仮想通貨事業者を標的にした攻撃キャンペーンに関する脅威情報のハンティング
2021-01-28 • JPCERT • Hunting for threat information regarding attack campaigns targeting virtual currency operators •
https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf
Attachments
JSAC2021_302_kodera_jp.pdf (3 MB)
The JSAC presentation explains hunting methods for threat intelligence related to cryptocurrency-business targeting campaigns, including activity affecting Japanese cryptocurrency operators. It references campaigns publicly reported by JPCERT/CC, ClearSky, and F-Secure, including Dangerous Password, CryptoCore Group, and Lazarus activity against the cryptocurrency vertical. The material describes delivery through shortened URLs, ZIP files, decoy PDF or DOCX documents, and LNK shortcut files, and argues that faster threat-information collection is needed to detect and prevent compromises.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| DOMAIN | up.digifincx.com | 2021-01-28 | 2022-01-13 |
| HASH | 5d183e8950c7fd56350d5c7edd42481… | 2020-06-24 | 2022-01-13 |
| HASH | bc64a9361f5125309c747675b5c176f… | 2020-06-24 | 2022-01-13 |
| HASH | 9ab13bfc2c60c1c15e677df76e8768e… | 2020-06-24 | 2022-01-13 |
| DOMAIN | 1driv.org | 2020-06-24 | 2021-05-24 |
| IPv4 | 103.31.249.62 | 2021-01-28 | 2021-02-01 |
| IPv4 | 45.61.139.215 | 2021-01-28 | 2021-02-01 |
| IPv4 | 103.130.195.170 | 2021-01-28 | 2021-02-01 |
| IPv4 | 84.201.189.216 | 2020-11-24 | 2021-02-01 |
| HASH | 1ea8699dc216353ba29c5d3ca7fcbca… | 2021-01-28 | 2021-01-28 |
| HASH | 0d79b66f41858a336a385a7f6cc9e4e… | 2021-01-28 | 2021-01-28 |
| HASH | 25b30145e1a6053953ad5cc236208f9… | 2021-01-28 | 2021-01-28 |
| HASH | 0edf580aa26d452ed435a68ebcbdfd6… | 2021-01-28 | 2021-01-28 |
| HASH | 92ff4894e56b666235c1433b0cc2e72… | 2021-01-28 | 2021-01-28 |
| HASH | cfbcd8b9f4e92856efd47ebcf48d78f… | 2021-01-28 | 2021-01-28 |
| HASH | 7dab46470f9e6ca4ec984b188eaad8d… | 2021-01-28 | 2021-01-28 |
| HASH | ca7e5275bf45970688d3b42424f5a13… | 2021-01-28 | 2021-01-28 |
| HASH | 1997c68e44ab32be9003ca34a4285ff… | 2021-01-28 | 2021-01-28 |
| HASH | bd91f0b64cd28ca0a76d1ae6f2958dd… | 2021-01-28 | 2021-01-28 |
| HASH | f83edae33ffd6991f07dc4c43c9eb31… | 2021-01-28 | 2021-01-28 |
| HASH | d287388e5ff978bf6f8af477460a9b7… | 2021-01-28 | 2021-01-28 |
| HASH | bbe5ae8daf7686945d8942dd2e285f3… | 2021-01-28 | 2021-01-28 |
| HASH | 3734cf8e76683834f2bdf863670262c… | 2021-01-28 | 2021-01-28 |
| HASH | ebb3a0d3e5985b73ebada12235abf1a… | 2021-01-28 | 2021-01-28 |
| HASH | d7ba33ab3f3c043e38cfa42df8c9144… | 2021-01-28 | 2021-01-28 |
| HASH | a4da4c09963be14742b1135dbbc7535… | 2021-01-28 | 2021-01-28 |
| HASH | 8d1e926a0b9fb1eecaee4bd9a8a96e0… | 2021-01-28 | 2021-01-28 |
| HASH | c64e2993563345fd497cfc382de27c7… | 2021-01-28 | 2021-01-28 |
| HASH | 517b42bd87238852a26d27c23da1053… | 2021-01-28 | 2021-01-28 |
| URL | https://jvcea.or.jp/news/main-i… | 2021-01-28 | 2021-01-28 |
| DOMAIN | shop.newsbtctech.com | 2021-01-28 | 2021-01-28 |
| DOMAIN | drop.trailads.net | 2021-01-28 | 2021-01-28 |
| IPv4 | 111.93.95.82 | 2021-01-28 | 2021-01-28 |
| IPv4 | 206.169.149.96 | 2021-01-28 | 2021-01-28 |
| IPv4 | 41.79.70.142 | 2021-01-28 | 2021-01-28 |
| IPv4 | 192.119.84.22 | 2021-01-28 | 2021-01-28 |
| IPv4 | 140.115.70.75 | 2021-01-28 | 2021-01-28 |
| IPv4 | 142.11.213.5 | 2021-01-28 | 2021-01-28 |
| IPv4 | 140.114.37.4 | 2021-01-28 | 2021-01-28 |
| HASH | c3d403b78b4f4aebf1e4b7447f39142… | 2020-11-24 | 2021-01-28 |
| HASH | 26a98b752fd8e700776f11bad4169a0… | 2020-11-24 | 2021-01-28 |
| HASH | effd76c58906877364ad6c62ff7d8d7… | 2020-11-24 | 2021-01-28 |
| HASH | 4c574c1a2b126c8a5ba1ef9560516d0… | 2020-11-24 | 2021-01-28 |
| IPv4 | 89.134.49.3 | 2020-11-24 | 2021-01-28 |
| DOMAIN | twosigmateam.info | 2020-08-18 | 2021-01-28 |
| DOMAIN | name.ownemail.me | 2020-08-18 | 2021-01-28 |
| DOMAIN | mse.theworkpc.com | 2020-08-18 | 2021-01-28 |
| HASH | 070be2bfc60d1616afb196d523f1540… | 2020-06-24 | 2021-01-28 |
| HASH | 9c3431932cdf13c6c126df26bab6025… | 2020-06-24 | 2021-01-28 |
| IPv4 | 78.94.213.101 | 2020-06-24 | 2021-01-28 |
| IPv4 | 140.117.91.22 | 2020-06-24 | 2021-01-28 |
| IPv4 | 23.254.144.139 | 2020-06-24 | 2021-01-28 |
| IPv4 | 88.204.166.59 | 2020-04-02 | 2021-01-28 |
| IPv4 | 41.85.145.164 | 2020-01-08 | 2021-01-28 |
| HASH | d70988e43ebc4981e880489b11b6c37… | 2019-07-09 | 2021-01-28 |
| HASH | 7dcbeb1806296739acfa5819872e8d9… | 2019-07-09 | 2021-01-28 |
| HASH | 901eca85c5711a53e53c48309b3afd3… | 2019-07-09 | 2021-01-28 |
| HASH | f9e299c562195513968be88c6096957… | 2019-07-09 | 2021-01-28 |
| HASH | 9b20767b11f7e54644104d455aa25c6… | 2019-07-09 | 2021-01-28 |
| HASH | 57278dab6a0e8438444996503a6528f… | 2019-07-09 | 2021-01-28 |
| HASH | 122674a261ac7061c8a304f3e4a1fb1… | 2019-07-09 | 2021-01-28 |
| DOMAIN | mdown.showprice.xyz | 2019-07-09 | 2021-01-28 |
| IPv4 | 75.133.9.84 | 2019-07-09 | 2021-01-28 |