — 2021-09-10
FileHash-SHA256 98f6be546c5191b67014e3d0f7f8df86715d970aa326a6a438d0be234daf8841 — 2021-09-10
FileHash-SHA256 9e178bb966f101e8c8ed020fbb2fb5878e2a969f7eaf47bc990f0472e85a3533 — 2021-09-10
FileHash-SHA256 b7b2aa801dea2ec2797f8cf43b99c4bf8d0c1effe532c0c800b40336e9012af2 — 2021-09-10
FileHash-SHA256 bf34dfb4140c00d23554b03ebb986b2734a2c396877681d526e2ac80b372268a — 2021-09-10
FileHash-SHA256 c1b587a922691c7e01db3e57f223fa2b5d2df2121736922ff97141571c550cfc — 2021-09-10
FileHash-SHA256 c8e3e27401ae87cbd891b46505b89f2970f8890de4b09cbaa538d827caa86b26 — 2021-09-10
FileHash-SHA256 ce16e9a2d3722bb5f5b3636f307bd386ed24abafea72aeb6dd002d51eeca16df — 2021-09-10
FileHash-SHA256 d1175b88744606363f6fdf2df5980ca5a0898a3944fcf15f5c4c014473b043ca — 2021-09-10
FileHash-SHA256 d981edf78680f46616574b46ac3d0ab58a509430c155905761058152a24f091d — 2021-09-10
FileHash-SHA256 d9d269a199ca0841fc71fef045c3dc5701a5042bea46d05a657b6db43fe55acc — 2021-09-10
FileHash-SHA256 da4b86b9367151e0c36b90cb7329aca2d05f2984ce0e0181dd355b728acc4428 — 2021-09-10
FileHash-SHA256 e009ef76fb9402fe379280ed9c6a4d81748fb259475b9048937f3d7c7f0f0f32 — 2021-09-10
FileHash-SHA256 e2ae201bd6a7397dcc5036260122e7d67046569b90c4f1b79ef8e34914729888 — 2021-09-10
FileHash-SHA256 e66adbc6ca13dab9915aca30360c86b75e63e9c0845ac89217299fed556810cc — 2021-09-10
URL http://45.138.157.78:80 — 2021-09-10
URL http://ns1.extrsports.ru:443 — 2021-09-10
URL http://www.microsofthelp.dns1.us:443 — 2021-09-10
URL http://www.twitterproxy.com:443 — 2021-09-10
domain dns224.com Registered=03/24/2020 Registrar=NameSilo, LLC 2021-09-10
domain mssetting.com Registered=10/27/2020 Registrar=DANESCO TRADING LTD 2021-09-10
hostname ns.cloud01.tk — 2021-09-10
hostname ns.cloud20.tk — 2021-09-10
hostname ns1.extrsports.ru — 2021-09-10
hostname www.microsofthelp.dns1.us — 2021-09-10
hostname www.twitterproxy.com — 2021-09-10
References (1)
↗ https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf