Pulse Detail — Threat Intelligence

PULSE NAME

Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor

WHITE APT41 AlienVault 2021-09-10 Modified: 2024-08-16

IOCs

HIGH VOLUME

An APT group known as Earth Baku has updated its arsenal of malware tools to target companies in the Indo-Pacific region. Earth Baku, a cyberespionage and cybercriminal group, was charged by the US Department of Justice in August 2020 with computer intrusion offenses related to data theft, ransomware, and cryptocurrency mining attacks.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1190 T1566.001 T1059.003 T1059.005 T1569.002 T1053.005 T1574.002 T1055.012 T1562.006 T1027 T1218.004 T1036.003 T1027.002 T1573.001 T1071.001 T1071.004 T1090.004 T1105

MALWARE FAMILIES

StealthMutant ScrambleCross StealthVector Cobalt Strike - S0154

Indicators of Compromise (17 / 76 total)

All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	083eae61806f710ba2fa8fb368f7e998	MD5 of 02378f64fd1083491cf5558397aae763ff047a5fa9fcaf624d1710b86f440777	2021-09-10
FileHash-MD5	167b224e00ea4cc7e793b01c85659e70	MD5 of 24ac3cc305576493beefab026d1cb7cce84f3bfcbcc51cdb5e612c290499390a	2021-09-10
FileHash-MD5	1e750c5cf5c68443b17c15f4aac4d794	MD5 of 477882b41e10aef0fcd0d5d33715dfb4eb7f8f3277057978ac77d3ec5914c6f9	2021-09-10
FileHash-MD5	420c09296ae836a853c5968a2a554f96	MD5 of 98f6be546c5191b67014e3d0f7f8df86715d970aa326a6a438d0be234daf8841	2021-09-10
FileHash-MD5	432e0676db09997f78e133263737b401	MD5 of 560a96e4577d09eb13416e5c4d649c346ca11a2459f09c8a3495d7c377c1f31d	2021-09-10
FileHash-MD5	5251b3f47b1ae8feb79642011b3a925b	MD5 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c MD5 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c	2021-09-10
FileHash-MD5	644236a17aaec2687b09583082e4f74e	MD5 of 8284c44f87ab8471918da564152ffcc28348a671e3a9316876b075cdf03c3607	2021-09-10
FileHash-MD5	6e17ee7ca6fddf28a47cc07d5524ce5c	MD5 of 9e178bb966f101e8c8ed020fbb2fb5878e2a969f7eaf47bc990f0472e85a3533	2021-09-10
FileHash-MD5	6fb64677980d2cae622e9ed6e4f4c449	MD5 of ce16e9a2d3722bb5f5b3636f307bd386ed24abafea72aeb6dd002d51eeca16df	2021-09-10
FileHash-MD5	955f71062d06ebca0c9852ae3ec2965b	MD5 of bf34dfb4140c00d23554b03ebb986b2734a2c396877681d526e2ac80b372268a	2021-09-10
FileHash-MD5	b4a8d94fa763a7bcae92b500535bf131	MD5 of 8da88951322fa7f464c13cb4a173d0c178f5e34a57957c9117b393133dd19925	2021-09-10
FileHash-MD5	c629ae2af8689989fc14b26405761d03	MD5 of 9269dc68d46630c0d534bf62a299037fd3a124a6459d97692c25ffb89ccd1f08	2021-09-10
FileHash-MD5	c86d9e9f1fab81bcddd93932d1858499	MD5 of e2ae201bd6a7397dcc5036260122e7d67046569b90c4f1b79ef8e34914729888	2021-09-10
FileHash-MD5	cde90ac52c964a6c6b4326347822c561	MD5 of 34f95e0307959a376df28bc648190f72bccc5b25e0e00e45777730d26abb5316	2021-09-10
FileHash-MD5	f5158addf976243ffc19449e74c4bbad	MD5 of d9d269a199ca0841fc71fef045c3dc5701a5042bea46d05a657b6db43fe55acc	2021-09-10
FileHash-MD5	f61dbac694d34c96830f184658610261	MD5 of 49e338c5ae9489556ae8f120a74960f3383381c91b8f03061ee588f6ad97e74c	2021-09-10
FileHash-MD5	fef94f9977f6c9da0d8e006a5fefc5c1	MD5 of 62d9e8f6e8ade53c6756f66beaaf4b9d93da6d390bf6f3ae1340389178a2fa29	2021-09-10

References (1)

↗ https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf