MuddyWater Operations
Iranian MOIS-linked MuddyWater persistent access campaigns targeting Middle East government and telecoms sectors.
Start date
1 January 2017
End date
—
Techniques
23
Indicators of compromise
278
118 md570 sha25670 sha111 ip9 url
Attributed actors
Techniques (23)
collection1
T1113Screen Capture
command-and-control3
T1573.001Symmetric Cryptography
T1105Ingress Tool Transfer
T1071.001Web Protocols
discovery3
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
execution3
T1059.003Windows Command Shell
T1059.001PowerShell
T1053.005Scheduled Task
exfiltration1
T1041Exfiltration Over C2 Channel
initial-access4
T1566.002Spearphishing Link
T1078Valid Accounts
T1133External Remote Services
T1566.001Spearphishing Attachment
lateral-movement2
T1021.001Remote Desktop Protocol
T1021.004SSH
persistence5
T1078Valid Accounts
T1547.001Registry Run Keys / Startup Folder
T1133External Remote Services
T1543.003Windows Service
T1053.005Scheduled Task
privilege-escalation5
T1078Valid Accounts
T1547.001Registry Run Keys / Startup Folder
T1055Process Injection
T1543.003Windows Service
T1053.005Scheduled Task
stealth5
T1078Valid Accounts
T1140Deobfuscate/Decode Files or Information
T1070.004File Deletion
T1055Process Injection
T1027Obfuscated Files or Information
Indicators of compromise (278)
SHA25670
5c7d16bd89ef37fe02cac1851e7214a01636ee4061a80bfdbde3a2d199721a79confirmed
e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431ecaconfirmed
315a95d2565b05d936d1357311848d7cc021dfddfd8bfe4a3f7dea18c2c19522confirmed
40ffcbf044ec951242a92a09b6a239183def2e74fc18e5975fa70e849d875a2econfirmed
94625dd8151814dd6186735a6a6a87b2a4c71c04b8402caf314fb6f98434eaadconfirmed
9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2confirmed
b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1aconfirmed
209fb398318a0d346b933b0c408467fce8dea36c10cd0f69ce4b342e28cee9dcconfirmed
4b2862a1665a62706f88304406b071a5c9a6b3093daadc073e174ac6d493f26cconfirmed
2a49d29d58d4d962bee5430e40f488bb79ebab92cf13db5bb4708f3eaf95caedconfirmed
aa60c1fae6a0ef3b9863f710e46f0a7407cf0feffa240b9a4661a4e8884ac627confirmed
f2f573af0f76fe0f21bbe630a4bb50b1c1836eb24429bfb8c93673276f27e374confirmed
255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625aconfirmed
ed988768f50f1bb4cc7fb69f9633d6185714a99ecfd18b7b1b88a42a162b0418confirmed
707d2128a0c326626adef0d3a4cab78562abd82c2bd8ede8cc82f86c01f1e024confirmed
12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aaconfirmed
5f2a6601d349af00a4cc101a638003af2f330879c333168cbf6a7a123dfb3928confirmed
5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564fconfirmed
d77e268b746cf1547e7ed662598f8515948562e1d188a7f9ddb8e00f4fd94ef0confirmed
bbcafdb4fd7bf107d8b85934286d531536b7a0a30e5eeed07e27f0f7afcf8a77confirmed
b9c70adbc731b1b2779ab35bb0fab29ae703e2a4a7214c5e2749b02daf326a9bconfirmed
18cf5795c2208d330bd297c18445a9e25238dd7f28a1a6ef55e2a9239f5748cdconfirmed
b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504confirmed
3eb27ecfbe5381b9cf4dcba2486e9773d9893b92c95032be784e0d2198740539confirmed
276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7bebconfirmed
153117aa54492ca955b540ac0a8c21c1be98e9f7dd8636a36d73581ec1ddcf58confirmed
e60c802b692a503f4f91e8809bb961b5423c602f6fb374de1af4d983415de3f1confirmed
507039a0c8a9a9c378118cd7015dd824e31b77c2b8835215d1a021bea82c66b4confirmed
bfb4fc96c1ba657107c7c60845f6ab720634c8a9214943b5221378a37a8916cdconfirmed
d07d4e71927cab4f251bcc216f560674c5fb783add9c9f956d3fc457153be025confirmed
2cea0b740f338c513a6390e7951ff3371f44c7c928abf14675b49358a03a5d13confirmed
6a68e8b12960257621cb89f979c1fbbd0f13c2338fad0f64e133deb95c99b2f9confirmed
9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7confirmed
18479a93fc2d5acd7d71d596f27a5834b2b236b44219bb08f6ca06cf760b74f6confirmed
cd123cc3c192e822d24534ad52b7c76becbe0b10f987c881d90a4629ef84f736confirmed
c87799cce6d65158da97aa31a5160a0a6b6dd5a89dea312604cc66ed5e976cc9confirmed
42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986confirmed
abc269676eab9cf71f4f00195d1be02c10ea5bfb383fa1396dc108e0f6f9b9beconfirmed
76e9988dad0278998861717c774227bf94112db548946ef617bfaa262cb5e338confirmed
e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13confirmed
616b5f143156dffbdc6cd5765d157874540739f7d74a0b86cb0c4ed342605443confirmed
818253f297fea7d8a2324ee1a233aabbaf3b0b4b9cdaa1ebd676fe00f2247388confirmed
b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76cconfirmed
91fe25107612a35f1e1c2b9ffa1027262062ee9a389d1fd4e118ea6f4798bcefconfirmed
86b5aab2be0b3f29e3184fd2337792a80706cc593cc17de85eea2401af29738fconfirmed
b0da2a7d0eeb5ab43eb99108b87d0141edcba4aa11d44c1f708527499410133fconfirmed
38556ba0b512636006c00b51f24ac92755bd1f1b21b4ae1812abf6bf9543221econfirmed
e04bb1c0a84debcae77cd82b0a27a02cdd68d47214d6bafefec8f5cad71f4a1cconfirmed
9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051confirmed
009cc0f34f60467552ef79c3892c501043c972be55fe936efb30584975d45ec0confirmed
f9a825385e4bf2a86943f78708f7b5a3bb4244c334be5cd363c221b59a21d42econfirmed
3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8confirmed
ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9confirmed
3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0cconfirmed
c2badcdfa9b7ece00f245990bb85fb6645c05b155b77deaf2bb7a2a0aacbe49econfirmed
ad7210a49bd908aae54da0f496ca62cb10a20c3c934dede84f9afff229186873confirmed
3da24cd3af9a383b731ce178b03c68a813ab30f4c7c8dfbc823a32816b9406fbconfirmed
f6707b5f41192353be3311fc7f48ee30465038366386b909e6cefaade70c91bcconfirmed
b7b8faac19a58548b28506415f9ece479055e9af0557911ca8bbaa82b483ffb8confirmed
3f14a1210d1f2cdb916275bf32cb49159b6f49a54f246bdcb0e967cd0edb8e82confirmed
7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4confirmed
fbbda9d8d9bcaaf9a7af84d08af3f5140f5f75778461e48253dc761cc9dc027cconfirmed
f10471e15c6b971092377c524a0622edf4525acee42f4b61e732f342ea7c0df0confirmed
41a32a19c78a542ab4d0701c31d9ef6c7f019c9bc604ab9415f4790b7ac6c591confirmed
dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92confirmed
eff78c23790ee834f773569b52cddb01dc3c4dd9660f5a476af044ef6fe73894confirmed
026868713d60e6790f41dc7046deb4e6795825faa903113d2f22b644f0d21141confirmed
af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102confirmed
9038ba1b7991ff38b802f28c0e006d12d466a8e374d2f2a83a039aabcbe76f5cconfirmed
2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82confirmed
MD5118
3fe517cfbe9700ed9c311661377fcbd9confirmed
245fa82c89875b70c2669921d4ba14d3confirmed
a65696d6b65f7159c9ffcd4119f60195confirmed
f84914c30ae4e6b9b1f23d5c01e001edconfirmed
c0c2cd5cc018e575816c08b36969c4a6confirmed
d9e1cff126e23d40d396bebc0fe103beconfirmed
e7a6c57566d9523daa57fe16f52e377econfirmed
c7a4e8ec050a078d37fff5197af953e2confirmed
47ec75d3290add179ac5218d193bb9a8confirmed
52f5c458bae1ec48fc650d0975663910confirmed
f2b5373f32a4b9b3d34701ff973ba69cconfirmed
e182a861616a9f12bc79988e6a4186afconfirmed
5bd61a94e7698574eaf82ef277316463confirmed
96565e257370e82ea6cc20bdc7831a7bconfirmed
9c6648cedeb3f5d9f6d104e638bd0c3dconfirmed
cec48bcdedebc962ce45b63e201c0624confirmed
89eb652b81f7b3cd7e9ee9e718575c09confirmed
f7a88a7f326a63079052f1884b57e3a8confirmed
aa1e8d0e1c4d4eb9984124df003ea7f2confirmed
d15aee026074fbd18f780fb51ec0632aconfirmed
1a870fa886d593f0dd1c9ce8816c3a63confirmed
8a36d91ca331f62642dbcafc2ea1b1abconfirmed
7beb94f602e97785370fec2d059d54a5confirmed
4f873578956d2790101443f24e4bd4d3confirmed
c2b5de9421b4a0c9b7d4688f4ae051acconfirmed
a0421312705e847a1c8073001fd8499cconfirmed
c732c8e6ad0cf8292aa60a9da9dcbe7cconfirmed
ef43c49686a0f7100f95a3dfa50d84eaconfirmed
a9ec30226c83ba6d7abb8d2011cdae14confirmed
4c5a5c236c9f4480b3d725f297673fadconfirmed
cd371d1d3bd7c8e2110587cfa8b7eaeaconfirmed
8528c24241b97c45d2f90f3ef1baceecconfirmed
7bc20c2666aeb10cbe1787cdeeb38138confirmed
37fa9e6b9be7242984a39a024cade2d5confirmed
2de65738f49b99cdb71355bdc924c55aconfirmed
be62fc5b1576e0a8491519e10bab931dconfirmed
52299ffc8373f58b62543ec754732e55confirmed
94edf251b5fe7cc19488b5f0c3c3e359confirmed
065463fcb19d087772450d47229f013fconfirmed
1b086ab28e3d6f73c6605f9ae087ad4aconfirmed
6c084c8f5a61c6bec5eb5573a2d51ffbconfirmed
8adf7f42b993b6d8b658ea5a9d554a49confirmed
c73fc71ee35e99230941f03fc32934d9confirmed
59502e209aedf80e170e653306ca1553confirmed
864d6321be50f29e7a7a4bfab746245aconfirmed
bb476622bcb0c666e12fbe4ccda8bbefconfirmed
eb69fb45feb97af81c2f306564acc2daconfirmed
f00fd318bf58586c29ab970132d1fd2aconfirmed
6b5a16c382d161788b9cc48d74f91543confirmed
b0ab12a5a4c232c902cdeba421872c37confirmed
1f354d76203061bfdd5a53dae48d5435confirmed
46d87fd65afee2330ee32fe404fe7657confirmed
3bb14adb551663fd2328d59f653ba757confirmed
345b1ea293764df86506f97ba498cc5econfirmed
e3e25957b738968befcf2333aa637d97confirmed
d68f5417f1d4fc022067bf0313a3867dconfirmed
801f34abbf90ac2b4fb4b6289830cd16confirmed
7a2ff07283ddc69d9f34cfa0d3c936d4confirmed
c0e35c4523a7931f4c99616d6079fd14confirmed
ad92ccf85ec170f340457d33bbb81df5confirmed
320df1e8ed4184af06bb4c62a00cc47bconfirmed
37f7e6e5f073508e1ee552ebea5d200econfirmed
24e1bd221ba3813ed7b6056136237587confirmed
b474b7d68214633e93dc1ab3fcad9a4bconfirmed
9f4044674100a8c28f9ed1b336c337ceconfirmed
11cc597cf11ee87c3a0f76dcecf7556aconfirmed
3c2a0d6d0ecf06f1be9ad411d06f7ba8confirmed
08acd1149b09bf6455c553f512b51085confirmed
a27655d14b0aabec8db70ae08a623317confirmed
5de97ae178888f2dd222bb8a66060ac2confirmed
fea26576aaf64f90e067892d07fb8f97confirmed
ce2df2907ce543438c19cfaf6c14f699confirmed
4f6c6295c85743cc3a2ca8f5dc2c4648confirmed
37b679e67208f1af8eed89301450017aconfirmed
c375bbf248592cee1a1999227457c300confirmed
23c82e8c028af5c64cbe37314732ec19confirmed
ab4f947f4649b9ec28d182b02778aa69confirmed
665947cf7037a6772687b69279753cdfconfirmed
860f5c2345e8f5c268c9746337ade8b7confirmed
aa564e207926d06b8a59ba50ca2c543dconfirmed
0ac499496fb48de0727bbef858dadbeeconfirmed
cb84c6b5816504c993c33360aeec4705confirmed
6cef87a6ffb254bfeb61372d24e1970aconfirmed
befc203d7fa4c91326791a73e6d6b4daconfirmed
43041985e356ec1bb76514dd6d7a347fconfirmed
ffb8ea0347a3af3dd2ab1b4e5a1be18aconfirmed
7d123d6987b6fa0f191e9ee2fb0d9484confirmed
d6acee43d61cbd4bcd7a5bdf4ed9b343confirmed
b8939fa58fad8aa1ec271f6dae0b7255confirmed
e5683fb480353c0dec333a7573710748confirmed
bf310319d6ef95f69a45fc4f2d237ed4confirmed
3bd80fc1bbd1476e125d2e487662e01fconfirmed
06178b5181f30ce00cd55e2690f667acconfirmed
0431445d6d6e5802c207c8bc6a6402eaconfirmed
ccd03992b1a52aba460a01a4113d59c8confirmed
b3504546810e78304e879df76d4eec46confirmed
2e82e242cb0684b98a8f6f2c0e8a12f3confirmed
dbe1463d7d1b0850df5e47b5320ef5fbconfirmed
2b8ab9112e34bb910055d85ec800db3fconfirmed
218d4151b39e4ece13d3bf5ff4d1121bconfirmed
029cb7e622f4eb0d058d577c9d322e92confirmed
51bc53a388fce06487743eadc64c4356confirmed
b6b0edf0b31bc95a042e13f3768a65c3confirmed
5466c8a099d1d30096775b1f4357d3cfconfirmed
9486593e4fb5a4d440093d54a3519187confirmed
159238b473f80272fdcd0a8ddf336a91confirmed
d632c8444aab1b43a663401e80c0bac4confirmed
4a022ea1fd2bf5e8c0d8b2343a230070confirmed
132efd7b3bdfb591c1bf2a4e19c710ebconfirmed
5a42a712e3b3cfa1db32d9e3d832f8f1confirmed
e1f97c819b1d26748ed91777084c828econfirmed
57e428c7f6e8430e0380e9a1681a940cconfirmed
c8b0458c384fd34971875b1c753c9c7cconfirmed
644538127a7d5372f16bbc62790e1b5dconfirmed
16ac1a2c1e1c3b49e1a3a48fb71cc74fconfirmed
faa4469d5cd90623312c86d651f2d930confirmed
c561e81e30316208925bfddb3cf3360aconfirmed
a16f4f0c00ca43d5b20f7bc30a3f3559confirmed
SHA170
b3545913847b7cb53fe01d599c5dd35b7c82ad97confirmed
db6376bfd590285e271387c81b676281a7a80abbconfirmed
0211569091b96cffab6918e18ccc97f4b24d88d4confirmed
0282bf2a9dca0a87e7fe2a12480c1cc2ea234b49confirmed
4f632db14f1cda11f7d3f907e746155cde399eafconfirmed
61608ed1de56d0e4fe6af07ecba0bd0a69d825b8confirmed
352687a98fb232e5614f7ce7cd57512553535915confirmed
89df0feca9a447465d41ac87cb45a6f3c02c574dconfirmed
34f4c4ac3500a91c5d9394b247ba1eeb7152535dconfirmed
c8b93462145d8233af5f52c4acea38de255e4701confirmed
2b3981a8889d51bb14a3a974d1578b0161b8784bconfirmed
0336503957730b0669a4575fa64b9c4d9d25f240confirmed
4986d8bca37e0863f5baf25a0da27e6b253d12bbconfirmed
e9731cc102d3c07744a06b63631addf8fc2b3f46confirmed
4e23eca913de2aeb7093cb7ecfbf1dc272ff78b9confirmed
7b5000cbc07308f030f8bedba6620d767a0504b5confirmed
36b2a003df195e2d640412a5791b631037e04e4bconfirmed
dfcd4a66adc4ebd573a48f1715a8f2b0c0291160confirmed
7b24d7332f22c4d9ac72070203745b4bea208cb4confirmed
c972a47804b6c4259b91c24e0c6db0537d03924aconfirmed
4209a007fcf4d4913afad323eb1d1ae466f911a6confirmed
8344f2c1096687ed83c2bbad0e6e549a71b0c0b1confirmed
a6f51730ee561e3395220b2dd26b927d1de4680dconfirmed
6123f7da1f716bbb9e0a8e76255ee6a68c6c9cf7confirmed
a74ebea575319e9e26a5fcd6939e103dbd230eb4confirmed
0c252c9778029cba362152c4623371b70f8e5422confirmed
ca97ac295b2cd57501517c0efd67b6f8a7d1fbdfconfirmed
8d5e3bed94115e93e51e67db815edbab10e35505confirmed
07704be3cb7c7dd6cfb987ded284960f721074fdconfirmed
99d3597fea978d3d8ea6ad1e5727d581ec409c1aconfirmed
8d86e25ee414d49cf925d5fd333443e39eebfc8fconfirmed
b9e6fc51fa3940fb632a68907b8513634d76e5a0confirmed
a02dfebd01369337e01b4f6bfd644d47457bee25confirmed
a8e7659942cc19f422678181ee23297efa55fa09confirmed
d02d93b707ac999fde0545792870a2b82dc3a238confirmed
5168a8880abe8eb2d28f10787820185fe318859econfirmed
6059e4d34dee97e6f63be8cb9467327ceb7c7f90confirmed
56837e2222dd6dd2700afdaf35d7d219b4566dffconfirmed
53785a0d58b774125d702cdd70015be273348314confirmed
72701410c05dda3c088a15f791946cf0861a9bcbconfirmed
89f726a22b1cad37d95befeed64a6c379f7db2adconfirmed
faf580608b76a47bcf181ec44bb36d637112d3faconfirmed
a80655582da300ba1e1c3f4ac78d61a5a8f6d3abconfirmed
cd2267e2d736e925247c2a22e4ca75d7e2ebb21econfirmed
69840d4c4755cdab01527eacbb48577d973f7157confirmed
47a4e0d466bb20cec5d354e56a9aa3f07cec816aconfirmed
a008761e02c15773286457854bc92baa6b2f0781confirmed
570f7272412ff8257ed6868d90727a459e3b179econfirmed
f53f52b9aa4573f7250d7693617f8617ec139aadconfirmed
81f46998c92427032378e5dead48bdfc9128b225confirmed
243ba07c35cf6b13ca5cde030437aa933840ee57confirmed
680fdada9f598f57f774f285dbfea5c383dc5b03confirmed
7d0b494354f1db904f21f52da58f14811c536e15confirmed
483cd5c9dd887367793261730d59178c19fe13f3confirmed
3765c1ad8a1d936aad88255aef5d6d4ce24f94e8confirmed
6c55d3acdc2d8d331f0d13024f736bc28ef5a7e1confirmed
3204447f54adeffb339ed3e00649ae428544eca3confirmed
f9bc806bc1fb99e8e88e3d8f142729bdd5a44ec9confirmed
32f723050afe20a3b5b6c3a1d60db385045a3dbfconfirmed
2f6dd6d11e28bf8b4d7ceec8753d15c7568fb22econfirmed
28e799d9769bb7e936d1768d498a0d2c7a0d53fbconfirmed
e21d95b648944ad2287c6bc01fcc12b05530e455confirmed
94e26fb2738e49bb70b445315c0d63a5d364c71bconfirmed
17ac7424c06f42844b70ac508d12608329d331aeconfirmed
6f5f226c071f97ac46c0b4f4d390fcce3f40b860confirmed
78ba7c54d0ee1009ea8fdf7a198ff3a2b0a7a4f7confirmed
afe50ddb5bf5702a4cc9a6cc21a441b09dbfb2c2confirmed
9f212961d1de465c20e84f3c4d8ac0302e02ce37confirmed
8743083219b6943c0c580093dd4139fe353c9943confirmed
36216f2ef471a3189f175630cebb06f04e30bf4bconfirmed
IP11
185.118.164.21confirmed
104.237.255.212confirmed
5.199.133.149confirmed
5.9.0.155confirmed
185.117.75.34confirmed
192.210.191.188confirmed
88.119.170.124confirmed
104.237.233.40confirmed
185.183.96.44confirmed
104.237.233.60confirmed
185.183.96.7confirmed
URL9
185.118.164.21/index?param=<computer_name>/<username>confirmed
http://hubinasia.com/wp-includes/widgets/main.phpconfirmed
http://www.cankayasrc.com/style/js/main.phpconfirmed
http://ektamservis.com/includes/main.phpconfirmed
https://benangin.com/wp-includes/widgets/main.phpconfirmed
http://gtme.ae/font-awesome/css/main.phpconfirmed
http://adibf.ae/wp-includes/js/main.phpconfirmed
https://www.adfg.ae/wp-includes/widgets/main.phpconfirmed
185.183.96.7/index.phpconfirmed