Pulse Detail — Threat Intelligence

PULSE NAME

Comprehensive Threat Intelligence: TeamTNT targeting AWS, Alibaba

WHITE AlienVault 2022-04-22 Modified: 2022-05-22

162

IOCs

HIGH VOLUME

The TeamTNT cyber crime group has developed malicious shell scripts designed to compromise modern cloud environments, such as Amazon Web Services, Alibaba's aegis cloud security agent, Cisco Talos has revealed.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1027 T1070 T1082 T1001 T1564 T1525 T1140 T1036 T1574 T1014 T1134 T1018 T1106 T1530 T1505 T1098 T1480 T1496 T1547 T1562 T1592

MALWARE FAMILIES

XMRig Kubernetes VPC Security AWS

Indicators of Compromise (49 / 162 total)

All URL FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain email hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	1b72088fc6d780da95465f80ab26ba094d89232ff30a41b1b0113c355cfffa57	—	2022-04-22
FileHash-SHA256	33c8591edd61c6e968e727683a63fba0352b5b6b59a0b3005628c38848dd7dd3	—	2022-04-22
FileHash-SHA256	5e1af7f4e6cf89cff44ee209399a9fab3bfd8f1ca9703fb54cee05cce2b16d4c	—	2022-04-22
FileHash-SHA256	9315e055f4570b7a392447300dcc2ec06f09b57858c131a35e012bd0bb2356cd	—	2022-04-22
FileHash-SHA256	95809d96f85e1571a3120c7c09a7f34fa84cb5902ad5172398dc2bb0ff1dd24a	—	2022-04-22
FileHash-SHA256	a46c870d1667a3ee31d2ba8969c9024bdb521ae8aad2079b672ce8416d85e8df	—	2022-04-22
FileHash-SHA256	0085bf33d4e4e051a15a1bd70636055d709aeef79025080afc7a8148ece55339	—	2022-04-22
FileHash-SHA256	024445ae9d41915af25a347e47122db2fbebb223e01acab3dd30de4b35464965	—	2022-04-22
FileHash-SHA256	030f3a45d2c0a5200a7fed4734fead988eea4bc1ec48b92e6530610ffd082afe	—	2022-04-22
FileHash-SHA256	06e8e4e480c4f19983f58c789503dbd31ee5076935a81ed0fe1f1af69b6f1d3d	—	2022-04-22
FileHash-SHA256	0ae5c1ddf91f8d5e64d58eb5395bf2216cc86d462255868e98cfb70a5a21813f	—	2022-04-22
FileHash-SHA256	0dab485f5eacbbaa62c2dd5385a67becf2c352f2ebedd2b5184ab4fba89d8f19	—	2022-04-22
FileHash-SHA256	17862610ea8190e3ed4d22099d324d9058b15c941ce97236405fc80d3c50d747	—	2022-04-22
FileHash-SHA256	19575166abd57feccf7cb0a1459daf476e736b7386c54a2b3320b2fc6ae12b9d	—	2022-04-22
FileHash-SHA256	220737c1ee400061e886eab23471f98dba38fa8e0098a018ea75d479dceece05	—	2022-04-22
FileHash-SHA256	244c8993f9092f47c78e8e1414cc7499de94cc3126d591ec920a3dc5cef9c6af	—	2022-04-22
FileHash-SHA256	2d85b47cdb87a81d5fbac6000b8ee89daa1d8a3c8fbb5d2bce7a840dd348ff1d	—	2022-04-22
FileHash-SHA256	3c4ddcf3e6bff60d52479d0d17c908e4813926e9729cf0a2bade843f8d8d4cb1	—	2022-04-22
FileHash-SHA256	451a4cbb6b931d8bb8392f08e7c9ec517b1b1ef06f42e1c8105e4feaafd6b157	—	2022-04-22
FileHash-SHA256	48f92bdc4c039437ba77e6c6a74bb0d4b747aa94fb815223ea6d735d04fcb733	—	2022-04-22
FileHash-SHA256	5483941dcb2fb017850f3d358e4b1cc45837f30f517ebbbb0718947c5c4d5d50	—	2022-04-22
FileHash-SHA256	5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201	—	2022-04-22
FileHash-SHA256	5dc3daf24fcef6ccaef2fec45bbb554f8090930d92a76f5d4c5a1f2487e484e0	—	2022-04-22
FileHash-SHA256	6075906fbc8898515fe09a046d81ca66429c9b3052a13d6b3ca6f8294c70d207	—	2022-04-22
FileHash-SHA256	6158197143f1696368e5a0b26f995b9801c2b29ca2e09d6f0aeb374a0fb3ce1b	—	2022-04-22
FileHash-SHA256	6c8a2ba339141b93c67f9d79d86a469da75bfbc69f128a6ed702a6e3925d5a29	—	2022-04-22
FileHash-SHA256	71af0d59f289cac9a3a80eacd011f5897e0c8a72141523c1c0a3e623eceed8a5	—	2022-04-22
FileHash-SHA256	721d15556bd3c22f3b4c6240ff9c6d58bfa60b73b3793fa8cdc64b9e89521c5b	—	2022-04-22
FileHash-SHA256	7856273b2378b5a46e87fd8f91411c3c068a28c20d120d953e5307d5704ae0a2	—	2022-04-22
FileHash-SHA256	78facfc012957637c52763a17b94fd21f1e85f5dfaf26e459c1e4a9041e6f0e0	—	2022-04-22
FileHash-SHA256	79bb16aa326a401e9cd1716d0ea1d6e1fdfdac945a7b4f4f4480be3a1e77cdd3	—	2022-04-22
FileHash-SHA256	7bb1bd97dc93f0acf22eff6a5cbd9be685d18c8dbc982a24219928159c916c69	—	2022-04-22
FileHash-SHA256	8388b707ddacfa551642a9a20a0eb3b7d40b9bdb8024e4f9c0ce8ee9e8a56d7d	—	2022-04-22
FileHash-SHA256	84ce185b70b337342f3c43b594daa5f78737eff32bff03361349a81ac7808b78	—	2022-04-22
FileHash-SHA256	96a52109973d50174252b05be64f3ddf0182137fc4186d7a5cef989a4604010d	—	2022-04-22
FileHash-SHA256	a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa	—	2022-04-22
FileHash-SHA256	af2cf9af17f6db338ba3079b312f182593bad19fab9075a77698f162ce127758	—	2022-04-22
FileHash-SHA256	b07ca49abd118bc2db92ccd436aec1f14bb8deb74c29b581842499642cc5c473	—	2022-04-22
FileHash-SHA256	b158fc11e1d4aeaf9d3111a285cd353eaff6627e328737a5a242d7ec219f4121	—	2022-04-22
FileHash-SHA256	c57f61e24814c9ae17c57efaf4149504e36bd3e6171e9299fd54b6fbb1ec108c	—	2022-04-22
FileHash-SHA256	c991bedd44ce0425a157aa0c1fd03d39c5ae2bc019be4518fd979be780889537	—	2022-04-22
FileHash-SHA256	cef2707760086718175235810e3e49a7bbfedce482dee09eef3d302247e97142	—	2022-04-22
FileHash-SHA256	da4a2ae560a6fad9c80182212da3440d678264b4d2d440c94168e36a530490a5	—	2022-04-22
FileHash-SHA256	dd60805ec68e3285a2cd4f32083f10a8571e81fb99c03434359bf339011a4a4c	—	2022-04-22
FileHash-SHA256	de651f9bc4e26a09a0d1ebc63a36c6139593bef6625822d59b2ccf37452ef716	—	2022-04-22
FileHash-SHA256	ea02410b2983cfa8cf6740f1f0dbd41d3d07da3f8d2b64ca85defa83060cae72	—	2022-04-22
FileHash-SHA256	f05155c8be6efbd94c0ec891494aa064a93def34b122bd70b4d225ea13fffff9	—	2022-04-22
FileHash-SHA256	f82ea98d1dc5d14817c80937b91b381e9cd29d82367a2dfbde60cfb073ea4316	—	2022-04-22
FileHash-SHA256	fa2a7374219d10a4835c7a6f0906184daaffd7dec2df954cfa38c3d4dd62d30d	—	2022-04-22

References (1)

↗ https://blog.talosintelligence.com/2022/04/teamtnt-targeting-aws-alibaba.html