HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Domains/URLs

https://sgp1.vultrobjects.com/jttrepijgdb/Artificial%20intelligence.pptx

https://sgp1.vultrobjects.com/jttrepijgdb/efg_d4.zip

https://ppt1.sgp1.vultrobjects.com/myvideo.mp4

https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_def7.zip

https://sgp1.vultrobjects.com/downloads/pictory/Pictory_premium_ver9.0.4.exe

https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_17.zip

https://ams1.vultrobjects.com/micbucket/Temp/0412.mp4

https://micbucket.ams1.vultrobjects.com/Exclude/Telegram.exe

Hash

b2f6f40570ac9085b5463fdb623560de

16602375fc2dae1eb54580ab7eda6567

7d3cce1f9dbaed585b61e6e903d69b9b

d6756063230136f8c55ae27f1a4b0112

5507a3e71aade582dd226b63b1930c56

ca65cc67247d0702ca34eb7b06873bec

4dcfa4317f2111109cd41f457541ed2b

a1ca53f09b0c6fe3b3b57b5202192d60

b66bd18de204d405500dc079876b7cbf

14698d3a03216daa2cf6f39e4f1c4031

0a656287defcbd8a9c47385b805993df

d9418fb432631021a15fb896b365d608

fefaefbf09841cef739d090305edc7a4

c8aeca21d10f6bbb78e1f2a67d78fcad

87f7d0b30f7905d282fb464f5ad6c6cf

6cae314ddcd821dd2a60dff1fa02460a

6cae314ddcd821dd2a60dff1fa02460a

be98163e7fea224af382a2251252ce4d

970fc0fcf3bc5a933d10e8413536f27f

5f3271ba8840be547b1f3a42ea28ebe0

a3394ef7ffa7e88b2e7efaee4617fe04

94779909cc510194900c3cc17d1194c8

7e23ffadb664b0e53d821478a249d84c

1e6b601f733bc40eaa58916986bfc5b9

1d947084fdf25e07ec8bcdaf0cec508a

e51ff37fb431767dcdec0b5e6d2a786a

42215c1fb55d945b4d2a0bb188ca4dcf

cbe1743e9aebd3e3002b2b005deb332c

4dd0cbdad60e65fb8cd6999bd9359444

66fd60d03613decacc3c42d94dd9aab8

8e9e81d1b252d7fa99579e9cf2e4b4ba

26892452f724581530c45287c8b7bc67

b3c1a3eebefafe1346c6a864b5423182

B9086413E7B6A0C6A11C25D14C22615F

7402F2F9263782A4C469570035843510

EBDD9595B79B39F53909D862499DBC94

F8B5554808428291ACC65D1FD2EFE01C

481C5B5E69A08C3DF206C59FD8DDC0DC

2965817D063F1E8F9889F9126443D631

D70EBF20E3D697897BAD5BEBF72EA271

3E7A2FCEF1D038D05B20148C573A6499

602174f6e691d6845ac645b68f1f2538

0190940243f6535f51d43edafac943d493159e14

5f899031ec31431ff0f5fcaf4ccf5cd9484b2066

292887ea4406fce26773992af0bd7dc34951aa84

43d9af0c411110905ab4ddf4e4f713101c74d9de

ea7071abca429f28bfe629a913513c6d604771f4

44068866546ffea6ef8ab8a639c2151b13f9fd6e

ac5939a17ec6455b6b7ae0f04c5b71b1db0d00c5

87dcba4957396a9e594ed1d133bc115315763002

7ee579a1fa697f66d80103a867cf706f67bba32b

704119320f7ed10dc7707833218468d455d3c5fd

0fe3cf4cabadedb382b0833dcb6ba74db3242022

ba3874ca96f9bca1daff22ef49ea7505d52b40d4

2fa0eb74f8a527d938f8538d66bcdebcc9771527

88a8d118ee190ac36cf684c2992f6ddd2dda517b

9108466c98df01033371483a789a0c23372c52f2

53d41445e176bf53c5acd2dad533eda612b05855

3549f6df9c14b70d2308b7b12033218e77fe1dc7

9391928e5163ff791c1b4bc535f4ac92510810a6

ef3f7292cb2f91f9a34953b875eb018b3ef889d2

4a2658c66f3aeabdb05f56ba88d587683319ce6d

5d3cde9f6971ec35431cbb113b6b4bc292ea5db0

2b11bccdea89d428610c15bea1fba417ab8681a6

6d9817f5066be757f5f09b067a80fed3cfe280f6

f269488e2128128f234ee2e996489317bfa4720b

8c6b6236420c876989af36e3a9e648a00f3000c9

6fcf829720f425f81a6b35ac5f05fa94775429eb

168caccbe59473091aa4fbbebba6257aed17985e

5dd86e22b882d52c67d274e3297694009d13fb96

88816b1262eaf819edebb93dc883b3082cc64c34

fec45095576d13a20a6d42096fcadc2d8f6dddd8

33e9e5463c12c0a21a7ab37fb7496ab2c5c40bb4

6dd639542464a647e3816af896fb1320aff64ba5

8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd

47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4

d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e

3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81

6ddd145622cde2d2f91dace7e1f7edef22f4d49d3645fa9ad4bdb772829c30bf

4a3aa8f4f0eb37be9778fbdf0b7dd282fc407557da61735d2ae9cfc73ee2aa81

844108a626c15395059efa355a66c8462af0c822d8219b35b6038d9d42dcf61d

65359388b49ae2a982111ebe8ac837d0f3294ceab7a712df20d0f6c19bf3029e

ec9d3e32a4e78f8cc9581f5cf030f0594debee1ce67d2d0759aff3ec1c720b35

5380ffda12f97cf4d8e0fe02e0580aa1a48b4b6da95e7f8a30029ad125c51b3f

e9d2e4e8fac6420ca3b3a3a63a3d313dcfb236a24a11889d6923dd9b42a777d4

8ad63d4d30cd28391318e26f4e9464f302b0a12675a721967d4f2173ed6cfe8a

3f1313c813e51edf5734d9fb99eb93d6c3aa6c309e3f0a6a4878291c5b2ec73b

138a4c9cd617912c2269fae64b6b12d57e926a36c2c62f25ee05a32cdf102212

bb56792212abe160fff643631fb69b2081601e6310fc6669fd9d52d690ec1903

7477f4f25d1cfc3dfb1267e35ab4bcf0b30b8c7ec9677a8d1849ee7d17bc15aa

2deeeda412c40ad515dca940916a376d187219ed09ed697b4be4879b7091ec53

b0308c91a56209222b178e7099ee03a7b0d06a0e473f042fb2d3c144a07484fa

c9e5cbc98e91aa35a260a1f85d7a5605dc7aa8d2d0b71eb6f063147d4dfa1b5f

d40d730bcfa4cc7f1ee070f6ce863b03acb81af0a4d66feaec285e1205258b35

067d93741bcab16810ef15c11941245229519470dc7b24793dd1d3a7addacaae

cbe9e32393529cd79e19a639a1d2da93fba06082be2bdb0c04241f269f98c773

4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405

e8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc

ffceb438127725a6a664aba5021f7625bd8c22b3f76447de91b728839136c9c3

0d74156089292eee308017c8e8a7550739ecb6149ff379810f7c54b1dbaabc91

886d04b78017f721ed458158e3c31300cb7f9d512481a50f21461711438e1c5e

2640fc95373dd299cc61966c2df5ba9e013280ee02944d11bb4d1f70ee57aa30

58fb875fedf57055c3fedf59fdedb9ebffbf452a0f7f21608abb069cc13effb9

c4e194747d9a268ff56ac1f0708745cbcc164751dcaa24f1a5a15acbe9c4d998

a85ce7dde7f83f116436adbdaa8e782e3af0f0ce87ec6534ec7b8ea83bb33eed

0aee700463efe5155d816b0f4d44edc9f4b4579156159b361d1f663b4143c4fd

65e2dbe5c6b670f663d93fd65608470091a231803b4f449bb00e99ebf76eddb7

Detection Query 1 :

domainname like "https://ppt1.sgp1.vultrobjects.com/myvideo.mp4" or url like "https://ppt1.sgp1.vultrobjects.com/myvideo.mp4" or siteurl like "https://ppt1.sgp1.vultrobjects.com/myvideo.mp4" or domainname like "https://sgp1.vultrobjects.com/jttrepijgdb/Artificial%20intelligence.pptx" or url like "https://sgp1.vultrobjects.com/jttrepijgdb/Artificial%20intelligence.pptx" or siteurl like "https://sgp1.vultrobjects.com/jttrepijgdb/Artificial%20intelligence.pptx" or domainname like "https://micbucket.ams1.vultrobjects.com/Exclude/Telegram.exe" or url like "https://micbucket.ams1.vultrobjects.com/Exclude/Telegram.exe" or siteurl like "https://micbucket.ams1.vultrobjects.com/Exclude/Telegram.exe" or domainname like "https://sgp1.vultrobjects.com/jttrepijgdb/efg_d4.zip" or url like "https://sgp1.vultrobjects.com/jttrepijgdb/efg_d4.zip" or siteurl like "https://sgp1.vultrobjects.com/jttrepijgdb/efg_d4.zip" or domainname like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_17.zip" or url like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_17.zip" or siteurl like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_17.zip" or domainname like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_def7.zip" or url like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_def7.zip" or siteurl like "https://ppt1.sgp1.vultrobjects.com/RuntimeSSH_def7.zip" or domainname like "https://ams1.vultrobjects.com/micbucket/Temp/0412.mp4" or url like "https://ams1.vultrobjects.com/micbucket/Temp/0412.mp4" or siteurl like "https://ams1.vultrobjects.com/micbucket/Temp/0412.mp4" or domainname like "https://sgp1.vultrobjects.com/downloads/pictory/Pictory_premium_ver9.0.4.exe" or url like "https://sgp1.vultrobjects.com/downloads/pictory/Pictory_premium_ver9.0.4.exe" or siteurl like "https://sgp1.vultrobjects.com/downloads/pictory/Pictory_premium_ver9.0.4.exe"

Detection Query 2 :

md5hash IN ("16602375fc2dae1eb54580ab7eda6567","42215c1fb55d945b4d2a0bb188ca4dcf","1d947084fdf25e07ec8bcdaf0cec508a","5f3271ba8840be547b1f3a42ea28ebe0","66fd60d03613decacc3c42d94dd9aab8","87f7d0b30f7905d282fb464f5ad6c6cf","4dd0cbdad60e65fb8cd6999bd9359444","7d3cce1f9dbaed585b61e6e903d69b9b","5507a3e71aade582dd226b63b1930c56","0a656287defcbd8a9c47385b805993df","e51ff37fb431767dcdec0b5e6d2a786a","a3394ef7ffa7e88b2e7efaee4617fe04","26892452f724581530c45287c8b7bc67","b3c1a3eebefafe1346c6a864b5423182","4dcfa4317f2111109cd41f457541ed2b","ca65cc67247d0702ca34eb7b06873bec","7e23ffadb664b0e53d821478a249d84c","cbe1743e9aebd3e3002b2b005deb332c","8e9e81d1b252d7fa99579e9cf2e4b4ba","94779909cc510194900c3cc17d1194c8","1e6b601f733bc40eaa58916986bfc5b9","602174f6e691d6845ac645b68f1f2538","fefaefbf09841cef739d090305edc7a4","b2f6f40570ac9085b5463fdb623560de","14698d3a03216daa2cf6f39e4f1c4031","6cae314ddcd821dd2a60dff1fa02460a","b66bd18de204d405500dc079876b7cbf","d9418fb432631021a15fb896b365d608","c8aeca21d10f6bbb78e1f2a67d78fcad","970fc0fcf3bc5a933d10e8413536f27f","a1ca53f09b0c6fe3b3b57b5202192d60","d6756063230136f8c55ae27f1a4b0112","be98163e7fea224af382a2251252ce4d","B9086413E7B6A0C6A11C25D14C22615F","7402F2F9263782A4C469570035843510","EBDD9595B79B39F53909D862499DBC94","F8B5554808428291ACC65D1FD2EFE01C","481C5B5E69A08C3DF206C59FD8DDC0DC","2965817D063F1E8F9889F9126443D631","D70EBF20E3D697897BAD5BEBF72EA271","3E7A2FCEF1D038D05B20148C573A6499")

Detection Query 3 :

sha1hash IN ("ac5939a17ec6455b6b7ae0f04c5b71b1db0d00c5","8c6b6236420c876989af36e3a9e648a00f3000c9","9108466c98df01033371483a789a0c23372c52f2","7ee579a1fa697f66d80103a867cf706f67bba32b","ef3f7292cb2f91f9a34953b875eb018b3ef889d2","33e9e5463c12c0a21a7ab37fb7496ab2c5c40bb4","87dcba4957396a9e594ed1d133bc115315763002","5d3cde9f6971ec35431cbb113b6b4bc292ea5db0","704119320f7ed10dc7707833218468d455d3c5fd","6dd639542464a647e3816af896fb1320aff64ba5","ba3874ca96f9bca1daff22ef49ea7505d52b40d4","2b11bccdea89d428610c15bea1fba417ab8681a6","f269488e2128128f234ee2e996489317bfa4720b","2fa0eb74f8a527d938f8538d66bcdebcc9771527","53d41445e176bf53c5acd2dad533eda612b05855","6d9817f5066be757f5f09b067a80fed3cfe280f6","0190940243f6535f51d43edafac943d493159e14","4a2658c66f3aeabdb05f56ba88d587683319ce6d","168caccbe59473091aa4fbbebba6257aed17985e","292887ea4406fce26773992af0bd7dc34951aa84","88a8d118ee190ac36cf684c2992f6ddd2dda517b","fec45095576d13a20a6d42096fcadc2d8f6dddd8","44068866546ffea6ef8ab8a639c2151b13f9fd6e","5f899031ec31431ff0f5fcaf4ccf5cd9484b2066","3549f6df9c14b70d2308b7b12033218e77fe1dc7","5dd86e22b882d52c67d274e3297694009d13fb96","ea7071abca429f28bfe629a913513c6d604771f4","9391928e5163ff791c1b4bc535f4ac92510810a6","0fe3cf4cabadedb382b0833dcb6ba74db3242022","6fcf829720f425f81a6b35ac5f05fa94775429eb","43d9af0c411110905ab4ddf4e4f713101c74d9de","88816b1262eaf819edebb93dc883b3082cc64c34")

Detection Query 4 :

sha256hash IN ("d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e","3f1313c813e51edf5734d9fb99eb93d6c3aa6c309e3f0a6a4878291c5b2ec73b","067d93741bcab16810ef15c11941245229519470dc7b24793dd1d3a7addacaae","c4e194747d9a268ff56ac1f0708745cbcc164751dcaa24f1a5a15acbe9c4d998","c9e5cbc98e91aa35a260a1f85d7a5605dc7aa8d2d0b71eb6f063147d4dfa1b5f","d40d730bcfa4cc7f1ee070f6ce863b03acb81af0a4d66feaec285e1205258b35","8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd","4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405","6ddd145622cde2d2f91dace7e1f7edef22f4d49d3645fa9ad4bdb772829c30bf","bb56792212abe160fff643631fb69b2081601e6310fc6669fd9d52d690ec1903","0d74156089292eee308017c8e8a7550739ecb6149ff379810f7c54b1dbaabc91","58fb875fedf57055c3fedf59fdedb9ebffbf452a0f7f21608abb069cc13effb9","5380ffda12f97cf4d8e0fe02e0580aa1a48b4b6da95e7f8a30029ad125c51b3f","886d04b78017f721ed458158e3c31300cb7f9d512481a50f21461711438e1c5e","7477f4f25d1cfc3dfb1267e35ab4bcf0b30b8c7ec9677a8d1849ee7d17bc15aa","ec9d3e32a4e78f8cc9581f5cf030f0594debee1ce67d2d0759aff3ec1c720b35","8ad63d4d30cd28391318e26f4e9464f302b0a12675a721967d4f2173ed6cfe8a","65e2dbe5c6b670f663d93fd65608470091a231803b4f449bb00e99ebf76eddb7","3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81","2640fc95373dd299cc61966c2df5ba9e013280ee02944d11bb4d1f70ee57aa30","a85ce7dde7f83f116436adbdaa8e782e3af0f0ce87ec6534ec7b8ea83bb33eed","0aee700463efe5155d816b0f4d44edc9f4b4579156159b361d1f663b4143c4fd","844108a626c15395059efa355a66c8462af0c822d8219b35b6038d9d42dcf61d","e9d2e4e8fac6420ca3b3a3a63a3d313dcfb236a24a11889d6923dd9b42a777d4","2deeeda412c40ad515dca940916a376d187219ed09ed697b4be4879b7091ec53","47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4","4a3aa8f4f0eb37be9778fbdf0b7dd282fc407557da61735d2ae9cfc73ee2aa81","e8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc","ffceb438127725a6a664aba5021f7625bd8c22b3f76447de91b728839136c9c3","cbe9e32393529cd79e19a639a1d2da93fba06082be2bdb0c04241f269f98c773","138a4c9cd617912c2269fae64b6b12d57e926a36c2c62f25ee05a32cdf102212","65359388b49ae2a982111ebe8ac837d0f3294ceab7a712df20d0f6c19bf3029e","b0308c91a56209222b178e7099ee03a7b0d06a0e473f042fb2d3c144a07484fa")