IoC for Chaes

Malware analysis and more technical information at https://decoded.avast.io/anhho/chasing-chaes-kill-chain/

Table of Contents

• SHA-256
• Network indicators

SHA-256

f20d0ffd1164026e1be61d19459e7b17ff420676d4c8083dd41ba5d04b97a08c
069b11b9b1b20828cfb575065a3d7e0b6d00cd1af10c85c5d6c36caea5e000b7
1836f3fa3172f4c5dbb15adad7736573b4c77976049259cb919e3f0bc7c4d5ea
02831471e4bf9ef18c46ed4129d658c8ce5b16a97f28228ab78341b31dbef3df
62053aeb3fc73ef0940e4e30056f6c42b737027a7c5677f9dbafc5c4de3590bd
a3bcbf9ea2466f422481deb6cb1d5f69d00a026f9f94d6997dd9a17a4190e3aa
e56a321cae9b36179e0da52678d95be3d5c7bde2a7863e855e331aea991d51b9
7a819b168ce1694395a33f60a26e3b799f3788a06b816cc3ebc5c9d80c70326b
70135c02a4d772015c2fce185772356502e4deab5689e45b95711fe1b8b534ce
6e6a44ca955d013ff01929e0fa94f956b7e3bac557babcd7324f3062491755e2
0b5646f45f0fad3737f231f8c50f4ed1a113eb533997987219f7eea25f69d93f
abc071831551af554149342ad266cc43569635fb9ea47c0f632caa5271cdf32f
bd4f39daf16ca4fc602e9d8d9580cbc0bb617daa26c8106bff306d3773ba1b74
c22b3e788166090c363637df94478176e741d9fa4667cb2a448599f4b7f03c7c
426327abdafc0769046bd7e359479a25b3c8037de74d75f6f126a80bfb3adf18
3311b0b667cd20d4f546c1cb78f347c9c56d9d064bb95c3392958c79c0424428
c9b3552665911634489af5e3cb1a9c0c3ab5aed2b73c55ae53b8731a1de23a9f
fa752817a1b1b56a848c4a1ea06b6ab194b76f2e0b65e7fb5b67946a0af3fb5b
e644268503cf1eaf62837ec52a91b8bec60b0c8ee1fb7e42597d6c852f8b8e9d
bd5d2a0ec30fa454af1a086b4c648039422eca4fa1b1d6e8ecc4d47be7fab27f
4d2ffae69b4e0f1e8ba46b79811d7f46f04bd8482568eccf5620e6b1129c1633
faad384e124c283a8d024ee69dceaac877be52f5adbf18ca6b475a66663b0e85
969fa30802bdb81be5b57fef073896c2ee3df4211663301548f8efa86257e0cf
5a1ebf757ab9aa796a8580daafab9635660b9cc55505db194cbfefeb612e48f0
2d9e040820acca9a0fab2dc68546e0a824c4c45ee8c62332213e47e1f6923c90
32c545e133183e6fc999e8f6a0da3c6e7fb1a12b97d2a3bbc5e84faa175a9ef6
e1d9effa8a56d23dbcefd2146eb5c174a245b35a4f718473452135bd064a2157
ba3e0314b1d6e6ee10c473c1bbd883c4a5c53b5703b5ced174cd5a30b0b87160
e210217f2b5912e16a281dcbd5a5247fe2a62897dc5c2e1bf4ff61d3a07405f0
7a1d74c4d62ceee45a3cbaf79070cfc01342a05f47e0efb401c53040897bed77
550188ad28ccc07791880777c2de07e6d824a7263b9e8054423597b160e594a3
9603c4ce0f5a542945ed3ced89dd943eb865368b4e263090be9e0d9c1785615d
9dbbff69e4e198aaee2a0881b779314cdd097f63f4baa0081103358a397252a1
6dc63ea4dbe5d710b7ba161877bd0a3964d176257cdfb0205c1f19d1853cc43b
3e48f714e793b3111ce5072e325af8130b90a326eca50641b3b2d2eba7ac0a45
0762038fe591fef3235053c7136f722820de6d8457cae09d4aa9bf6cb7f497a1
754eeb010795c86d1cc47b0813da6bbc6d9153f1dd22da8af694a9e2dca51cda
ea177d6a5200a39e58cd531e3effb23755604757c3275dfccd9e9b00bfe3e129
7c275daab005bb57e8e97ac98b0ae145a6e850370e98df766da924d3af609285
96224c065027bb72f5e2caebf4167482fe25fb91c55f995e1c86e1c9884815c3
2688a7ac5b408911ae3e473278ecbc7637491df2f71f6f681bc3ed33045b9124
f3c1fd9e8674901771c5bfc4ce16eba75beff7df895a4dc6fdd33bedb2967a08
ddecc2606be56beae331000ba091e5e77ae11380f46eba45387c65289e6ce421
debe443266ab33acb34119f515f4622464edff198f77fd20006e2d79aafb6dfc
bf4a83a19065d5c45858ceb988dce39d93c412902ead6434e85fbf2caa17db44
87502ad879a658aa463088c50facfbdbb1c6592263e933b8b99e77293fdf1384
6b6abc64053d20306147efced9df2ef75153e87a1d77ce657943b2373fb4ffb9
679a02d0ae4f5382767eb11cefad59c0664f55ed2ce3e3b3df97b78c09e18aa3
564b31c3d609d96a73ee139ec53453b985673ffacacb56ecd13d2c83bbf851e0
e649f71b68cc54f3d985e398f1c6354963ec027a26230c4c30b642d2fd5af0a6
3fd48530ef017b666f01907bf94ec57a5ebbf2e2e0ba69e2eede2a83aafef984
5da6133106947ac6bdc1061192fae304123aa7f9276a708e83556fc5f0619aab

Network indicators

Download URLs

dragaobrasileiro[.]com.br/wp-content/themes/getcorsfile.php?
chopeecia[.]com.br/D4d0EMeUm7/index.php?install
bodnershapiro[.]com/blog/wp-content/themes/twentyten/p.php?
dmt-sys[.]net/index.php?
up-dmt[.]net/index.php?
sys-dmt[.]net/index.php?
x-demeter[.]com/index.php?
x-dmt[.]net/index.php?P
walmirlima[.]com.br/wp-content/themes/epico/proxy.php?
atlas[.]med.br/wp-content/themes/twentysixteen/proxy.php?
apoiodesign[.]com/language/overrides/p.php?

HTML Scripts

is[.]gd/EnjN1x?V=31
is[.]gd/oYk9ielu?D=30
is[.]gd/Lg5g13?V=29
tiny[.]one/96czm3nk?v=28
is[.]gd/WRxGba?V=27
is[.]gd/3d5eWS?V=26
is[.]gd/GgGf9z?v=v25.0
is[.]gd/wvJ6Dd?v=v23.0
is[.]gd/B7n1xY?v=v21.0
is[.]gd/y0fFL5?v=v19.0
is[.]gd/PsGIhU?v=v18.0

CnC Servers

200[.]234.195.91
f84f305c[.]com
bkwot3kuf[.]com
comercialss[.]com
awsvirtual[.]blogspot.com
cliq-no[.]link
108[.]166.219.43
176[.]123.8.149
176[.]123.3.100
198[.]23.153.130
191[.]252.110.241
191[.]252.110.75