indicator_type,data,additional_data,description
source,https://businessinsights.bitdefender.com/apt36-nightmare-vibeware,https://intellizone.bitdefender.com/en/threat-search/threats/BD9a057rfr,APT36: A Nightmare of Vibeware
file,a5f8e394f7098294b2983f7cd7e750c3,,CrystalShell Slack
file,3cf6bc05a246ddb7bf875381a9bdf7d4,,CrystalShell Discord
file,8a1f290595e459cbfb55fa4c3a58ee0b,,CrystalShell Discord
file,41e952209f149525e4be1eea7961b00b,,CrystalShell Discord
file,83d3def856a88bad32d683ead6cf540b,,CrystalShell Discord
file,c9423c4cb3f520ae60fdd1bf4b9e64b4,,CrystalShell Discord
file,f916e6cc69a4e6a2fcbbcc7fe046f383,,CrystalShell Discord
file,913199ea8343ac030f4fe8dcb215a2eb,,ZigShell
file,54380dfde28bb96e5a3a0dadbf9c4cb0,,ZigShell
file,8aeb2fb5a8d863126588ff91186d4c0a,,ProcessFile
file,379c8e420d4fa723751677571c6a52ee,,ProcessFile
file,83822297319d8961f4a87805df963a48,,ProcessFile
file,c8d2d1837c75cf5050dc679a40e6c394,,ProcessFile
file,fa2dc49926eb370dc755d7681eae2a85,,ProcessFile
file,9652d51cde165d405916a8f3e26e7318,,ProcessFile
file,0fbb0143272c325f4b540819a84826b5,,LuminousCookies
file,2e75e109184a7f6473258bf00440bfd0,,LuminousCookies
file,47ff0ff8336a207722a8dcd0d3e92825,,LuminousCookies
file,2fc4c9cf0b2b52e8840ca7a3f38034fb,,BackupSpy
file,ca2edac970d8afed99db4b5cda72a13e,,SupaServ
file,bea885be7d43627211504dc51685db0e,,SupaServ
file,569bb4899de5759c32ea6df661c35d4c,,SupaServ
file,86e72d95b2a8d49c6537076934fda2fe,,NimShellcodeLoader
file,62c335a4c4ab14bbc85eb1c026db2f8a,,CrystalShell Loader
file,c57a340368c9996b8ded4af57a8c3686,,SheetCreep
file,32277138366754f6e8514bb89ed74741,,SheetCreep
file,857f5f12a88d35dbabdc9a61bc692238,,SheetCreep
file,ed4dd29c57a38f2bb1934acbaeadeeba,,MailCreep
file,c8593e311e3cc8443a3187cd7666018b,,MailCreep
file,39e6cd3e098a0c23f1695e3e8ad4a30c,,MailCreep
file,f82d87182c19cc4811e952e1c18ef71d,,AllRounder
file,ed95f38533247a4bb7ad49db297dbe1b,,AllRounder
file,acae98c2997aa85e7b0789a99b6c106a,,AllRounder
file,82f322d4665589191da19e1e663b7d51,,AllRounder
file,c0218ece73d9046e25293fbef71bc70c,,ZigLoader
file,f465416476bb3838e982da81aa4aee5b,,Gate Sentinel Beacon
file,7804b006084b6f582f2f74ff758d8cee,,Gate Sentinel Beacon
file,12289d965b800c8450526bad29f70669,,filecopyU
file,e2f6b3d71063b22c0d88c194e9148eaf,,filecopyU
file,5ea7da52f69f0772621a227007413959,,filecopyU
file,3e9b3306644b1a4d8c3ac23c7e0d4c7b,,filecopyU
file,16be323504052f95cf670e1f3a705892,,filecopyU
domain,hcisupport[.]in,,Initial Access Domain
ip,45.56.162[.]192,,Initial Access Domain IP
domain,hcidoc[.]in,,Initial Access Domain
ip,193.29.56[.]122,,Initial Access Domain IP
domain,coadelhi[.]in,,Initial Access Domain
ip,104.238.61[.]237,,Initial Access Domain IP
ip,23.152.0[.]81,,Havoc C2, also used as CobaltStrike and Mythic C2
ip,45.56.162[.]170:8000,,C2 used to download malicious files, also used as CobaltStrike C2
file,3f834e31f560d9d58bd7849cddda5769,,Xaitaz ChromeElevator - NOT indicative of APT36, but included here for completeness as it was observed in the same environment as other APT36 tools
file,12b4800a37b97cfc031e52ea06e0a7e2,,Xaitaz ChromeElevator - NOT indicative of APT36, but included here for completeness as it was observed in the same environment as other APT36 tools
file,62411d171212eeb325ce00d357bf0795,,Xaitaz ChromeElevator - NOT indicative of APT36, but included here for completeness as it was observed in the same environment as other APT36 tools
file,04939089f73d100ab4948cda2a1e3736,,Xaitaz ChromeElevator - NOT indicative of APT36, but included here for completeness as it was observed in the same environment as other APT36 tools
file,fa01bbb5effe12423953c757fd0cb111,,Carved4 go-crypter - NOT indicative of APT36, but included here for completeness as it was observed in the same environment as other APT36 tools