Delving Deep: An Analysis of Earth Lusca’s Operations
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf

Doraemon

SHA-256

---------------------------------------------

2d3699607194d1a2a6c1eeeb5d0e5e5e385b78d94d5053e38e3c1908c5ced1c6
95aa15baeef978b99e63a406fa06a1197f6f762047f9729f17bb49b72ead6477

C&C server

---------------------------------------------

dsyu.livehost.live
dust.dnslookup.services
http://www.akiyaku.jp/images/images/mm.html
http://www.n.co/1/1/1/1

---------------------------------------------

Cobalt Strike

SHA-256

---------------------------------------------

46aedd46f54967c9c9dbfabc04237a4808981086d94c5fd5482a5d42e34d8b1f
d71a7b1efc4a06afffd94f526ad496368a9c4489296076449c74eec2d76ee4ca
6a4e32229e5ca41e8eca99cefe5beef3e3621c2199f8844b4d218c14b5481534
8be8a6f8fe7c182a5017040aa8c8cfc9cefbcf8f3d1be932c7e710101c34d57e
82a0e722f6746d6f1db58b365c0f15da135bff170d2000858d6e345712ea8732
c6a027d3c7e4734e4cf62741f7fb58f225dcb5ad36af75c6e19a4e3d870294e8
28c9a18366475de99f5959750e2f3c526668bee78af3419c646a514eecaeebbd
d36deb308bd61d31d919d4d77f5c12ac108042da9b9301678859229e2fc891e1
44fa4d2db0b68a0638e0d28594fd446ef2615755c9fc001e7e2e80feea3052ae
93956d3ebb0614ff5c959bed7edaf4f3f41df4538468de0f84f3e27b8e3bde49
5e9d0dc03f725337ec3e2a426d982563ff2ec0232c829325599e721d4307bb9a
586dc1eb6e9f910e3cba04f80ad6ce61abfe523f93f09b7188afd3c780bf81fe
7fd30094c50e324431fd913076c46ccd722ba2eb5a670d129e3fd3f45c124383
7a0b6ab149abd2c053278acda610ed2a2a07a8e70d8897fe34eaebaa3fffcfb8
abf59d67fcafa42fb5d4f562870af2aa092c678673b6c404b5afe2eadb18229d
318dbf3cfca46574c16f5e20828b2a878665a8209120efd9e611d8cf98954afa
161afaaa83bc5202af3e4f7a083fa3f888d59f381f7a3e06176dc8e048fe066f
c7a9eb1c6d1bbea60759fa6e4396254d897922bc86c6c1d1b520f0a2357184d6
f819177fb5f6489f3cf0ff402bbf5d4678c2b703e09c1e26ac00fb08376edb13
2fe174c17383598025c3af714cbd4807ed5eac3ba17b1ac444794de6650bc188
afead6dc93f0a64c68b091420d9b884550418e9322109d483eb625e7694f8105
8559fe618ca3841b9f541a034393cfe8b454751fb99791c4c6de1b20ac08d803
4814e8baf52df7a17af3d88aba38d7bce4aed753a05b3d64478d4efedccc6625
98356e59608a77921d0f6f2ac95ab58302d69e9333447aab91512e0976c8b368
4347bd2231fcda57da6201dde35818817fca05c2222d3660b49eb98eb07e322c
e1efba0b38226e882a3cf3ce3b6374d0c825170057ea7d07141ae95e054de4a3
2409047d04b8d3317710eca9e5d97e56a5210b07781903b2f2dc29358c1d4c56
171403ea31eb670cc240305dfda802f06f01339587ae02384f9d3b01720432c7
2e8652950932b5f3e8901b125d4198b2cae3abde50dcf072e77c788c0f76b43a
9d514cdf1db58f7eef40a7bea52c9e646b5db0f81ed2809caed9a68b97665d99
66667b603352399069facd78a6d8903f40b5c6e6cfaafb924873b0e590f2a696
9a73700d5c704c884cb9c905b4e4dfdf299ade57eba52801ae1d076137cff552
2ca332d56d0e032be324b6ed2c014f4edf9cfa328bc5ac61e5434c9ddf7c17b6
7f40b8c0d45d7290fb55552e7da28bec2efa8797ab13662f62bb72c74cb7dc01
89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54
97b2f7ef4132f27c615cec5fb75f8849b4576f5d6d1d1111074397596c946b8d
aeb4a8f6115bbba85513ded12a9c31a00e4e3a60ae501fbbf43510782289fe92
d9cfc3b7544927a2d5d56f0d4767b88b83a91616aa3b0a4a1846fd7881a4e0f9

C&C server

---------------------------------------------

coivo2xo.livehost.live
www.getdns.gd
cookiestest.ml
qqfinance.ml
lzfhome.xyz
ybk47i6z8q.wikimedia.vip
w01grw7gs.ithome.house

---------------------------------------------

Winnti

SHA-256

---------------------------------------------

e46fcaac5f65a410040010c338f2fc02d9ac0327344acab8ce5152529312c4ae
66923293d6cd7169d843e26aade13896ce77214fbe256bd925d7b96187b2aa48
11e02158d456bb43c7d8abfc34cf46ad0eccf7c93959ac90df24f52ce6d8962c
88cc62d5eeb21590da9b67b25ba588c2975a45289a829ab27b820eaa2ff88ea2
367021e9ec138b8283fa83d5258bb06022f08aa129a9c6537203238b1bce538a
96cb323da444f9c65043cc69c4d85f9c72d6c9d47c2cdcfa8caec455a9b9357e

C&C server

---------------------------------------------

lmogv.dnslookup.services
smtp.nslookup.club
3VnwTuq9s.ithome.house

---------------------------------------------

ShadowPad

SHA-256

---------------------------------------------

92d224568617795959723e2cc22d6e244d225c2210758f08965d5844f24feed8
196507c6dc3541c131085f034609ba533fbafc54bee0477dab9c7bc214900e30
6de4eb04725383af828d319f6253f65b939727df26b35ca424b92e11ebb7110d
54538baa089bdd0aecc54bd3e8c3bdbb5dbf2eae18ed3178c8015b0d150bcba0
edee57d418cbde1a7ab44edfbc2c4f99dbac107a823b4f4a5ccace25d0d2b108
dbb32cb933b6bb25e499185d6db71386a4b5709500d2da92d377171b7ff43294
8065da4300e12e95b45e64ff8493d9401db1ea61be85e74f74a73b366283f27e
c602456fae02510ff182b45d4ffb69ee6aae11667460001241685807db2e29c3
94295f90dc5fb03fc47e8e2144774f103b8a29d2ada101173f193cd0c8a38f3d

C&C server

---------------------------------------------

5s2zm07ao.wikimedia.vip
r1d3wg7xofs.livehost.live
6czumi0fbg.symantecupd.com
1dfpi2d8kx.wikimedia.vip
5NcNt6z1.wikimedia.vip

---------------------------------------------

FunnySwitch

SHA-256

---------------------------------------------

3fe1b293d8a50db95d50e6eec9773e9c2e552a0122fe4428de8d31061092d330
06a5413e0ffadc4d4fcaf4782ef81d3e1b7a860c580bbe37e9c0e9940e68161e
f37c19b86a5b8b6c71d7350894506c7278864f7f968d0593a5e477c728b91372
23dfce597a6afef4a1fffd0e7cf89eba31f964f3eabcec1545317efeb25082ed
6f258841a10be2543878dc8479098f8fe1752f4cbd7c29d6854f5329d0960e87

C&C server

---------------------------------------------

7hln9yr3y6.symantecupd.com
bm2l41risv.livehost.live
o56n1tosy.livehost.live
mztfki9x.wikimedia.vip 
ok3x377v3f.symantecupd.com

--------------------------------------------- 

WebShell

SHA-256

---------------------------------------------

d7ecfd61915972f1d74f51039fc97a3b2d855a13c70a052ebb1bc80e78dd3382
d7078956cb7be6e7e6751ec66ff0e1c428a67d8ab6be03f9ed6fbcede866c39e
cd335698d4c2422e924fdc67dcceb2037c954d875f03aa298d9fb5f0db851548
4d0c611bece3baa5d1502b50779be653e25c0ac8679111628d32686002743600
60b4d23d41707ef7fc09e01f1864cb0d8c8a4f5d180fc97e559356780efcd54b
7aaf33bb2979262590932dcfd6902d09a3c0045d906570a15123fa12f8656171
ececbed665469514ed8583a4928f9a524f00a9b9c3c042015717ea22614398e4
b081db87c75b6aea905a62532cb40bc21bc7acebb7a0c6c601d993c76a8c6ce1
bb45df12b63e5b133e6cb622b174ad68bc95a5bce15f98eede56597d38401b27
566152a2d86186dcfb28856b4ed0dfdb60e355d93ab693f7931201f75868fff0
e2e969efc2d688e01a9aa32d50176374af811a3324651fb03b7b848e06e0b677
c0725296e8ab3d9d3c932ecf45588f39ef8fa7a310d31bfd05a061194f8eeb1e
b151285b331ab2450e2f7387590b29348ebb6f34391d4b10958faea715027795

---------------------------------------------

Tools 

SHA-256

---------------------------------------------

b5577248f532c2939db023d279d625fa4c01e9ee68441fe90046d2b6e79ac1d7
9ee8b7ab27830bf615ce82f4b4930d10b735837842dfdd1d7ed25a460f76b863
7d036e80f607710376a881653d7c26b4dfba87e45dbfc69bcb913dbc01d67ef2
de4d7ea590f1f27f6ceae6de40802f632eff7028cdb51c03b5f799da08abf80d
9d2d265c0761366f2d8063bf2aed877fe9ada98008cc777919f75866b57febb8
c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc
b16ee7b7cc4fbb390c9ee7a0be1760743b521514d1100dc20cd3972de7d5252d
622c797683ef9f83cf1f33367e5dc9b61cfd577f4edc674d1ea6d5b310558097
3ea02150e161a7c10e845e1ca7504fe399f8f482603490b38a41e748b6580d02
a49923faa7d2a2a5e191a0aeca3ffd484655be1fdaaef81b3a85f28ce65859ae
c4071807b1d03b9db79f1281785d89700c88008ec544b17488e2132ed89a32ac
d1871f94304fdd7fea81f9a6a06908eaf8744bc784e698eb36a352f9e2b2049f
8d841149791b51f226249d0e5459f9b97f796be5a4e10ddc38eafc393288a7f4
2e9fbdcb3b13bd05cf9f35125efb1ca9e28d9afba8d9ae33e471075b0cafb16f
0025f9eaa43f5bb04b5c1f751334b8fec1024c2cf04f8124d6051ab1d1ebf448
c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e
2951af1fbf080341f977c7f8fd9916a42ad1f3d25fe7175def598600d946898e
b77c08892dd3fe6a938201b56236130f487b6c0fcf132a73b9bfa2baf0b45c46
a76eaabc4e8ba5d6b3747825a9fbc286d44d3981ac521119902d64ae2fdcc4b7
28332bdbfaeb8333dad5ada3c10819a1a015db9106d5e8a74beaaf03797511aa
9cbcc08529dad8f0aae689dbacffa34b5c4895d49cf68a81c785f578482598a7
9042e5a9ce45e4288f1396ff8e3ba27e16b500d431f8b2da1baba3c35b7782ba
f1a3cff4428b86501abff58d98a740ad60388ea8588190ee169d956544b4d4ad

---------------------------------------------

XMR Miner

SHA-256

---------------------------------------------

625a6ba45d06b3387b50802d3eac280bb854327348b3a3fe4863cd0bd8a69a55
21cf3727a9e58f346bcdf039ad23ca8838dae902d0596726332f5815672d22e7
949aa21dcf474003f06735cacdc9938bed366c64fde6ced58a3336b007c0bb7b

---------------------------------------------