MuddyWater expands operations

[harlan4096]

• Summary
  
• Decoy images by country
  
• Jordan
  
• Turkey
  
• Saudi Arabia
  
• Azerbaijan
  
• Iraq
  
• Pakistan
  
• Afghanistan
  
• Technical details
  
• The initial infection vector
  
• The macro payload analysis, dropped files and registry keys
  
• Case 1: INF, SCT and text files dropped by the macro
  
• Case 2: VBS and text files dropped by the macro
  
• The PowerShell code
  
• CnC communication
  
• Victim system reconnaissance
  
• Supported commands
  
• Victimology
  
• Attacker deception and attribution
  
• Recommendations for organizations
  
• Conclusion
  
• Additional information
  
• Indicators of compromise
  
• MD5
  
• File names
  
• Domains, URLs and IP addresses
  

Full reading: https://securelist.com/muddywater/88059/