UAT-10147 Deploys SPECTRE: A Cross-Platform Implant with Linux Rootkit and BYOVD Capabilities

Domains/Urls

https://js.jyzyps.com/js/vnnb.js

https://js.jyzyps.com/js/nb.js

http://vn.mma888.cc/

http://thceshi.healthsave.net

http://www.xxxx.vip

http://spider.xxxx.com

vip8888vn.xyz

b.niupilao.vip

vip.niupilao.vip

udvyiwvfs.cyou

IP Address

27.124.2.46

27.124.2.48

27.124.2.52

139.180.197.150

Hash

008f28989917a9712657de5675fc024b65cb27536734e9b54ea6c3af00ea70f2

11ccfdfb0dfe782ba0eeabaa8e65619a792f9258476a072b774ef19a5240b944

1c2edfb1b280fdc570591c88da5b1adbd249be6b8cc306a42525a515adaf73e8

21274d668e28b01172fa326f42e396b825708ddc2336ae388d6729627c525775

43124b72616ef38b0c8a07b167e971b0e4479626fb5ef2303b2ed993e21f6c4c

50d88f3d8f91f18195f1e9948cf6b47d69d7e19226957b1e7e3b2e4bd7c4fef4

59a386b75b84f137c4e17c37e3430fc93c0184102b3fbdfe649cef2e0335d85b

684e7ed556dcc9e2fe24fcfd73e6b9c29d7126584f87c5331c2607d39e29329f

76df454fe87620dd59efb483a56a8b573c7d16207635cf2616a67e25dab57779

77cce6576f93961651133b543948ea3853cc2f06b8c3fd523f6858d6d18ad775

830c6ca21a7da0eed436f8371c8a86baa62ab857a5478a222dd3189645d4d084

91d00ca46d1013c031aa8ff2e54b7b3496bac78f6147842766bffd4d32a2e042

7565a5bc56fcd94c7f52cf7428747cd4f52d0d3b485900d3d9b06b470ccba23b

b74beab9dac9ee7853b5e846eec6f778db01867b49f64d6be259ea9e19006121

bfbd1aa2c0ace1575e86dc5cedc0754e4ae4aae97e70ac9f0523a2e8e8b22ed9

c88dab534081650d5a385f9bc5c61eced41b4e9fe63ace6173aa536c4aaffa67

cf0a6353f1fccf63fca02ed41eafd3da8d55f77b8b4c45666a37fa3cdc33da55

41f1514ad52c870bc4b51291cb939067e8ace23ec308419253ee0a2497bf2e21

dd4c16c65513c3eb66691f87d5bb5595d38554395ec89be2b9e325e013ef53d5

dee976f262498184d746cc8305cc9e6905ad762c661df8d7daec120f14060b41

2e9f10f5cc9fb5c9f935ee78a21de70168e398b7a47db54373a5dcb19c485398

e315f955a9b44a9c875d2e47f2a91e9e77043bd553ad616ada38eaf669d44b2e

58725b8e592435026928c39622f41b7ad4f4dc62e353eb459c3b4858eafd9e82

544a7d9d4de3904ad35e6cc87f34cb556fda722c3d3cae1a6334645f1a950cc7

9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28

722bd55e1496cb614f4f365a4203da6166c637f2c6b9ec0da3844637bc6e9e9d

0345406e85aa7759c0af0372c23de0c5f3e9b6d53e970405e5c168f55c51a7e0

23a7adda56e2e5519e01f57f16f99e4be611aac4fa908f2ee2d99e3d96e14865

9619259c1ea9b1c6b8279fdb761018b14a41acc94f67f1469bf68bf393b4ba74

f07d869ddd17d4359e26da43574d0d07987b500a390196b72b3c1747a4cbb3bf

d0da3be9de8e7068a65247b8195d73e88f454820e13c1de62675e1f845d6fabf

0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036

35c960bda30ceeb22216fad7776b43ecf44aaccf2ff7f600f91a1afb49a8a43c

7172ebfb4e96e3b0bff59e87f670c5512144d445b276746c8c78593272720ebf

b02664c71d1a40760ff6eb253d1a9022d93262698d528d95e8983bf848b8827b

dbe956ae1135e81ae06220393ee80caacc62006295a1fb26e87f048a7a78b81b

4bbba075f56ee15760b1397100a82f2c7425b866cf1a35684fda5b712783f97b

1c70b2a55b6f3a3382f40fe15293b609d047103b0c6c7da0049f7c0e365ea880

fc54b68f0a375600c8ab23d894b56837db287b32209c0a455fb439a780593c80

b0c1c3b806a60807854173f2199ba49baf5c2729051b14e4725cb90cfc755519

089b19f7760a53272f580432460dc959cbb8ffb87bde43152795ff5d893debdd

1fc83b41d201bfbc4db94e332e0c770be9d74591d9817c1b938ccdf17c7a48a9

fea09e46f6adf23aa17c56faa14d19168b5417ed90d7b2b36f2c8dd5f6014ea7

061b765659bf24b62d242d4f8ca9a9884037e186714517509a8f48b54e1123a0

Detection Query 1 :

domainname like "vip8888vn.xyz" or url like "vip8888vn.xyz" or siteurl like "vip8888vn.xyz" or domainname like "http://spider.xxxx.com" or url like "http://spider.xxxx.com" or siteurl like "http://spider.xxxx.com" or domainname like "b.niupilao.vip" or url like "b.niupilao.vip" or siteurl like "b.niupilao.vip" or domainname like "https://js.jyzyps.com/js/vnnb.js" or url like "https://js.jyzyps.com/js/vnnb.js" or siteurl like "https://js.jyzyps.com/js/vnnb.js" or domainname like "http://vn.mma888.cc/" or url like "http://vn.mma888.cc/" or siteurl like "http://vn.mma888.cc/" or domainname like "https://js.jyzyps.com/js/nb.js" or url like "https://js.jyzyps.com/js/nb.js" or siteurl like "https://js.jyzyps.com/js/nb.js" or domainname like "http://www.xxxx.vip" or url like "http://www.xxxx.vip" or siteurl like "http://www.xxxx.vip" or domainname like "udvyiwvfs.cyou" or url like "udvyiwvfs.cyou" or siteurl like "udvyiwvfs.cyou" or domainname like "http://thceshi.healthsave.net" or url like "http://thceshi.healthsave.net" or siteurl like "http://thceshi.healthsave.net" or domainname like "vip.niupilao.vip" or url like "vip.niupilao.vip" or siteurl like "vip.niupilao.vip"

Detection Query 2 :

dstipaddress IN ("27.124.2.52","139.180.197.150","27.124.2.46","27.124.2.48") or srcipaddress IN ("27.124.2.52","139.180.197.150","27.124.2.46","27.124.2.48")

Detection Query 3 :

sha256hash IN ("bfbd1aa2c0ace1575e86dc5cedc0754e4ae4aae97e70ac9f0523a2e8e8b22ed9","1fc83b41d201bfbc4db94e332e0c770be9d74591d9817c1b938ccdf17c7a48a9","7172ebfb4e96e3b0bff59e87f670c5512144d445b276746c8c78593272720ebf","91d00ca46d1013c031aa8ff2e54b7b3496bac78f6147842766bffd4d32a2e042","23a7adda56e2e5519e01f57f16f99e4be611aac4fa908f2ee2d99e3d96e14865","fea09e46f6adf23aa17c56faa14d19168b5417ed90d7b2b36f2c8dd5f6014ea7","830c6ca21a7da0eed436f8371c8a86baa62ab857a5478a222dd3189645d4d084","544a7d9d4de3904ad35e6cc87f34cb556fda722c3d3cae1a6334645f1a950cc7","7565a5bc56fcd94c7f52cf7428747cd4f52d0d3b485900d3d9b06b470ccba23b","dd4c16c65513c3eb66691f87d5bb5595d38554395ec89be2b9e325e013ef53d5","11ccfdfb0dfe782ba0eeabaa8e65619a792f9258476a072b774ef19a5240b944","43124b72616ef38b0c8a07b167e971b0e4479626fb5ef2303b2ed993e21f6c4c","c88dab534081650d5a385f9bc5c61eced41b4e9fe63ace6173aa536c4aaffa67","21274d668e28b01172fa326f42e396b825708ddc2336ae388d6729627c525775","77cce6576f93961651133b543948ea3853cc2f06b8c3fd523f6858d6d18ad775","1c2edfb1b280fdc570591c88da5b1adbd249be6b8cc306a42525a515adaf73e8","58725b8e592435026928c39622f41b7ad4f4dc62e353eb459c3b4858eafd9e82","b74beab9dac9ee7853b5e846eec6f778db01867b49f64d6be259ea9e19006121","e315f955a9b44a9c875d2e47f2a91e9e77043bd553ad616ada38eaf669d44b2e","9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28","35c960bda30ceeb22216fad7776b43ecf44aaccf2ff7f600f91a1afb49a8a43c","0345406e85aa7759c0af0372c23de0c5f3e9b6d53e970405e5c168f55c51a7e0","50d88f3d8f91f18195f1e9948cf6b47d69d7e19226957b1e7e3b2e4bd7c4fef4","f07d869ddd17d4359e26da43574d0d07987b500a390196b72b3c1747a4cbb3bf","cf0a6353f1fccf63fca02ed41eafd3da8d55f77b8b4c45666a37fa3cdc33da55","9619259c1ea9b1c6b8279fdb761018b14a41acc94f67f1469bf68bf393b4ba74","76df454fe87620dd59efb483a56a8b573c7d16207635cf2616a67e25dab57779","0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036","dee976f262498184d746cc8305cc9e6905ad762c661df8d7daec120f14060b41","089b19f7760a53272f580432460dc959cbb8ffb87bde43152795ff5d893debdd","061b765659bf24b62d242d4f8ca9a9884037e186714517509a8f48b54e1123a0","41f1514ad52c870bc4b51291cb939067e8ace23ec308419253ee0a2497bf2e21","684e7ed556dcc9e2fe24fcfd73e6b9c29d7126584f87c5331c2607d39e29329f","59a386b75b84f137c4e17c37e3430fc93c0184102b3fbdfe649cef2e0335d85b","d0da3be9de8e7068a65247b8195d73e88f454820e13c1de62675e1f845d6fabf","b02664c71d1a40760ff6eb253d1a9022d93262698d528d95e8983bf848b8827b","008f28989917a9712657de5675fc024b65cb27536734e9b54ea6c3af00ea70f2","2e9f10f5cc9fb5c9f935ee78a21de70168e398b7a47db54373a5dcb19c485398","722bd55e1496cb614f4f365a4203da6166c637f2c6b9ec0da3844637bc6e9e9d","dbe956ae1135e81ae06220393ee80caacc62006295a1fb26e87f048a7a78b81b","4bbba075f56ee15760b1397100a82f2c7425b866cf1a35684fda5b712783f97b","1c70b2a55b6f3a3382f40fe15293b609d047103b0c6c7da0049f7c0e365ea880","fc54b68f0a375600c8ab23d894b56837db287b32209c0a455fb439a780593c80","b0c1c3b806a60807854173f2199ba49baf5c2729051b14e4725cb90cfc755519")