Lazarus - Operation Applejeus Filename IOCs

https://securelist.com/operation-applejeus/87553/
Neo23x0 · Aug 24, 2018 · c3294a8 · c3294a8
1 parent 479f693
commit c3294a8
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/iocs/filename-iocs.txt b/iocs/filename-iocs.txt
@@ -3060,4 +3060,11 @@ ystem32\\Microsoft\\Protect\\Windows\\svchost.exe;80
 \\cbmsfgrc\.dat;60
 \\mswmpdat\.tlb;60
 
+# Lazarus - Operation Applejeus https://securelist.com/operation-applejeus/87553/
+:\\Recovery\\msn\.exe;80
+:\\Recovery\\msndll\.log;80
+\\Windows\\msn\.exe;80
+ystem32\\uploadmgrsvc\.dll;80
+ystem32\\uploadmgr\.dat;80
+
 # End