Mustang Panda Attacks

Overview

This report analyzes Mustang Panda, an APT group engaged in cyber espionage, based on open-source intelligence. It details targeted countries and sectors, along with malware samples, hashes, and tools used in attacks. Included are Indicators of Compromise, YARA and SIGMA rules, and TI lookup queries to support detection and threat hunting. It is not an in-depth analysis of Mustang Panda tactics and tools but a collection of indicators to help identify similar activity, focusing on recent operations.

About Mustang Panda

Mustang Panda (Bronze President) is a Chinese APT group active since 2012. It specializes in cyber espionage, targeting organizations of interest to China. The group is known for focused phishing attacks using lure documents that mimic official materials.

Origin Country

China

Motivation

Espionage

Information theft

First Seen

2014

Targeted Countries

• Myanma
• Philippines
• Vietnam
• Singapore
• Cambodia
• Taiwan
• Japan

Industry Attacked

• Government
• Education
• Military

ShadowPad

• Stately Taurus Abuses VSCode Tunneling

• SHA-256: 0f11b6dd8ff972a2f8cb7798b1a0a8cd10afadcea201541c93ef0ab9b141c184

• Sample: ANY.RUN

• SHA-256: 456e4dae82a12bcda0506a750eac93bf79cc056b8aad09ec74878c90fd67bd8f

• SHA-256: bdadcd2842ed7ba8a21df7910a0acc15f8b0ca9d0b91bebb49f09a906ae217e6

PoohLoader

• Mustang Panda loader

PoohLoader uses the legitimate Windows utility mavinject.exe to inject malicious code into the waitfor.exe process.

With the following TI lookup query, we can search through public tasks and identify this malicious activity.

TI lookup: commandLine:"*Mavinject.exe*" and threatName:"poohloader"

• SHA-256: 855c796ea8a3b7f942ad00baed720939d52c3b5d7ac944da41e7a867f8649145

• Sample: ANY.RUN

SharpNBTScan

• Stately Taurus Abuses VSCode Tunneling

• SHA-256: 506fc87c8c96fef1d2df24b0ba44c8116a9001ca5a7d7e9c01dc3940a664acb0

Tscan

• Stately Taurus Abuses VSCode Tunneling

• SHA-256: cca63c929f2f59894ea2204408f67fc1bff774bb7164fde7f42d0111df9461bd

LaZagne

• Stately Taurus Abuses VSCode Tunneling

• SHA-256: 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05

• Sample: ANY.RUN

Mimikatz

• Stately Taurus Abuses VSCode Tunneling

• Attacks Against Southeast Asian Government

• SHA-256: ac34e1fb4288f8ad996b821c89b8cd82a61ed02f629b60fff9eb050aaf49fc31

• SHA-256: 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc

• SHA-256: 2254e3242943c0afe038baeafe8381bbff136e6d8f681f0f446bf0e458900643

• Sample: ANY.RUN

In-Swor

• Stately Taurus Abuses VSCode Tunneling

• SHA-256: 440e7bce4760b367b46754a70f480941a38cd6cd4c00c56bbaeb80b9c149afb1

• SHA-256: 5bfc45f7fce27d05e753a61dde5fab623efff3e4df56fb6a0cf178a0b11909ce

• SHA-256: fb0c4db0011ee19742d7d8bd0558d8ee8be2ef23c4c61a3e80a34fba6c96f3ff

• SHA-256: 965dd0b255f05ff012d2f152e973e09ceb9e95b6239dc820c8ac4d4492255472

PsExec

• Stately Taurus Abuses VSCode Tunneling

HIUPAN

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 586632c8bb5890c760efc21662105e649177deaf2b2c2eef3ede1da088f23a6c

PUBLOAD

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 2e44ebe8d864ae19446d0853c51e471489c0893fc5ae2e042c01c7f232d2a2c2

• SHA-256: a062fafaff556b17a5ccb035c8c7b9d2015722d86a186b6b186a9c63eeb4308a

• SHA-256: 14a9a74298408c65cb387574ffa8827abd257aa2b76f87efbaa1ee46e8763c57

FDMTP

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: ee986beeb058ec27d0dad9a0a671bbabaa56057102faf30f63397bdbe7fca81f

• Sample: ANY.RUN

IOCs (Click to expand)

• SHA-256: 3514d2e74b476e1569bbf3311934809c6f8e97df5c9669a5fe475e508886df9f
• SHA-256: 71f114842c30e94c95e57ad394969d5766ca28d056dc724c9820717cf03eb0fe
• SHA-256: 959fd255338558d02c567680625d88f5c48e43827bbb1c408f2d43b01807809a
• SHA-256: 466684ad5755c9ee6080ff2a01646824c63a90d3e5be923581b89c707267e79f
• SHA-256: f67ce881d31e7475d3bd70cad8bdc8fe0e8fd5f66b87ede0e49109395f7033aa
• SHA-256: e2f4b2d71e02b49a2721a88eea7bf7308143ee55d7d8119e5e291eafd4859af5
• SHA-256: ea18df47214ac1f96a75b1dffbe510b2855197490bc65f47886b25fc7e8aca15
• SHA-256: 533f47bc4997eed0491f58f24d45c7850cb460da252de90635938e095b5fc213
• SHA-256: 99071b9df19024480e1b6d7049e6713486418759b7f0191643776bd0ac08172b
• SHA-256: 756b9d6f50bd56adca1fa3d48ff07edf8ee3cc568fb32cbdd892403670343b43
• SHA-256: d69a4a7aa3144ee7ec35e7c3a3a4220f5a43bc29cc4cfa0f27fef60b4d93de8d
• SHA-256: 56cb16589ab852de4900496ef74212c17902867e90253b4d9d7f335ef7d45a7b
• SHA-256: c662f5c851314d952cf3594232a7db5b96cb528716cd71bf38393b647cfd4c82
• SHA-256: f452b787e47493e89078e884bf92c61626e6ff4b9bc8eee8ae3728ddc65b7e46
• SHA-256: fd68b49acf9234a8592497ef1d675acd57c6a67c6975313772d12c837f3264d1
• SHA-256: 565fa2992212c89bdec334c0fd318b3fd2c91707431fd8186016f11645925892
• SHA-256: df0e16a29c9dffe2ff7b3d4c957af7459fd7e6fa8026d067202912b997773749
• SHA-256: 3278c06b5510edabb3318aa1892eb7e426e97946b86eea925965a46ba1725ebd

PTSOCKET

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 8ebb12d253a4b4c28435b25478abb590e94bdb55b83c55cda6d44c58a03bf9be

DOWNBAIT

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 3b9ef9701ea2b2c1a89489ed0ed43ffabec9e22b587470899c0d5aca1a1e4302

PULLBAIT

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 9dd62afdb4938962af9ff1623a0aa5aaa9239bcb1c7d6216f5363d14410a3369

CBROVER

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: 7c520353045a15571061c3f6ae334e5f854d441bab417ebf497f21f5a8bc6925

PLUGX

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• Mustang Panda’s PlugX new variant

The OneNotem.exe process first connects to www.google.com to verify internet connectivity before reaching out to the C2 domains ivibers[.]com and meetvibersapi[.]com. This behavior is linked to the deployment of PlugX malware, where the process acts as a legitimate executable used for DLL side-loading. In this case, a malicious DLL is loaded, which decrypts and executes the PlugX payload in memory, ensuring stealthy persistence and remote access.

With the following TI lookup query, we can search through public tasks and identify this malicious activity.

TI lookup: filePath:"OnesNotem.exe" and domainName:"ivibers.com" or domainName:"meetvibersapi.com"

• SHA-256: c7ec098093eb08d2b36d1c37b928d716d8da021f93319a093808a7ceb3b35dc1

• Sample: ANY.RUN

• SHA-256: 44d2d35ca87bf4292e4586bd08f3fe51d3fff693fed2f9795ff49733338ae8a7

• SHA-256: afed5635fa6d63b158fc408d5048bf2dafd6da210a98f308c02c94514ae28fc8

• SHA-256: b37b244595cac817a8f8dba24fbea208205e1d1321651237fe24fdcfac4f8ffc

• SHA-256: de08f83a5d2421c86573dfb968293c776a830d900af2bc735d2ecd7e77961aaf

• SHA-256: d32d7e86ed97509289fff89a78895904cf07a82824c053bfaf1bc5de3f3ba791

FILESAC

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

• SHA-256: b63bc07202491a4dcd34cc419351edb2f2c395b2671d7acf7bfc88abada344ec

LadonGo

• Attacks Against Southeast Asian Government

• SHA-256: 4a8b7cfb2e33aa079ba51166591c7a210ad8b3c7c7f242fccf8cb2e71e8e40d5

• Sample: ANY.RUN

• SHA-256: 12534f7014b3338d8f9f86ff1bbeacf8c80ad03f1d0d19077ff0e406c58b5133

• SHA-256: 6868f5ce836034557e05c7ddea006a91d6fc59de7e235c9b08787bd6dbd2b837

NBTScan

• Attacks Against Southeast Asian Government

• SHA-256: 541bac89b3a414e06b45d778f86b245675922e8b11f866c8b6a827c5d418e598

AdFind

• Attacks Against Southeast Asian Government

• SHA-256: 8445aa54adf4d666e65084909a7b989a190ec6eca2844546c2e99a8cfb832fad

Impacket

• Attacks Against Southeast Asian Government

• SHA-256: b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b

Hdump

• Attacks Against Southeast Asian Government

• SHA-256: 64ab1c1b19682026900d060b969ab3c3ab860988733b7e7bf3ba78a4ea0340b9

• Sample: ANY.RUN

ToneShell

• Attacks Against Southeast Asian Government

• SHA-256: 011fe9974f07cb12ba30e69e7a84e5cb489ce14a81bced59a11031fc0c3681b7

• Sample: ANY.RUN

• SHA-256: 86140e6770fbd0cc6988f025d52bb4f59c0d78213c75451b42c9f812fe1a9354

• Sample: ANY.RUN

• SHA-256: a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc

• Sample: ANY.RUN

• SHA-256: 66b7983831cbb952ceeb1ffff608880f1805f1df0b062cef4c17b258b7f478ce

• Sample:ANY.RUN

IOC Summary

• Stately Taurus Abuses VSCode Tunneling

IOCs (Click to expand)

• SHA-256: 506fc87c8c96fef1d2df24b0ba44c8116a9001ca5a7d7e9c01dc3940a664acb0
• SHA-256: aa2c0de121ae738ce44727456d97434faff21fc69219e964e1e2d2f1ca16b1c5
• SHA-256: 8fdac78183ff18de0c07b10e8d787326691d7fb1f63b3383471312b74918c39f
• SHA-256: 39ceb73bcfd1f674a9b72a03476a9de997867353172c2bf6dde981c5b3ad512a
• SHA-256: 0f11b6dd8ff972a2f8cb7798b1a0a8cd10afadcea201541c93ef0ab9b141c184
• SHA-256: 456e4dae82a12bcda0506a750eac93bf79cc056b8aad09ec74878c90fd67bd8f
• SHA-256: bdadcd2842ed7ba8a21df7910a0acc15f8b0ca9d0b91bebb49f09a906ae217e6
• SHA-256: ac34e1fb4288f8ad996b821c89b8cd82a61ed02f629b60fff9eb050aaf49fc31
• SHA-256: 440e7bce4760b367b46754a70f480941a38cd6cd4c00c56bbaeb80b9c149afb1
• SHA-256: 5bfc45f7fce27d05e753a61dde5fab623efff3e4df56fb6a0cf178a0b11909ce
• SHA-256: fb0c4db0011ee19742d7d8bd0558d8ee8be2ef23c4c61a3e80a34fba6c96f3ff
• SHA-256: 965dd0b255f05ff012d2f152e973e09ceb9e95b6239dc820c8ac4d4492255472
• SHA-256: acedfe9c662c2666787cbbf8d3a0225863bab2c239777594b003381244ed81ba
• SHA-256: cca63c929f2f59894ea2204408f67fc1bff774bb7164fde7f42d0111df9461bd
• SHA-256: 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05
• ip: 216.83.40[.]84
• ip: 185.132.125[.]72

• VSCode for Unauthorized Access

IOCs (Click to expand)

• SHA-256: 281766109f2375a01bad80478fd18841eccaefc1ee9277179cc7ff075d1beae2
• SHA-256: c7f07bdfb91653f53782885a3685436e2e965e1c5f4863c03f5a9825c0364489
• URL: hxxp://requestrepo.com/r/2yxp98b3
• URL: hxxps://paste[.]ee/r/DQjrd/0

• Attacks with PUBLOAD, HIUPAN & Multi-Stage Downloaders

IOCs (Click to expand)

• SHA-256: ee986beeb058ec27d0dad9a0a671bbabaa56057102faf30f63397bdbe7fca81f
• SHA-256: 3514d2e74b476e1569bbf3311934809c6f8e97df5c9669a5fe475e508886df9f
• SHA-256: 2e44ebe8d864ae19446d0853c51e471489c0893fc5ae2e042c01c7f232d2a2c2
• SHA-256: a062fafaff556b17a5ccb035c8c7b9d2015722d86a186b6b186a9c63eeb4308a
• SHA-256: d1492101eb450f0e9badaea254e5551b49297fa4a98c53c939bb96bafd2151fe
• SHA-256: 586632c8bb5890c760efc21662105e649177deaf2b2c2eef3ede1da088f23a6c
• SHA-256: 68bec53e4772eee6c13278a471d669b916cdc797c81d128ee103ee90841fa19e
• SHA-256: 71f114842c30e94c95e57ad394969d5766ca28d056dc724c9820717cf03eb0fe
• SHA-256: 959fd255338558d02c567680625d88f5c48e43827bbb1c408f2d43b01807809a
• SHA-256: 466684ad5755c9ee6080ff2a01646824c63a90d3e5be923581b89c707267e79f
• SHA-256: f67ce881d31e7475d3bd70cad8bdc8fe0e8fd5f66b87ede0e49109395f7033aa
• SHA-256: e2f4b2d71e02b49a2721a88eea7bf7308143ee55d7d8119e5e291eafd4859af5
• SHA-256: ea18df47214ac1f96a75b1dffbe510b2855197490bc65f47886b25fc7e8aca15
• SHA-256: 533f47bc4997eed0491f58f24d45c7850cb460da252de90635938e095b5fc213
• SHA-256: c2bed145cf09022ee6a378dc5e9b3ae49b7c95a6551fa7310a1d997f93f6e2d1
• SHA-256: 99071b9df19024480e1b6d7049e6713486418759b7f0191643776bd0ac08172b
• SHA-256: 756b9d6f50bd56adca1fa3d48ff07edf8ee3cc568fb32cbdd892403670343b43
• SHA-256: d69a4a7aa3144ee7ec35e7c3a3a4220f5a43bc29cc4cfa0f27fef60b4d93de8d
• SHA-256: 14a9a74298408c65cb387574ffa8827abd257aa2b76f87efbaa1ee46e8763c57
• SHA-256: 8ebb12d253a4b4c28435b25478abb590e94bdb55b83c55cda6d44c58a03bf9be
• SHA-256: 56cb16589ab852de4900496ef74212c17902867e90253b4d9d7f335ef7d45a7b
• SHA-256: c662f5c851314d952cf3594232a7db5b96cb528716cd71bf38393b647cfd4c82
• SHA-256: f452b787e47493e89078e884bf92c61626e6ff4b9bc8eee8ae3728ddc65b7e46
• SHA-256: fd68b49acf9234a8592497ef1d675acd57c6a67c6975313772d12c837f3264d1
• SHA-256: 565fa2992212c89bdec334c0fd318b3fd2c91707431fd8186016f11645925892
• SHA-256: df0e16a29c9dffe2ff7b3d4c957af7459fd7e6fa8026d067202912b997773749
• SHA-256: 3278c06b5510edabb3318aa1892eb7e426e97946b86eea925965a46ba1725ebd
• SHA-256: 3b9ef9701ea2b2c1a89489ed0ed43ffabec9e22b587470899c0d5aca1a1e4302
• SHA-256: 9dd62afdb4938962af9ff1623a0aa5aaa9239bcb1c7d6216f5363d14410a3369
• SHA-256: d8747574251c8b4ab8da4050ba9e1f6e8dbbaa38f496317b23da366e25d3028a
• SHA-256: 7c520353045a15571061c3f6ae334e5f854d441bab417ebf497f21f5a8bc6925
• SHA-256: b63bc07202491a4dcd34cc419351edb2f2c395b2671d7acf7bfc88abada344ec
• SHA-256: 44d2d35ca87bf4292e4586bd08f3fe51d3fff693fed2f9795ff49733338ae8a7
• SHA-256: afed5635fa6d63b158fc408d5048bf2dafd6da210a98f308c02c94514ae28fc8
• SHA-256: b37b244595cac817a8f8dba24fbea208205e1d1321651237fe24fdcfac4f8ffc
• SHA-256: de08f83a5d2421c86573dfb968293c776a830d900af2bc735d2ecd7e77961aaf
• SHA-256: d32d7e86ed97509289fff89a78895904cf07a82824c053bfaf1bc5de3f3ba791
• ip: 103[.]15[.]29[.]17
• ip: 154[.]90[.]32[.]88
• ip: 47[.]76[.]87[.]55
• ip: 154[.]90[.]32[.]88
• ip: 47[.]253[.]106[.]177
• ip: 16[.]162[.]188[.]93
• ip: 18[.]163[.]112[.]181
• domain: www[.]ynsins[.]com
• domain: www[.]aihkstore[.]com
• domain: www[.]bcller[.]com

• Attacks Against Southeast Asian Government

IOCs (Click to expand)

• SHA-256: 4a8b7cfb2e33aa079ba51166591c7a210ad8b3c7c7f242fccf8cb2e71e8e40d5
• SHA-256: 12534f7014b3338d8f9f86ff1bbeacf8c80ad03f1d0d19077ff0e406c58b5133
• SHA-256: 6868f5ce836034557e05c7ddea006a91d6fc59de7e235c9b08787bd6dbd2b837
• SHA-256: 541bac89b3a414e06b45d778f86b245675922e8b11f866c8b6a827c5d418e598
• SHA-256: 8445aa54adf4d666e65084909a7b989a190ec6eca2844546c2e99a8cfb832fad
• SHA-256: b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b
• SHA-256: 64ab1c1b19682026900d060b969ab3c3ab860988733b7e7bf3ba78a4ea0340b9
• SHA-256: 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc
• SHA-256: 2254e3242943c0afe038baeafe8381bbff136e6d8f681f0f446bf0e458900643
• SHA-256: 2f5cf595ac4d6a59be78a781c5ba126c2ff6d6e5956dc0a7602e6ba8e6665694
• SHA-256: 0f2f0458d2f1ac4233883e96fe1f4cc6db1551cdcfdd49c43311429af03a1cd5
• SHA-256: 011fe9974f07cb12ba30e69e7a84e5cb489ce14a81bced59a11031fc0c3681b7
• SHA-256: 3fc4d023d96f339945683f6dc7d9e19a9a62b901bef6dc26c5918ce9508be273
• SHA-256: 3a429b8457ad611b7c3528e4b41e8923dd2aee32ccd2cc5cf5ff83e69c1253c2
• SHA-256: f58d3d376c8e26b4ae3c2bbaa4ae76ca183f32823276e6432a945bcbc63266d9
• SHA-256: 46c6ee9195f3bd30f51eb6611623aad1ba17f5e0cde0b5523ab51e0c5b641dbf
• SHA-256: 86140e6770fbd0cc6988f025d52bb4f59c0d78213c75451b42c9f812fe1a9354
• SHA-256: a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc
• SHA-256: 19d07dbc58b8e076cafd98c25cae5d7ac6f007db1c8ec0fae4ce6c7254b8f073
• SHA-256: 8e801d3a36decc5e4ce6fd3e8e45b098966aef8cbe7535ed0a789575775a68b6
• SHA-256: df4ba449f30f3ed31a344931dc77233b27e06623355ece23855ee4fe8a75c267
• SHA-256: 345ef3fb73aa75538fdcf780d2136642755a9f20dbd22d93bee26e93fb6ab8fd
• SHA-256: 3a5e69786ac1c458e27d38a966425abb6fb493a41110393a4878c811557a3b5b
• SHA-256: 66b7983831cbb952ceeb1ffff608880f1805f1df0b062cef4c17b258b7f478ce
• SHA-256: f2a6a326fb8937bbc32868965f7475f4af0f42f3792e80156cc57108fc09c034
• SHA-256: dafa952aacf18beeb1ebf47620589639223a2e99fb2fa5ce2de1e7ef7a56caa0
• SHA-256: 52cd066f498a66823107aed7eaa4635eee6b7914acded926864f1aae59571991
• SHA-256: 8129bd45466c2676b248c08bb0efcd9ccc8b684abf3435e290fcf4739c0a439f
• SHA-256: 1874b20e3e802406c594341699c5863a2c07c4c79cf762888ee28142af83547f
• SHA-256: 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71
• domain: www.uvfr4ep[.]com
• domain: Feed-5613.coderformylife[.]info
• ip: 45.64.184[.]189
• ip: 43.254.132[.]242
• ip: 103.27.202[.]68
• ip: 67.53.148[.]77
• ip: 207.246.89[.]250

• Mustang Panda’s PlugX new variant

IOCs (Click to expand)

• SHA-256: c7ec098093eb08d2b36d1c37b928d716d8da021f93319a093808a7ceb3b35dc1
• SHA-256: 651c096cf7043a01d939dff9ba58e4d69f15b2244c71b43bedb4ada8c37e8859
• SHA-256: 908ff3a80ef065ab4be1942e0d41583903f6aac02d97df6b4a92a07a633397a8
• SHA-256: c6ef220d0c6e9015bdfb7977ff15e7f2c4c0dbfcd3b28ffb3066fe6d21251322
• SHA-256: 8af3fc1f8bd13519d78ee83af43daaa8c5e2c3f184c09f5c41941e0c6f68f0f7
• domain: ivibers[.]com
• domain: meetvibersapi[.]com

• Attacks by the Mustang Panda APT on Vietnamese entities

IOCs (Click to expand)

• SHA-256: 47eb43acdd342d3975000f650cf656d9f0f759780d85f16d806d6b9a70f1be46
• SHA-256: 9375b508e981ed792742f1f3b831ea6647191c261e0d3cd61e60645251ba7df7
• SHA-256: cd10f98c2dbcc0c8fe3f0ed19efb1b2340f67b1138a55b0bb8d1e3dfb985df51
• SHA-256: bce44453835ce96e49046ff618749a9533c290504c3d7559b3a63969b9f3ef13
• SHA-256: 57ba7d5093ec54b0223e6a826f6cb5e019a353963ddbac8420036f7374b28f62
• SHA-256: 96cf65bb1ac9735c6a1100944d0f46343bb74f3a3c05bc6282271184b872198e
• SHA-256: fe721743a87c2f2767c031ccac337c1fb1ae5e92384738dd90c65d3b1617a341
• SHA-256: 0ea669d3ef2ae00f25ccb4fef4805c6fd7f9816c37afb8957b3d4ace065e1d95
• SHA-256: 4c805f281923ffc2214f4fe48f31ea392b13b710969a18ad6b6b561744cd3875
• SHA-256: 968b3de170038522deae02b9b96c45cfc6a5c70fa0ddfaf29320d0d0d36aabfa
• URL: hxxp://mega.vlvlvlvl[.]site/Vanban_8647.PDF_update.hta
• URL: hxxp://mega.vlvlvlvl[.]site/HP.exe
• URL: hxxp://mega.vlvlvlvl[.]site/HPCustPartUI.dll
• URL: hxxp://mega.vlvlvlvl[.]site/Vanban_8647.PDF.ps1
• URL: hxxp://payment.tripadviso[.]online/tempdata.dat
• URL: hxxp://vibm[.]vn/init.txt
• URL: hxxp://megacybernews[.]com/newrun.ps1
• URL: hxxp://megacybernews[.]com/getdata.ps1
• URL: hxxp://megacybernews[.]com/stage2.2.ps1
• URL: hxxp://megacybernews[.]com/checkin.php
• URL: hxxp://megacybernews[.]com/book.dll
• URL: hxxp://megacybernews[.]com/unikey.exe
• URL: hxxp://megacybernews[.]com/wwlib.dll
• domain: mega.vlvlvlvl[.]site
• domain: payment.tripadviso[.]online
• domain vibm[.]vn
• domain megacybernews[.]com

• Stately Taurus Targets Myanmar

IOCs (Click to expand)

• SHA-256: b7e042d2accdf4a488c3cd46ccd95d6ad5b5a8be71b5d6d76b8046f17debaa18
• SHA-256: ce4f7e7ce82a5621b5409ccb633e27269a05ce17d1b049feda9fbc4793e6c484
• SHA-256: 2a00d95b658e11ca71a8de532999dd33ddee7f80432653427eaa885b611ddd87
• SHA-256: a00673e35eaccf494977f4e9a957d5820a20fe6b589c796f9085a0271e8c380c
• SHA-256: 0d0981941cf9f1021b07b7578c45ed4c623edb16ad03a256c4cd9aaf900d723d
• SHA-256: 51d89afe0a49a3abf88ed6f032e4f0a83949fc44489fc7b45c860020f905c9d7
• SHA-256: e537c5da268c6a08d6e94d570e8efb17d0ca3f4013e221fadc4e0b3191499767
• ip: 123.253.32.15
• ip: 103.159.132.80
• ip: 37.120.222.19
• domain: openservername.com

• New Information on Cyberespionage Attacks against Myanmar Military

IOCs (Click to expand)

• ip: 45.121.146[.]113
• ip: 61.4.102[.]75
• ip: 45.154.24[.]14
• ip: 103.249.84[.]137
• SHA-256: 3a6887963920c8bc1ae35fdca69af2c0865f8b5c6ef90b4db91fa152bc56050d
• SHA-256: fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1
• SHA-256: 879d99081510b6bbf1df105bca85087edadcc3b235fb1e358194892cae2b034f
• SHA-256: fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1
• SHA-256: b300afb993b501aca5b727b1c964810345cfa5b032f5774251a2570a3ae16995
• SHA-256: 8f3a36aaa55f54ae4e665a3c4213dec1f16912bf5ed2f0ff5ff9d08a84a451a6
• SHA-256: 3adf6df9bfc377a762f4cebe9e5b5e7d7a823de03f6bfe8efa8ed5473ce10bc1
• SHA-256: fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1
• SHA-256: fcefba64cfd18a3899cb5c87328eabad18a0efebfb5d8f8e774c570cad332e64
• SHA-256: 5a61ff42ca850ba08f835e3a960d87450c2d6557f5fa65dd006c00eda1ab45a3
• SHA-256: 6811e4b244a0f5c9fac6f8c135fcfff48940e89a33a5b21a552601c2bceb4614
• SHA-256: e90d5c6ee2bb69dcd327ca344263ce1e033a04c6e054c69c46b01236691b7641
• SHA-256: 536f55acdb6393d8bf9976cc3ba1e64280c8f8c26463a139354e53991dd87745
• SHA-256: 5a61ff42ca850ba08f835e3a960d87450c2d6557f5fa65dd006c00eda1ab45a3
• SHA-256: 6c90df591f638134db3b48ff1fd7111c366ec069c69ae28ee60d5cdd36408c02
• SHA-256: edb0025d79d00839cc52d6b750d845c37ffd5a882c81e7979e2594a7f6c6d361
• SHA-256: 01273b6bb129a54d59e91c389a71add9892d392ea5f145169ae628ec99eda935
• SHA-256: 8e4af4de49f2aed26db54ac90acf72edf5aa83f0aa38d262a95c653106a56acf

Sigma

GitHub, Sigma Rule for PoohLoader

title:  PoohLoader - Mustang Panda
id: 0640db90-7432-4c0f-8961-b8c60457a2d3
status: test
description: Detect PoohLoader process. Please note that I intentionally made this rule to be heuristic, and Mustang Panda usually change the DLL so it is a good idea to change the DLL name in the Selection to match with your situation.
references:
    - https://x.com/FatzQatz
author: FatzQatz (https://x.com/FatzQatz)
date: 2025/01/26
modified: 2025/01/26
logsource:
   category: process_creation
   product: windows
detection: 
   selection_if_av_exist_waitfor:
      ParentImage|endswith: '\regsvr32.exe'
      ParentCommandLine|contains: 'EACore.dll'
      Image|endswith: '\waitfor.exe'
      CommandLine|contains: 'Event'
   selection_if_av_exist_mavinject:
      ParentImage|endswith: '\regsvr32.exe'
      ParentCommandLine|contains: 'EACore.dll'
      Image|endswith: '\mavinject.exe'
      CommandLine|contains: 'injectrunning'
   selection_if_av_not_exist:
      ParentCommandLine|contains: 'ProgramData\session'
      Image|endswith: '\waitfor.exe'
      CommandLine|contains: 'Event'
   parent_condition:
      ParentImage|endswith: 
          - '\cmd.exe'
          - '\powershell.exe'
          - '\msiexec.exe'
   condition: ((selection_if_av_exist_waitfor and selection_if_av_exist_mavinject) or selection_if_av_not_exist) and not parent_condition
falsepositives: Unknown
level: medium

YARA

GitHub, Yara Rule for PoohLoader

rule mal_poohloader
{
    meta:
        version = "1.0"
        first_imported = "2025-01-26"
        last_modified = "2025-01-26"
        sharing = "TLP:CLEAR"
        author = "FatzQatz"
        description = "Detect PoohLoader, a Loader used by Mustang Panda to deploy Toneshell. This Loader utilized Mavinject to inject the shellcode."
        falsepositives= "Unknown"
    strings:
        $s_1 = "C:\\Windows\\SysWOW64\\waitfor.exe" nocase wide
        $s_2 = "c:\\windows\\System32\\regsvr32.exe" nocase wide
        $s_3 = "C:\\Windows\\SysWOW64\\Mavinject.exe" nocase wide
        $s_4 = "DllRegisterServer" nocase
        $s_5 = "INJECTRUNNING" nocase wide
        $hex = {
            8B 45 F8			// mov     eax, [ebp+data_size]
            2B 45 EC			// sub     eax, [ebp+var_14]
            8B 4D EC			// mov     ecx, [ebp+var_14]
            8A 90 ?? ?? ?? ??	// mov     dl, ds:byte_mem1[eax]
            88 91 ?? ?? ?? ??	// mov     mem2[ecx], dl
            8B 45 F8			// mov     eax, [ebp+data_size]
            2B 45 EC			// sub     eax, [ebp+var_14]
            8A 4D E3			// mov     cl, [ebp+var_1D]
            88 88 ?? ?? ?? ??	// mov     ds:byte_mem1[eax], cl
    }
    condition:
        uint16(0) == 0x5A4D
        and (filesize >= 400KB and filesize <= 8MB)
        and (all of ($s_*)
            or (any of ($s_*) and $hex))
}

ShadowPad Detection YARA Rules

rule Windows_Trojan_ShadowPad_1 {
    meta:
        author = "Elastic Security"
        creation_date = "2023-01-23"
        last_modified = "2023-01-31"
        description = "Target SHADOWPAD obfuscation loader+payload"
        os = "Windows"
        arch = "x86"
        category_type = "Trojan"
        family = "ShadowPad"
        threat_name = "Windows.Trojan.ShadowPad"
        license = "Elastic License v2"
    strings:
        $a1 = { 87 0? 24 0F 8? }
        $a2 = { 9C 0F 8? }
        $a3 = { 03 0? 0F 8? }
        $a4 = { 9D 0F 8? }
        $a5 = { 87 0? 24 0F 8? }
    condition:
        all of them
}

rule Windows_Trojan_Shadowpad_2 {
    meta:
        author = "Elastic Security"
        creation_date = "2023-01-31"
        last_modified = "2023-01-31"
        description = "Target SHADOWPAD loader"
        os = "Windows"
        arch = "x86"
        category_type = "Trojan"
        family = "Shadowpad"
        threat_name = "Windows.Trojan.Shadowpad"
        license = "Elastic License v2"
    strings:
        $a1 = "{%8.8x-%4.4x-%4.4x-%8.8x%8.8x}"
    condition:
        all of them
}

rule Windows_Trojan_Shadowpad_3 {
    meta:
        author = "Elastic Security"
        creation_date = "2023-01-31"
        last_modified = "2023-01-31"
        description = "Target SHADOWPAD payload"
        os = "Windows"
        arch = "x86"
        category_type = "Trojan"
        family = "Shadowpad"
        threat_name = "Windows.Trojan.Shadowpad"
        license = "Elastic License v2"
    strings:
        $a1 = "hH#whH#w" fullword
        $a2 = "Yuv~YuvsYuvhYuv]YuvRYuvGYuv1:tv<Yuvb#tv1Yuv-8tv&Yuv" fullword
        $a3 = "pH#wpH#w" fullword
        $a4 = "HH#wHH#wA" fullword
        $a5 = "xH#wxH#w:$" fullword
        $re1 = /(HTTPS|TCP|UDP):\/\/[^:]+:443/
    condition:
        4 of them
}

References

• https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/

• https://x.com/fatzqatz/status/1883443770819248130?s=46&t=QMtQK6cFw1XMX3Jx2tsV0w

• https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/

• https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html

• https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/

• https://cyble.com/blog/silent-intrusion-unraveling-the-sophisticated-attack-leveraging-vs-code-for-unauthorized-access/

• https://cyble.com/blog/vietnamese-entities-targeted-by-china-linked-mustang-panda-in-cyber-espionage/

• https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/

• https://github.com/FatzQatz/Detection_Rule/blob/main/Sigma_Rule/mal_poohloader.yml

• https://github.com/FatzQatz/Detection_Rule/blob/main/YARA_Rule/mal_poohloader.yar

• https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns