fox-it / Operation Wocao
Operation Wocao - Indicators of Compromise
Stars: ✭ 29
Projects that are alternatives of or similar to Operation Wocao
S1EM
This project is a SIEM with SIRP and Threat Intel, all in one.
Stars: ✭ 270 (+831.03%)
Mutual labels: suricata, yara
Ghidra scripts
Scripts for the Ghidra software reverse engineering suite.
Stars: ✭ 732 (+2424.14%)
Mutual labels: yara
Stoq
An open source framework for enterprise level automated analysis.
Stars: ✭ 352 (+1113.79%)
Mutual labels: yara
Strelka
Real-time, container-based file scanning at enterprise scale
Stars: ✭ 387 (+1234.48%)
Mutual labels: yara
Qnsm
QNSM is network security monitoring framework based on DPDK.
Stars: ✭ 334 (+1051.72%)
Mutual labels: suricata
Didierstevenssuite
Please no pull requests for this repository. Thanks!
Stars: ✭ 856 (+2851.72%)
Mutual labels: yara
Peframe
PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
Stars: ✭ 472 (+1527.59%)
Mutual labels: yara
Suricata Rules
Suricata IDS rules 用来检测红队渗透/恶意行为等，支持检测CobaltStrike/MSF/Empire/DNS隧道/Weevely/菜刀/冰蝎/挖矿/反弹shell/ICMP隧道等
Stars: ✭ 397 (+1268.97%)
Mutual labels: suricata
Mitigating Web Shells
Guidance for mitigation web shells. #nsacyber
Stars: ✭ 698 (+2306.9%)
Mutual labels: yara
Pulledpork
Pulled Pork for Snort and Suricata rule management (from Google code)
Stars: ✭ 339 (+1068.97%)
Mutual labels: suricata
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (+1413.79%)
Mutual labels: yara
Holmes Totem
Investigation Planner for fast running analysis with predictable execution time. For example, static analysis.
Stars: ✭ 25 (-13.79%)
Mutual labels: yara
Operation Wocao - Indicators of Compromise
This repository contains the indicators of compromise related to the Operation Wocao report.
Operation Wocao (我操, “Wǒ cāo”, used as “shit” or “damn”) is the name that Fox-IT uses to describe the hacking activities of a Chinese based hacking group.
The full report can be found here:
Available IOCs
| Filename | Description |
|---|---|
| ips.txt | The various IPs obversed, either as C2 or as operator IPs. |
| hashes.txt | The hashes for various malicious scripts and binaries. |
Available signatures
| Filename | Description |
|---|---|
| yara.yar | Contains Yara signatures to detect various malicious scripts and binaries. |
| suricata.rules | Contains Suricata signatures to detect XServer and other malicious traffic. |
Context for IP addresses
| IP | Hoster | Active period | Description |
|---|---|---|---|
| 185.244.150.236 | Host Sailor | 2018 | Identified in the memory dump of a compromised machine. Used as a command line argument for a PowerShell backdoor. Also used to access webshells. |
| 217.182.129.156 | OVH | 2018-2019 | Back-connect used by the agent backdoor. Identified based on compromised machines connecting to this IP with a known suspicious client hello value in the TLS handshake. IP is hardcoded. |
| 23.254.211.108 | Hostwinds | 2018-2019 | Used to connect to a VPN concentrator with stolen credentials. |
| 108.61.179.160 | Choopa / Vultr | 2018-2019 | Used to connect to a VPN concentrator with stolen credentials. |
| 198.46.140.26 | ColoCrossing | 2018-2019 | Used to connect to a VPN concentrator with stolen credentials. |
| 31.222.185.215 | Rackspace | 2018-2019 | Used to access webshells. |
| 45.77.229.10 | Choopa / Vultr | 2018-2019 | Used to access webshells. |
| 46.101.153.58 | Digital Ocean | 2018-2019 | Used to access webshells. |
| 62.141.37.236 | myLoc | 2018-2019 | Used to access webshells. |
| 95.179.161.243 | Vultr | 2018-2019 | Used to access webshells. |
| 138.68.144.161 | Digital Ocean | 2018-2019 | Used to access webshells. |
| 185.191.228.108 | Cogent Communications | 2018-2019 | Used to access webshells. |
| 209.97.140.206 | Alameda | 2018-2019 | Used to access webshells. |
| 46.182.106.190 | Tor exit node | * | Used to access webshells. |
| 141.255.162.36 | Tor exit node | * | Used to access webshells. |
| 185.220.101.0 | Tor exit node | * | Used to access webshells. |
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].