2021-12-07_APT-C-36

Malware dirigido a Colombia.

APT-C-36 aka Blind Eagle (también "Operación Spalax")

Operación Spalax: https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/
APT-C-36: https://ti.qianxin.com/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/

IOC's REF: https://twitter.com/1ZRR4H/status/1467924773862879232 
Thanks to https://twitter.com/sS55752750 and https://twitter.com/500mk500 !!

IOC's:

http://149.56.200.165/rump/
http://91.241.19.49/test/

warzone22.duckdns.org
warzone33.duckdns.org
njss.duckdns.org
vjmas.duckdns.org
carbnsfg.duckdns.org
bitrs.duckdns.org
anysdk.duckdns.org

149.56.200.165:4782 QuasarRAT
46.246.6.8:5000 NjRAT 
46.246.86.7:2022
149.56.200.165:5200 AveMaria / Warzone
149.56.200.165:6606
149.56.200.165:7707
149.56.200.165:8808 AsyncRAT.