North Korean Remote Access Trojan: BLINDINGCAN

2020-08-19 USCISA

https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a

Thumbnail for North Korean Remote Access Trojan: BLINDINGCAN

This campaign utilized compromised infrastructure from multiple countries to host its command and control (C2) infrastructure and distribute implants to a victim's system. Government partners, DHS and FBI identified Remote Access Trojan (RAT) malware variants used by the North Korean government. This Malware Analysis Report (MAR) is the result of analytic efforts between Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation.

Indicators of Compromise

Type Value First Seen Last Seen
HASH e7aa0237fc3db67a96ebd877806a2c88 2020-08-19 2025-08-13
HASH 56470e113479eacda081c2eeead153bf 2020-08-19 2023-04-12
URL https://www.automercado.co.cr/e… 2020-08-19 2021-02-25
URL https://www.curiofirenze.com/in… 2020-08-19 2021-02-25
DOMAIN curiofirenze.com 2019-11-05 2021-02-25
HASH b70e66d387e42f5f04b69b9eb153060… 2020-08-19 2020-12-15
HASH 58027c80c6502327863ddca28c31d35… 2020-08-19 2020-09-29
YARA CISA_10295134_01 2020-08-19 2020-08-19
YARA CISA_10135536_06 2020-08-19 2020-08-19
HASH 70b01a5a98c1febe2bde96c9270957c3 2020-08-19 2020-08-19
HASH 7d507281e2e21476ff1af492ad9f574… 2020-08-19 2020-08-19
HASH bbdf7f1c6cfdab4beb23ae1f5e5e8e3f 2020-08-19 2020-08-19
HASH 0a93a2ad9833deb5581854bc11c7fcb7 2020-08-19 2020-08-19
HASH 7e564082b35201e421694b4ecea4ed0a 2020-08-19 2020-08-19
HASH 7dce6f30e974ed97a3ed024d4c62350… 2020-08-19 2020-08-19
HASH 61de5945f98a8652eaf4ae5b93b41128 2020-08-19 2020-08-19
HASH 18cfd7e01da5d30a27a885164d5a7b9b 2020-08-19 2020-08-19
HASH 75588d29242e426f361ddcf8c53954f5 2020-08-19 2020-08-19
HASH a0605f0296280e16d350cf78eb70a0d3 2020-08-19 2020-08-19
HASH 71170f767f99b3b8e8fb41eb4ca505b9 2020-08-19 2020-08-19
HASH 920679e3a916eba5c0309f6381f49d76 2020-08-19 2020-08-19
HASH bddf350b1495019b036eb25682895735 2020-08-19 2020-08-19
HASH 78a65874b49922217fd0423cc6293a2… 2020-08-19 2020-08-19
HASH d742ba8cf5b24affdf77bc6869da0dc5 2020-08-19 2020-08-19
HASH c627db421adaaa320d3ac42396c89f8a 2020-08-19 2020-08-19
HASH 9a33838895830247744985365b8b2948 2020-08-19 2020-08-19
HASH f71d67659baf0569143874d5d1c5a4d… 2020-08-19 2020-08-19
HASH 99d34a0fcb234b3aed2a92fc7101b9f5 2020-08-19 2020-08-19
HASH 58c4168b836758e380e64f12eca00760 2020-08-19 2020-08-19
HASH 8b53b519623b56ab746fdaf14d3eb40… 2020-08-19 2020-08-19
HASH 4de4bb5980c9ffde6d9809bca8589667 2020-08-19 2020-08-19
HASH c7b7bc3bf34654bd45c303561f9359e1 2020-08-19 2020-08-19
HASH 0d6201e58760b130181228a80ca4a775 2020-08-19 2020-08-19
HASH c2c5751cdfdbe9fac44337d4cb6e74e4 2020-08-19 2020-08-19
HASH 2cc742e33c53aeb638e9798422f8adaa 2020-08-19 2020-08-19
HASH bdfd16dc53f5c63da0b68df71c6e61b… 2020-08-19 2020-08-19
HASH aedd1ea7e39bc6c20eb7c1a31ee31945 2020-08-19 2020-08-19
HASH 2564f80bde6880569bc81d572ffd85c6 2020-08-19 2020-08-19
HASH 9feef1eed2a8a5cbfe1c6478f2740d8… 2020-08-19 2020-08-19
HASH 21c81d1a5ad5583610f1bcb7827fec54 2020-08-19 2020-08-19
HASH 6c2d15114ebdd910a336b6b147512a74 2020-08-19 2020-08-19
HASH 02678efe715ff2658c6a4c2b596046b… 2020-08-19 2020-08-19
HASH 6dead31f52ae9c89182635c7bc5363ff 2020-08-19 2020-08-19
HASH 5275449d25a64e7415c1c1e727a0af7… 2020-08-19 2020-08-19
HASH c70edfaf2c33647d531f7df76cd4e5b… 2020-08-19 2020-08-19
HASH e032dedb2f8e5a189a3a98897f1f7f92 2020-08-19 2020-08-19
HASH 4eb9a889d49c201486c6a9844c0a3861 2020-08-19 2020-08-19
HASH 3f6ef29b86bf1687013ae7638f66502… 2020-08-19 2020-08-19
HASH 80eb6e1fc17919b7444d34b73621166f 2020-08-19 2020-08-19
HASH dcf95cd96203e794724fc14e454e63f… 2020-08-19 2020-08-19
HASH ee27480742e19dfbbedf334ca52aafa5 2020-08-19 2020-08-19
HASH 96721e13bae587c75618566111675de… 2020-08-19 2020-08-19
HASH d5186efd8502a3a99a66729cb847d3f… 2020-08-19 2020-08-19
HASH 158ddb85611b4784b6f5ca7181936b8… 2020-08-19 2020-08-19
HASH b1dd2c73b3c13a147828f7bb4389d241 2020-08-19 2020-08-19
HASH 1360c7212899568e17f02f8e61db1c60 2020-08-19 2020-08-19
HASH 40c5103cd9681a2830667957f3e3d03… 2020-08-19 2020-08-19
HASH 88750685639a22c3e4bcb15f40390ff9 2020-08-19 2020-08-19
HASH 0685a556cdaa359c306b3c7830fc6f1e 2020-08-19 2020-08-19
HASH 0ecc687d741c7b009c648ef0de0a5d4… 2020-08-19 2020-08-19
HASH 63d155f889e09272d85cfd9dfc266131 2020-08-19 2020-08-19
HASH 8d179113e963d81adbf8d39ceff456a… 2020-08-19 2020-08-19
HASH da2a58c7e17c14ced8b67bc462ad7427 2020-08-19 2020-08-19
HASH a1c37a2c9fedecabe570383d81bfb5d6 2020-08-19 2020-08-19
HASH 513e6f9be441b608d02560144adad488 2020-08-19 2020-08-19
HASH 7955fa7ab32773d17e0e94efeea69cf4 2020-08-19 2020-08-19
HASH 0fc12e03ee93d19003b2dd7117a66a3… 2020-08-19 2020-08-19
HASH e7718609577c6e34221b03de7e959a8c 2020-08-19 2020-08-19
HASH b87183316e04b075a0da8e286b297fdb 2020-08-19 2020-08-19
HASH ae1c3feb6a3beda4db0ce8c794af77e7 2020-08-19 2020-08-19
HASH 586d012540ed1244572906e3733a0cb… 2020-08-19 2020-08-19
HASH 1ee75106a9113b116c54e7a59549500… 2020-08-19 2020-08-19
HASH 4be9aecc0fc76c037420ece97645c6a… 2020-08-19 2020-08-19
HASH 9f1fe9ee707daa61e91ad94d618b066f 2020-08-19 2020-08-19
HASH 51741feb8529e34f47173f59abe8b19b 2020-08-19 2020-08-19
HASH 3a6b48871abbf2a1ce4c89b08bc0b7d8 2020-08-19 2020-08-19
HASH 65793cf7eaeca085293db7251eb4469a 2020-08-19 2020-08-19
HASH 97d24ac0d773f6260ab512fa496099b… 2020-08-19 2020-08-19
HASH 61e11f8acaaf9d065546a237ced1e964 2020-08-19 2020-08-19
HASH 20ee5fdc9589067a7a312d6f660f0c8… 2020-08-19 2020-08-19
HASH a2b361aa5b6f2d5912845d84ca96a368 2020-08-19 2020-08-19
HASH c139714dd00b81eb08ecaf32bdced254 2020-08-19 2020-08-19
HASH 6cea7290883f0527dbd3e2df64462684 2020-08-19 2020-08-19
HASH f9e6c35dbb62101498ec755152a8a67b 2020-08-19 2020-08-19
HASH af2479dbb1f93be4fc4a092cbbd4df85 2020-08-19 2020-08-19
HASH 6066ee1e6c73fe6133738f26cf898280 2020-08-19 2020-08-19
HASH f13bc7e5f532956e1c5490d27d9b9eb0 2020-08-19 2020-08-19
HASH d40ad4cd39350d718e189adf45703eb… 2020-08-19 2020-08-19
HASH 6f329c32f228d9a4d856afd4794c7f2b 2020-08-19 2020-08-19
HASH 4f06d9f35e1f31817d4205f0cda45316 2020-08-19 2020-08-19
HASH bfbe6f46025a25810199ae50f7f7ed04 2020-08-19 2020-08-19
HASH d2e652e58f57bd6314d5ebf8f59687e9 2020-08-19 2020-08-19
HASH 0452202027da519acb3a7d074696de07 2020-08-19 2020-08-19
HASH c545b6874d37d733e970a7e884ddc2c7 2020-08-19 2020-08-19
HASH a09ee0743bee58fbe63a9a50c1d3f79b 2020-08-19 2020-08-19
HASH 5665fa000b3cd52ceae755d35ca698e… 2020-08-19 2020-08-19
HASH e83cf8a6a4b24bd5d2b8ce4364d79fa… 2020-08-19 2020-08-19
HASH 3c4d32746197a23e043dec30c3f17502 2020-08-19 2020-08-19
HASH 46abe134e48b8af335f468d25c91a1fe 2020-08-19 2020-08-19
HASH aefcd8e98a231bccbc9b2c6d578fc8f3 2020-08-19 2020-08-19
HASH 300ac7ec543fda0fab22c110a7d26281 2020-08-19 2020-08-19
HASH 531f04a4abeb58f9e10fffc6afe98250 2020-08-19 2020-08-19
EMAIL [email protected] 2020-08-19 2020-08-19
URL https://joker.com 2020-08-19 2020-08-19
URL https://www.anca-aste.it/upload… 2020-08-19 2020-08-19
URL http://www.cheapnet.it 2020-08-19 2020-08-19
URL http://www.cwnet.it 2020-08-19 2020-08-19
URL https://agarwalpropertyconsulta… 2020-08-19 2020-08-19
URL https://www.anca-aste.it/upload… 2020-08-19 2020-08-19
URL https://www.anca-aste.it/upload… 2020-08-19 2020-08-19
DOMAIN bigrock.com 2020-08-19 2020-08-19
DOMAIN ns1.x-peditenetworks.com 2020-08-19 2020-08-19
DOMAIN automercado.co 2020-08-19 2020-08-19
DOMAIN ns3.x-peditenetworks.com 2020-08-19 2020-08-19
DOMAIN ns1.bh-58.webhostbox.net 2020-08-19 2020-08-19
DOMAIN whois.bigrock.com 2020-08-19 2020-08-19
DOMAIN ns2.x-peditenetworks.com 2020-08-19 2020-08-19
DOMAIN whois.joker.com 2020-08-19 2020-08-19
DOMAIN joker.com 2020-08-19 2020-08-19
DOMAIN endurance.com 2020-08-19 2020-08-19
DOMAIN agarwalpropertyconsultants.com 2020-08-19 2020-08-19
DOMAIN ns2.bh-58.webhostbox.net 2020-08-19 2020-08-19
IPv4 54.241.91.49 2020-08-19 2020-08-19
IPv4 51.68.152.96 2020-08-19 2020-08-19
IPv4 199.79.63.24 2020-08-19 2020-08-19
IPv4 192.99.20.39 2020-08-19 2020-08-19
HASH 7933716892e0d6053057f5f2df0ccad… 2020-07-29 2020-08-19
HASH 6a3446b8a47f0ab4f536015218b2265… 2020-07-29 2020-08-19

Related Reports

« Back