Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Domains/Urls

fonts.tarotfree101.top

fonts.chrorne.com

robot.avbliud.com

microsoft-flash.com

www.wps-cn.com

www.f1ash.org.cn

browser-update.pages.dev

eastus2.wac-azure.com

mailbycloud.com

www.jkskhei.com

ns1.jkskhei.com

dns.wizkidblogger.com

r6fi2yvqql.execute-api.ap-southeast-2.amazonaws.com

http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log

https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq

https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe

https://www.f1ash.org.cn/flashcenter_pp_ax_install_cn.exe

IP Address

103.87.9.62

152.42.174.151

43.246.208.236

43.246.208.179

47.84.37.113

47.84.51.173

167.71.195.255

38.12.1.47

129.212.237.224

47.87.71.167

47.250.208.35

219.76.254.184

Hash

e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf

01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a

e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34

f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8

e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530

e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb

09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff

c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42cc

b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e

0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3

153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94e

297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561

30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61d

430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55

5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97ef

5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7ac

6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2

97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aad

ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813

e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0

ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877

ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869

Detection Query 1 :

domainname like "robot.avbliud.com" or url like "robot.avbliud.com" or siteurl like "robot.avbliud.com" or domainname like "eastus2.wac-azure.com" or url like "eastus2.wac-azure.com" or siteurl like "eastus2.wac-azure.com" or domainname like "microsoft-flash.com" or url like "microsoft-flash.com" or siteurl like "microsoft-flash.com" or domainname like "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq" or url like "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq" or siteurl like "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq" or domainname like "fonts.tarotfree101.top" or url like "fonts.tarotfree101.top" or siteurl like "fonts.tarotfree101.top" or domainname like "https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or url like "https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or siteurl like "https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or domainname like "fonts.chrorne.com" or url like "fonts.chrorne.com" or siteurl like "fonts.chrorne.com" or domainname like "www.f1ash.org.cn" or url like "www.f1ash.org.cn" or siteurl like "www.f1ash.org.cn" or domainname like "ns1.jkskhei.com" or url like "ns1.jkskhei.com" or siteurl like "ns1.jkskhei.com" or domainname like "www.wps-cn.com" or url like "www.wps-cn.com" or siteurl like "www.wps-cn.com" or domainname like "dns.wizkidblogger.com" or url like "dns.wizkidblogger.com" or siteurl like "dns.wizkidblogger.com" or domainname like "www.jkskhei.com" or url like "www.jkskhei.com" or siteurl like "www.jkskhei.com" or domainname like "https://www.f1ash.org.cn/flashcenter_pp_ax_install_cn.exe" or url like "https://www.f1ash.org.cn/flashcenter_pp_ax_install_cn.exe" or siteurl like "https://www.f1ash.org.cn/flashcenter_pp_ax_install_cn.exe" or domainname like "browser-update.pages.dev" or url like "browser-update.pages.dev" or siteurl like "browser-update.pages.dev" or domainname like "r6fi2yvqql.execute-api.ap-southeast-2.amazonaws.com" or url like "r6fi2yvqql.execute-api.ap-southeast-2.amazonaws.com" or siteurl like "r6fi2yvqql.execute-api.ap-southeast-2.amazonaws.com" or domainname like "mailbycloud.com" or url like "mailbycloud.com" or siteurl like "mailbycloud.com" or domainname like "http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log" or url like "http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log" or siteurl like "http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log"

Detection Query 2 :

dstipaddress IN ("43.246.208.236","47.87.71.167","219.76.254.184","47.250.208.35","47.84.51.173","167.71.195.255","152.42.174.151","43.246.208.179","38.12.1.47","129.212.237.224","47.84.37.113","103.87.9.62") or srcipaddress IN ("43.246.208.236","47.87.71.167","219.76.254.184","47.250.208.35","47.84.51.173","167.71.195.255","152.42.174.151","43.246.208.179","38.12.1.47","129.212.237.224","47.84.37.113","103.87.9.62")

Detection Query 3 :

sha256hash IN ("0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd","01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a","ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877","b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e","e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34","f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8","e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb","9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3","ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813","e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530","09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42cc","e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf","153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94e","297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561","30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61d","430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55","5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97ef","5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7ac","6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2","97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aad","e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0","ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869")