巴基斯坦最新SideCopy APT攻击印度政府实体

 

Hash: 70427a5a7cee2a8da876be4ac74caf8888145972930968b7f4fb5932ecee5f31 IP: 85[.]158[.]108[.]85 URL’s http[:]//85[.]158[.]108[.]85:42368/api/root_241244114973094/hello http[:]//85[.]158[.]108[.]85:42368/api/root_6488530725012/hello http[:]//85[.]158[.]108[.]85:42368/api/root_241244114973094/upload http[:]//85[.]158[.]108[.]85:42368/api/root_6488530725012/upload

 

VBS hosted here is signed using PKCS #7, similar to your previous findings, could be related hxxps://zohidsindia.com/ac/cds.vbs 95dfea2c3e7f5bfa8fc18258a6c40cd5 hxxps://nationaldefensecollege[.]com/content/kk.vbs e2babc163a149bc6ff79a3d43aeb54e7 e496c6fd5076f999f0bac84ee70743fa

 

 

185.235.137[.]237

 

66.29.146[.]99