SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

Domains/URLs

www.tm-mfa.com

infrastructure.minings.blog

azure.uzrailwaystax.com

ns.panterstationary.online

pro.taustas.com

www.tmgaz-server.com

www.tojiktelecomtj.com

infoxxe.plan-mail.com

mail.plan-mail.com

ns2.asiainfo.it.com

www.wordcheck.info

ns1.wordcheck.info

help.hoster-kg.com

state.presldent.info

cert.presldent.info

check.presldent.info

chief.presldent.info

it.presldent.info

tmk.natcommunzu.com

microsoft.natcommunzu.com

storage.natcommunzu.com

support.natcommunzu.com

uz.natcommunzu.com

help.galkynysh.net

kg.cwisuz.com

www.tojiktelecomtj.com

gov.mpekz.online

normativ.dushanbeidc.org

normativ.sozandagon.org

data.yntymak-ord.com

link.ytnymak-ord.com

center.yntymak-ordo.com

azure.adm-devon.com

uz.adm-devon.com

sanly.oilgas-tm.com

mail.postmfa.com

center.infocomkg.org

kg.tdtu.org

mail.infocomkg.org

service.infocomkg.org

info.tdtu.org

ud.tdtu.org

api.hpsupporter.com

checkup.hpsupporter.com

help.hpsupporter.com

telecom.hpsupporter.com

IP Address

46.30.191.230

188.190.29.126

193.29.59.159

31.58.220.250

171.22.16.187

185.243.114.124

185.243.115.156

45.153.125.200

194.68.44.133

2.58.14.95

31.59.185.224

2.58.15.172

188.190.18.208

46.30.188.54

31.58.209.28

45.153.125.20

188.190.29.126

31.57.92.84

92.243.66.71

193.29.56.119

2.58.14.95

188.190.18.208

171.22.16.187

193.29.57.182

45.153.125.20

188.190.29.126

46.30.189.191

46.30.191.214

45.86.163.87

2.58.15.101

185.253.117.32

193.29.57.159

46.30.190.170

185.243.112.253

185.243.112.220

45.67.230.185

91.132.94.36

46.30.188.54

45.153.127.186

185.243.114.238

46.30.191.232

45.86.162.249

2.58.15.129

46.30.191.90

5.183.95.7

193.29.59.248

185.253.116.145

83.242.96.242

45.153.127.99

45.86.162.141

192.121.87.172

193.29.58.217

195.88.191.70

45.153.127.38

195.88.191.250

5.183.95.49

194.14.217.199

Hash

9297D5FD21EF21B16F5880CD4FAEA2AD1FB9EE39

Detection Query 1 :

domainname like "chief.presldent.info" or url like "chief.presldent.info" or siteurl like "chief.presldent.info" or domainname like "info.tdtu.org" or url like "info.tdtu.org" or siteurl like "info.tdtu.org" or domainname like "help.hoster-kg.com" or url like "help.hoster-kg.com" or siteurl like "help.hoster-kg.com" or domainname like "help.hpsupporter.com" or url like "help.hpsupporter.com" or siteurl like "help.hpsupporter.com" or domainname like "azure.uzrailwaystax.com" or url like "azure.uzrailwaystax.com" or siteurl like "azure.uzrailwaystax.com" or domainname like "cert.presldent.info" or url like "cert.presldent.info" or siteurl like "cert.presldent.info" or domainname like "microsoft.natcommunzu.com" or url like "microsoft.natcommunzu.com" or siteurl like "microsoft.natcommunzu.com" or domainname like "check.presldent.info" or url like "check.presldent.info" or siteurl like "check.presldent.info" or domainname like "ns.panterstationary.online" or url like "ns.panterstationary.online" or siteurl like "ns.panterstationary.online" or domainname like "pro.taustas.com" or url like "pro.taustas.com" or siteurl like "pro.taustas.com" or domainname like "telecom.hpsupporter.com" or url like "telecom.hpsupporter.com" or siteurl like "telecom.hpsupporter.com" or domainname like "gov.mpekz.online" or url like "gov.mpekz.online" or siteurl like "gov.mpekz.online" or domainname like "www.tm-mfa.com" or url like "www.tm-mfa.com" or siteurl like "www.tm-mfa.com" or domainname like "www.tmgaz-server.com" or url like "www.tmgaz-server.com" or siteurl like "www.tmgaz-server.com" or domainname like "link.ytnymak-ord.com" or url like "link.ytnymak-ord.com" or siteurl like "link.ytnymak-ord.com" or domainname like "kg.tdtu.org" or url like "kg.tdtu.org" or siteurl like "kg.tdtu.org" or domainname like "mail.infocomkg.org" or url like "mail.infocomkg.org" or siteurl like "mail.infocomkg.org" or domainname like "normativ.sozandagon.org" or url like "normativ.sozandagon.org" or siteurl like "normativ.sozandagon.org" or domainname like "mail.plan-mail.com" or url like "mail.plan-mail.com" or siteurl like "mail.plan-mail.com" or domainname like "center.yntymak-ordo.com" or url like "center.yntymak-ordo.com" or siteurl like "center.yntymak-ordo.com" or domainname like "azure.adm-devon.com" or url like "azure.adm-devon.com" or siteurl like "azure.adm-devon.com" or domainname like "kg.cwisuz.com" or url like "kg.cwisuz.com" or siteurl like "kg.cwisuz.com" or domainname like "infrastructure.minings.blog" or url like "infrastructure.minings.blog" or siteurl like "infrastructure.minings.blog" or domainname like "storage.natcommunzu.com" or url like "storage.natcommunzu.com" or siteurl like "storage.natcommunzu.com" or domainname like "checkup.hpsupporter.com" or url like "checkup.hpsupporter.com" or siteurl like "checkup.hpsupporter.com" or domainname like "www.tojiktelecomtj.com" or url like "www.tojiktelecomtj.com" or siteurl like "www.tojiktelecomtj.com" or domainname like "infoxxe.plan-mail.com" or url like "infoxxe.plan-mail.com" or siteurl like "infoxxe.plan-mail.com" or domainname like "service.infocomkg.org" or url like "service.infocomkg.org" or siteurl like "service.infocomkg.org" or domainname like "support.natcommunzu.com" or url like "support.natcommunzu.com" or siteurl like "support.natcommunzu.com" or domainname like "it.presldent.info" or url like "it.presldent.info" or siteurl like "it.presldent.info" or domainname like "uz.natcommunzu.com" or url like "uz.natcommunzu.com" or siteurl like "uz.natcommunzu.com" or domainname like "help.galkynysh.net" or url like "help.galkynysh.net" or siteurl like "help.galkynysh.net" or domainname like "tmk.natcommunzu.com" or url like "tmk.natcommunzu.com" or siteurl like "tmk.natcommunzu.com" or domainname like "data.yntymak-ord.com" or url like "data.yntymak-ord.com" or siteurl like "data.yntymak-ord.com" or domainname like "center.infocomkg.org" or url like "center.infocomkg.org" or siteurl like "center.infocomkg.org" or domainname like "uz.adm-devon.com" or url like "uz.adm-devon.com" or siteurl like "uz.adm-devon.com" or domainname like "api.hpsupporter.com" or url like "api.hpsupporter.com" or siteurl like "api.hpsupporter.com" or domainname like "mail.postmfa.com" or url like "mail.postmfa.com" or siteurl like "mail.postmfa.com" or domainname like "ud.tdtu.org" or url like "ud.tdtu.org" or siteurl like "ud.tdtu.org" or domainname like "normativ.dushanbeidc.org" or url like "normativ.dushanbeidc.org" or siteurl like "normativ.dushanbeidc.org" or domainname like "www.wordcheck.info" or url like "www.wordcheck.info" or siteurl like "www.wordcheck.info" or domainname like "ns1.wordcheck.info" or url like "ns1.wordcheck.info" or siteurl like "ns1.wordcheck.info" or domainname like "state.presldent.info" or url like "state.presldent.info" or siteurl like "state.presldent.info" or domainname like "sanly.oilgas-tm.com" or url like "sanly.oilgas-tm.com" or siteurl like "sanly.oilgas-tm.com"

Detection Query 2 :

dstipaddress IN ("185.253.116.145","45.86.162.141","45.153.125.20","45.153.125.200","46.30.191.90","31.58.220.250","185.243.115.156","46.30.188.54","2.58.14.95","46.30.190.170","185.243.112.220","31.59.185.224","193.29.57.182","185.253.117.32","45.67.230.185","185.243.114.238","83.242.96.242","193.29.56.119","188.190.18.208","188.190.29.126","46.30.191.230","46.30.189.191","194.68.44.133","31.58.209.28","193.29.59.248","195.88.191.250","2.58.15.172","185.243.112.253","92.243.66.71","31.57.92.84","45.86.162.249","2.58.15.129","171.22.16.187","46.30.191.214","45.153.127.99","45.153.127.186","193.29.58.217","195.88.191.70","5.183.95.49","194.14.217.199","185.243.114.124","45.86.163.87","192.121.87.172","45.153.127.38","193.29.59.159","2.58.15.101","91.132.94.36","5.183.95.7","46.30.191.232","193.29.57.159") or srcipaddress IN ("185.253.116.145","45.86.162.141","45.153.125.20","45.153.125.200","46.30.191.90","31.58.220.250","185.243.115.156","46.30.188.54","2.58.14.95","46.30.190.170","185.243.112.220","31.59.185.224","193.29.57.182","185.253.117.32","45.67.230.185","185.243.114.238","83.242.96.242","193.29.56.119","188.190.18.208","188.190.29.126","46.30.191.230","46.30.189.191","194.68.44.133","31.58.209.28","193.29.59.248","195.88.191.250","2.58.15.172","185.243.112.253","92.243.66.71","31.57.92.84","45.86.162.249","2.58.15.129","171.22.16.187","46.30.191.214","45.153.127.99","45.153.127.186","193.29.58.217","195.88.191.70","5.183.95.49","194.14.217.199","185.243.114.124","45.86.163.87","192.121.87.172","45.153.127.38","193.29.59.159","2.58.15.101","91.132.94.36","5.183.95.7","46.30.191.232","193.29.57.159")

Detection Query 3 :

sha1hash IN ("9297D5FD21EF21B16F5880CD4FAEA2AD1FB9EE39")