THREAT OPS › Threat News › STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus
<div class="block-paragraph_advanced"><p>Written by: Jordan Jones</p> <hr /></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY
Attributed threat actors
- TurlaG0010
MITRE ATT&CK techniques
- Windows Management InstrumentationT1047
- JavaScriptT1059.007
- AppDomainManagerT1574.014
- MasqueradingT1036
- Email AccountT1087.003
- Web ServicesT1583.006
- PowerShellT1059.001
- Inter-Process CommunicationT1559
- Web ServicesT1584.006
- Hijack Execution FlowT1574
- Remote Desktop ProtocolT1021.001
- Environmental KeyingT1480.001
- MasqueradingAML.T0074
Indicators of compromise
- ed88a43801b5c58b9be27fa74abaa278a48904f3cc1bc905f2d85e32448b96c5sha256
- d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3esha256
- e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6sha256
- 1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24sha256
- 1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011fsha256
- 81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bacsha256
- 9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ecsha256
- 34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368bsha256
- 0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61bsha256
- 2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7sha256
- b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cffsha256
- 82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eebsha256
- 249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecbsha256
- b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5asha256
- 40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50sha256
- da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40sha256
- 9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73sha256
- e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722sha256
- dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22sha256
- 2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0sha256
- 40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3sha256
- d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43sha256
- 98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397sha256
- 6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342sha256
- 0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4sha256
- 626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459sha256
- 447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4sha256
- 45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893sha256
- 80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661sha256
- 55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352csha256
- e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ffsha256
- 19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9sha256
- 6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58esha256
- d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3sha256
- 4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320sha256
- f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99edsha256
- 7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78sha256
- b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636sha256
- a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196cesha256
- e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8sha256