Pulse Detail — Threat Intelligence

PULSE NAME

Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor

WHITE APT41 AlienVault 2021-09-10 Modified: 2024-08-16

IOCs

HIGH VOLUME

An APT group known as Earth Baku has updated its arsenal of malware tools to target companies in the Indo-Pacific region. Earth Baku, a cyberespionage and cybercriminal group, was charged by the US Department of Justice in August 2020 with computer intrusion offenses related to data theft, ransomware, and cryptocurrency mining attacks.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1190 T1566.001 T1059.003 T1059.005 T1569.002 T1053.005 T1574.002 T1055.012 T1562.006 T1027 T1218.004 T1036.003 T1027.002 T1573.001 T1071.001 T1071.004 T1090.004 T1105

MALWARE FAMILIES

StealthMutant ScrambleCross StealthVector Cobalt Strike - S0154

Indicators of Compromise (17 / 76 total)

All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA1	09ffe37a54bc4ebebd8d56098e4c76232f35d821	SHA1 of 9e178bb966f101e8c8ed020fbb2fb5878e2a969f7eaf47bc990f0472e85a3533	2021-09-10
FileHash-SHA1	0f853e919a6d3d1ac7cc77534aa5c52fd1b16bf5	SHA1 of 24ac3cc305576493beefab026d1cb7cce84f3bfcbcc51cdb5e612c290499390a	2021-09-10
FileHash-SHA1	1077a3dc0d9ccfbb73bd9f2e6b72bc67addcf2ab	SHA1 of 34f95e0307959a376df28bc648190f72bccc5b25e0e00e45777730d26abb5316	2021-09-10
FileHash-SHA1	32ad4408adab44547bee230dc87bdc713b40b164	SHA1 of d9d269a199ca0841fc71fef045c3dc5701a5042bea46d05a657b6db43fe55acc	2021-09-10
FileHash-SHA1	4c8194c94e25d51a062fab3e0a3edcec349fe914	SHA1 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c SHA1 of 04f6fc49da69838f5b511d8f996dc409a53249099bd71b3c897b98ad97fd867c	2021-09-10
FileHash-SHA1	4cec7cdc78d95c70555a153963064f216dae8799	SHA1 of 8da88951322fa7f464c13cb4a173d0c178f5e34a57957c9117b393133dd19925	2021-09-10
FileHash-SHA1	7185bb6f1dddca0e6b5a07b357529e2397cdee44	SHA1 of 49e338c5ae9489556ae8f120a74960f3383381c91b8f03061ee588f6ad97e74c	2021-09-10
FileHash-SHA1	89626c89f1e96bad8a8b1e427efb4821a1cb68e9	SHA1 of e2ae201bd6a7397dcc5036260122e7d67046569b90c4f1b79ef8e34914729888	2021-09-10
FileHash-SHA1	9a0fd1e3c2341976f3ecefe896f3de6e6c199ca7	SHA1 of 02378f64fd1083491cf5558397aae763ff047a5fa9fcaf624d1710b86f440777	2021-09-10
FileHash-SHA1	aa5b5f24bdfb049ef51bbb6246cb56cec89752bf	SHA1 of 9269dc68d46630c0d534bf62a299037fd3a124a6459d97692c25ffb89ccd1f08	2021-09-10
FileHash-SHA1	afaee2608bbdf1c469bb9f74b1013d86c5667898	SHA1 of 560a96e4577d09eb13416e5c4d649c346ca11a2459f09c8a3495d7c377c1f31d	2021-09-10
FileHash-SHA1	c00d036b84502948fb55a6ff89a46b4a5b2cb02b	SHA1 of 8284c44f87ab8471918da564152ffcc28348a671e3a9316876b075cdf03c3607	2021-09-10
FileHash-SHA1	ce2ceafa512bff34fdf4c84a0e9b59511270db5c	SHA1 of 62d9e8f6e8ade53c6756f66beaaf4b9d93da6d390bf6f3ae1340389178a2fa29	2021-09-10
FileHash-SHA1	daa2168731838ca2d926e7d52498582765918a96	SHA1 of 98f6be546c5191b67014e3d0f7f8df86715d970aa326a6a438d0be234daf8841	2021-09-10
FileHash-SHA1	e15c9eb75f69a9d5ce601201cf09ea9f54e7b4bb	SHA1 of 477882b41e10aef0fcd0d5d33715dfb4eb7f8f3277057978ac77d3ec5914c6f9	2021-09-10
FileHash-SHA1	ea44e9fbdbe5906a7fc469a988d83587e8e4b20d	SHA1 of ce16e9a2d3722bb5f5b3636f307bd386ed24abafea72aeb6dd002d51eeca16df	2021-09-10
FileHash-SHA1	f83714dd633913a33701f47345964216aa172915	SHA1 of bf34dfb4140c00d23554b03ebb986b2734a2c396877681d526e2ac80b372268a	2021-09-10

References (1)

↗ https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf