/* CAT(1) */

I've been continuing to work on tracking the MAN1 group's deployment of Hancitor/H1N1 documents and have analzyed/ran all samples I have access to for August/September (37,283) through my decryptor, along with a handful of additional scripts, to build a massive file of meta-data and IoC's. I wanted to release it to the public so I've put it on $dayjob's GitHub.

The main CSV fields map to the below:

"sha256","P2","P3","P3PAY","P1","P1HEAD","P4","P1ADD","P1XOR","P2FILEVER","P3URLS","P1SIZE","P2FILEDESC","P4PAY","P1MAGIC","P2COMPNAME","DATE","P1ORIGNAME","P2PRODNAME","P1COMPNAME","YARA","P1FILEDESC","P3XOR","P1INTNAME","P4URLS","P1COPY","P2INTNAME","P1B64","P1URLS","P1PRODNAME","P2URLS","P1PAY","P2XOR","P1FILEVER","P2COPY","P2ORIGNAME",”P2PAY"

For the most part the fields correlate to the various stages of my decryptor. The PE related meta-fields are extracted from the embedded payloads once I've ripped them out.

Below are a few excerpts of the data...

hxxp://21naillounge.com/wp-includes/Requests/Exception/Transport/ls.exe hxxp://andmabi.com/ls/gate.php hxxp://andrutoffa.com/ls4/gate.php hxxp://arrysiet.ru/ls5/gate.php hxxp://atsinrobevent.ru/ls4/gate.php hxxp://bettitotuld.com/ls3/gate.php hxxp://bongants.com/wp-content/themes/sketch/tmp.exe hxxp://bureugut.ru/ls5/gate.php hxxp://busofketper.com/ls4/gate.php hxxp://callereb.com/ls/gate.php hxxp://cediac.mobi/wp-content/plugins/diacce-albums-plugin/images/ls.exe hxxp://covemotert.ru/ls4/gate.php hxxp://dafiutrat.ru/ls3/gate.php hxxp://dingtalhedtuse.com/ls4/gate.php hxxp://evengwafiot.ru/h/gate.php hxxp://eventhedtsiar.com/ls5/gate.php hxxp://eventtorshendint.ru/ls3/gate.php hxxp://fehisresro.com/ls5/gate.php hxxp://fejusttold.ru/ls/gate.php hxxp://fofaarty.ru/ls5/gate.php hxxp://gamefoheck.ru/ls5/gate.php hxxp://gewilaningrec.ru/ls4/gate.php hxxp://goldencaribootours.com/modules/mod_superfishmenu/tmpl/js/ls.exe hxxp://hecksafaor.com/h/gate.php hxxp://helahatun.com/ls3/gate.php hxxp://henenverfort.ru/ls4/gate.php hxxp://hersmabeand.com/ls5/gate.php hxxp://hinhenharre.ru/ls3/gate.php hxxp://hinromfor.com/ls/gate.php hxxp://howrighhehat.ru/ls/gate.php hxxp://idmuchatbut.ru/ls3/gate.php hxxp://joeventinve.ru/h/gate.php hxxp://johnhowkette.com/ls5/gate.php hxxp://johntotrepwron.com/ls4/gate.php hxxp://kinperileft.ru/h/gate.php hxxp://kinperileft.ru/ls4/gate.php hxxp://lacninghanar.com/ls/gate.php hxxp://latotrepma.ru/ls4/gate.php hxxp://mianingrabted.ru/h/gate.php hxxp://michanic.ru/lbozjd/shabs/tmp.exe hxxp://muchidonhen.ru/ls5/gate.php hxxp://mywassnoaning.ru/ls/gate.php hxxp://noruromin.com/ls3/gate.php hxxp://onehepherthin.ru/h/gate.php hxxp://onehepherthin.ru/ls6/gate.php hxxp://onketorsco.com/ls3/gate.php hxxp://opweb.xyz/modules/mod_ariimageslidersa/tmp.exe hxxp://otinrofha.ru/ls4/gate.php hxxp://perunkehem.ru/ls4/gate.php hxxp://prettynailsfl.com/profiles/testing/modules/drupal_system_listing_incompatible_test/ls.exe hxxp://qualyandco.com/wp-content/themes/qualy-co/tmp.exe hxxp://rantertinhe.ru/h/gate.php hxxp://redidfe.ru/ls/gate.php hxxp://resrebsedrol.ru/ls4/gate.php hxxp://rinwasceand.ru/ls4/gate.php hxxp://ritbotohem.ru/h/gate.php hxxp://ritbotohem.ru/ls4/gate.php hxxp://robinfortfa.com/h/gate.php hxxp://romarbe.ru/ls/gate.php hxxp://romorlittbet.com/ls4/gate.php hxxp://roprinromrow.ru/ls3/gate.php hxxp://rusinhoun.ru/ls5/gate.php hxxp://saherresot.ru/ls5/gate.php hxxp://sandrikedot.ru/ls5/gate.php hxxp://sarowrebted.ru/h/gate.php hxxp://shaheenoman.com/plugins/editors/tinymce/fields/ls.exe hxxp://sincyhespar.ru/ls5/gate.php hxxp://sinsedmuchor.com/ls4/gate.php hxxp://sohenlega.ru/h/gate.php hxxp://sohenlega.ru/ls6/gate.php hxxp://sonotsandthat.ru/ls4/gate.php hxxp://sorolgoteveng.com/h/gate.php hxxp://supketwron.ru/ls/gate.php hxxp://tafajohnet.ru/ls4/gate.php hxxp://tefaverrol.ru/ls3/gate.php hxxp://thehentoftbet.ru/ls4/gate.php hxxp://thetrocotof.ru/ls4/gate.php hxxp://tingapeper.ru/ls5/gate.php hxxp://tonslacsotont.ru/ls3/gate.php hxxp://torinverwa.ru/h/gate.php hxxp://torsketronand.ru/ls4/gate.php hxxp://totrovefort.ru/ls4/gate.php hxxp://totwoveret.com/ls4/gate.php hxxp://tyatmorow.com/ls6/gate.php hxxp://ughlittrinthe.ru/ls3/gate.php hxxp://ughtontrofhe.com/ls5/gate.php hxxp://undwohed.ru/ls/gate.php hxxp://utthettorssed.com/ls4/gate.php hxxp://vetomoof.ru/h/gate.php hxxp://wassrefrightons.ru/h/gate.php hxxp://wilthetedot.com/h/gate.php hxxp://wilthetedot.com/ls4/gate.php hxxp://witjono.ru/ls/gate.php hxxp://witruterred.ru/ls4/gate.php hxxp://wotalhedron.com/h/gate.php hxxp://www.sacacademy.com/images/design/prettyPhoto/dark_rounded/tmp.exe

A large chunk of the registered domains correlate back to Marek (who has been blogged about previously).

Name | Email | Country | State | City | Street | Telephone | Organization Marek Kazuewsky | marekkazuewsky@gazeta.pl | poland | mazowieckie | warszawa | Tamka str, 6 fl 41 | 3513129795033 | NA

The company names in the PE meta showed a pretty clear pattern as well. The number proceeding the name are the number of samples that had it.

27097 SynapticosSoft, Corporation. 1502 SynSoft, Corporation. 1478 BonsSofts 677 Synaptoft, Corporation. 365 Syft, Corporation. 362 SySoft, Corporation. 307 *FontsSofts 192 SicosSoft, Corporation. 106 &BonsSoft 69 SycosSoft, Corporation. 60 SynicoSoft, Corporation. 50 BonsSoft 36 SynaosSoft, Corporation. 32 SynosSoft, Corporation. 31 SosSoft, Corporation. 28 SynapsSoft, Corporation. 26 *BonsSofts 19 SynticSoft, Corporation. 19 SynaptisSoft, Corporation. 19 SynacosSoft, Corporation. 19 SynaSoft, Corporation. 19 FontsSofts 18 SynasSoft, Corporation. 17 SypticSoft, Corporation. 12 OlieSoftWare 11 SynapcosSoft, Corporation. 10 SynaptsSoft, Corporation. 9 ^VolSoft 8 SyssesSoft, Corporation. 8 SynicSoft, Corporation. 8 SyicosSoft, Corporation. 7 SynaposSoft, Corporation. 6 Synoft, Corporation. 6 SoftMarket 6 &VolSoft& 6 VolSoft. 5 Synapqoft, Corporation. 5 %VolSoft 3 GolSoft 2 ^GolSoft 1 SynicosSoft, Corporation. 1 Synapoft, Corporation. 1 QQQ&AlinSoft 1 HHH&AlinSoft

Example tracking campaigns by XOR keys in the 2nd stage with this data.

Another example using the data to track when the MAN1 group has shifted their API calls in the Microsoft Word Documents.

If the research proves useful to you, or you need clarification, just drop me a line.




Older posts...