Topinambour

  • The way of propagation

    Trojanized software installers
  • Purpose/Functions

    Cyberespionage
  • Special features

    Please find more information here:

  • Targets

    Diplomatic organizations/embassies
  • Artefacts/Attribution

    Indicators of compromise

    C2 HTTP GET templates

    • http://:/file
    • http://:/update
    • http://:/exit

    Some campaign-related MD5 hashes

    • 47870ff98164155f088062c95c448783
    • 2c1e73da56f4da619c4c53b521404874
    • 6acf316fed472300fa50db54fa6f3cbc
    • 9573f452004b16eabd20fa65a6c2c1c4
    • 3772a34d1b731697e2879bef54967332
    • d967d96ea5d0962e08844d140c2874e0
    • a80bbd753c07512b31ab04bd5e3324c2
    • 37dc2eb8ee56aeba4dbd4cf46f87ae9a
    • 710f729ab26f058f2dbf08664edb3986

    Domains and IPs

    VPSs used as control servers

    • 197.168.0.73
    • 197.168.0.98
    • 197.168.0.212
    • 197.168.0.243
    • 197.168.0.247
    • 197.168.0.250
  • Description

    A malicious toolset discovered in 2019 that was utilized by the APT group Turla. The malware is delivered to targets via legitimate software installers infected with the Trojan dropper. Once delivered, the attackers gain remote access to the device.

    Additional information