Indicators of Compromise
APT42 Domains and URLs
DWP Phishing Equipment associated
accredit-navigation[.]on-line
hXXps://n9[.]cl/4xgro
GCollection Phishing Equipment associated
panel-short-check[.]reside
check-pabnel-status[.]reside
meetroomonlin1925.w3spaces[.]com
smaaaal[.]cfd
click-choose-figured[.]cfd
short-ion-per[.]reside
checking-paneling[.]reside
hXXps://panel-short-check[.]reside/PhyfkFQX
hXXps://check-pabnel-status[.]reside/Gcollection/Ref/CkliPwaM
hXXps://check-pabnel-status[.]reside/Gcollection/Password
hXXps://panel-short-check[.]reside/ZZqt3LYD
hXXps://check-pabnel-status[.]reside/Lcollection/Ref/F53OQQkE
hXXps://check-pabnel-status[.]reside/Lcollection/Password
hXXps://meetroomonlin1925.w3spaces[.]com/
hXXps://smaaaal[.]cfd/Wp59tqKU
hXXps://click-choose-figured[.]cfd/Gallery/Ref/FSaEM5gG
hXXps://click-choose-figured[.]cfd/Gallery/Password
hXXps://short-ion-per[.]reside/08EFNZ1
hXXps://checking-paneling[.]reside/aliasauthG/Password
hXXps://checking-paneling[.]reside/aliasauthG/autoref/vNSX6c2m
Different
understandingthewar[.]org
brookings[.]e mail
sharedrive.webredirect[.]org
visioneditor.loseyourip[.]com
s3api[.]store
hXXps://sharedrive.webredirect[.]org/Khn/shoaGzA/cGNt/dMPaV/kvvhK
hXXps://firebasestorage.googleapis[.]com/v0/b/share-box-5f395.appspot.com/o/onedrive-qrty45.html
hXXps://visioneditor.loseyourip[.]com
hXXps://s3api[.]store/api/
APT42 Samples (SHA256)
c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32 (NEWSTERMINAL)
bc2597ce09987022ff0498c6710a9b51a1a47ed8082ac044be2838b384157527 (OFFICEFUEL)
baac058ddfc96c8aea8c0057077505f0ad3ff20311d999886fed549924404849 (OFFICEFUEL)
0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60 (FUELDUMP)
f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060 (FUELDUMP)
82ae2eb470a5a16ca39ec84b387294eaa3ae82e5ada4b252470c1281e1f31c0a (FUELDUMP)
89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c (FUELDUMP)
c3486133783379e13ed37c45dc6645cbee4c1c6e62e7988722931eef99c8eaf3 (GORBLE PS – LNK)
33a61ff123713da26f45b399a9828e29ad25fbda7e8994c954d714375ef92156 (GORBLE PS – Stage 1)
4ac088bf25d153ec2b9402377695b15a28019dc8087d98bd34e10fed3424125f (GORBLE PS – Stage 2)
APT42 – IPs Addresses
49.13.194[.]118 (C2 – OFFICEFUEL/FUELDUMP)
91.107.150[.]184 (C2 – OFFICEFUEL/FUELDUMP)
