Cyclops Blink Sets Sights on Asus Routers

By Feike Hacquebord, Stephen Hilt, Fernando Merces

APPENDIX
Appendix A: Indicators of Compromise (IOCs)

SHA-256 ccae8f66ef880ac02b9affdeaca07a7ddb9428b4f683fd55b35ea3ec20ead5ca

ID 0xA08F078B

RSA-2560 Public Key -----BEGIN PUBLIC KEY-----

MIIBYjANBgkqhkiG9w0BAQEFAAOCAU8AMIIBSgKCAUEArDTQ3wSSUvkK/BdV7rQV

jjmo0tRcvuSz6uQWOzNW2jdV5ngHfJA2JD+4nKuygMH5u1Rw0oL0bPpTtheV3Fhk

SEaQ4E9o19bpLq/NRhsLblBD8yXOHnKMhvu+kkmSFSFkI5uBci15Uz746ret4lcF

L1hSE3pIVPbOr7JWXMlBToXnQmOq9ZiZwfi16YCwSoX7hGPG1egm+RAYAzPm9WgO

BrFqUMara2thAietFyGVqN6fO1DvJoXh4AzTznsYwa8sBRJy5YrhziMcWw8zK/k2

vLMHqD+tc8sp4bt4bCaI/SwHFzKctP7YBbfhyX4P08/6leZ4jNgcbDYrhzxuAmXv

hwfI93WAQ76IWyt994nWLOMs1RCDGrFOno6Q9z14QRQ8U8xEc4ZNEyBlTvLnH3JS

kHmC5zQMhYYzSUY4HPMepasCAwEAAQ==

-----END PUBLIC KEY-----

Telfhash t1f06196ca4c3bce13c522d62c7ce53f1a41465406b463ed005ef8f2684e5356aa18eb79

SHA-256 7923585e8e6117eb6b3fb4a12871bc31b81d54a7ed297927bf72715c45c41da6

ID 0xBD0A5B36
 RSA-2560 Public Key -----BEGIN PUBLIC KEY-----

MIIBYjANBgkqhkiG9w0BAQEFAAOCAU8AMIIBSgKCAUEA2rhl3vp5nrf1oHP+FIKq

whdLKkCO8bBjmZ6t56jw4k2NU4hA/9lExmfT6dZrkmAPltr3DZ2cBmRK6iYaUBHI

foOum16m9Q9fMtcKnsbMDCJ1NyeBB7XcA7hLiPU6Kccw1i+XqNgb/bZl21Cr2bSE

DLSKXxEGGwlX5sUPxM5gPh86DaEdOkgsm74ALEUfmclF6xHRhNeKOehFdZ4ZUf17

r0kM8kyNBZyq56mxWNed0bvzhlwG9/AE2QU8n43q+jAldenhbFS/WapF/sNLPNRs

euRdG8JT13axJnbKnFifRRJkiT4L1L8Nau7L8f1SQ4NUQL1m/uHShM9J4ssIcMWG

Zl+lT+cyGKO9COE60NrgoW3X0DCVfT3lvpiNnP5/rxB2LKddh7qR7mU8JUaWNmDQ

nXFAguFHiCOqq/YAFr3peO0CAwEAAQ==

-----END PUBLIC KEY-----

Telfhash t1f06196ca4c3bce13c522d62c7ce53f1a41465406b463ed005ef8f2684e5356aa18eb79

Appendix A: Cyclops Blink Command-and-Control (C&C) Servers

C&C IP Address Country

1.9.85.247 MY

1.9.85.248 MY

1.9.85.249 MY

1.9.85.252 MY

1.9.85.253 MY

1.9.85.254 MY
 2.192.0.94 IT

2.192.1.120 IT

2.192.6.144 IT

2.192.67.0 IT

2.192.7.244 IT

2.192.71.115 IT

2.192.74.124 IT

2.229.24.16 IT

2.229.32.106 IT

2.230.110.137 IT

12.34.226.34 US

12.172.90.242 US

12.191.39.162 US

12.191.39.163 US

12.191.39.164 US

12.191.39.165 US
12.191.39.166 US

24.39.220.218 US

24.96.94.11 US

24.199.247.222 US

24.227.240.210 US

24.227.240.211 US

37.26.183.94 FR

37.71.147.186 FR

37.99.163.162 SA

37.99.163.163 SA

37.99.163.164 SA

37.99.163.165 SA

37.99.163.166 SA

41.142.240.197 MA

50.192.49.210 US

50.196.104.201 US
 50.243.3.153 US

50.243.3.154 US

50.243.3.155 US

50.243.3.156 US

50.243.3.157 US

50.255.126.65 US

65.183.166.218 US

65.183.166.219 US

65.183.166.220 US

65.183.166.222 US

69.54.25.34 US

70.62.153.174 US

70.89.246.33 US

70.89.246.34 US

70.89.246.35 US

70.89.246.36 US
70.89.246.37 US

70.91.93.133 US

72.68.69.63 US

78.134.89.167 IT

79.11.46.30 IT

80.15.113.188 FR

80.118.6.90 FR

80.153.75.103 DE

80.155.38.210 DE

80.155.38.211 DE

80.155.38.212 DE

80.155.38.213 DE

80.155.38.214 DE

81.4.177.114 CY

81.4.177.115 CY

81.4.177.116 CY
 81.4.177.117 CY

81.4.177.118 CY

82.198.72.201 DE

82.62.143.41 IT

87.139.213.76 DE

87.193.135.123 DE

90.63.245.175 FR

90.85.224.121 FR

90.85.224.122 FR

90.85.224.123 FR

90.85.224.124 FR

90.85.224.125 FR

93.51.177.66 IT

93.51.177.67 IT

93.51.177.68 IT

93.51.177.69 IT
93.51.177.70 IT

96.67.145.115 US

96.80.68.193 US

96.80.68.194 US

96.80.68.195 US

96.80.68.196 US

96.80.68.197 US

97.87.91.211 US

97.87.91.212 US

97.87.91.213 US

97.87.91.214 US

97.87.91.215 US

97.87.91.216 US

97.87.91.217 US

97.87.91.218 US

97.87.91.219 US
100.42.249.124 CA

100.43.220.234 US

100.43.220.235 US

100.43.220.236 US

100.43.220.237 US

100.43.220.238 US

102.50.244.205 MA

105.157.69.243 MA

105.159.248.137 MA

109.192.30.125 DE

137.103.44.146 US

148.76.89.2 US

148.76.89.3 US

148.76.89.4 US

148.76.89.5 US

148.76.89.6 US
151.0.169.240 IT

151.0.169.241 IT

151.0.169.242 IT

151.0.169.243 IT

151.0.169.244 IT

151.0.169.245 IT

151.0.169.246 IT

151.0.169.247 IT

151.0.169.250 IT

151.0.185.146 IT

151.0.185.147 IT

151.0.185.148 IT

151.0.185.149 IT

151.0.185.150 IT

151.84.220.205 IT

156.67.22.130 IT
 162.17.254.17 US

162.226.120.185 US

162.226.120.186 US

162.226.120.187 US

162.226.120.188 US

162.226.120.189 US

178.251.78.84 IT

178.251.78.85 IT

178.251.78.86 IT

182.73.50.114 IN

182.73.50.115 IN

183.171.8.8 MY

184.185.80.174 US

185.82.169.99 IT

185.82.169.99 IT

185.198.198.254 TR
 188.125.98.34 IT

188.125.98.42 IT

188.125.98.43 IT

188.125.98.45 IT

188.152.254.170 IT

190.5.142.154 SV

190.5.142.155 SV

194.219.4.77 GR

194.243.24.214 IT

198.0.120.242 US

198.0.120.243 US

205.237.46.215 CA

208.81.37.50 US

208.81.37.55 US

208.81.37.56 US

208.81.37.57 US
 208.81.37.58 US

208.81.37.59 US

208.81.37.60 US

208.81.37.61 US

209.33.154.42 US

209.33.154.43 US

209.33.154.44 US

209.33.154.45 US

209.33.154.46 US

209.162.240.245 CA

209.181.47.54 US

212.31.113.18 CY

212.103.208.182 IT

212.103.222.218 IT

212.202.147.10 DE

212.234.179.113 FR
 213.166.202.194 FR

216.211.37.59 CA

217.57.78.18 IT

217.57.80.18 IT

217.141.177.210 IT

218.161.2.56 TW

Note: The IP addresses in bold were live C&Cs at the time of authoring this report.

Appendix A: Observed TCP Ports of Cyclops Blink C&Cs

TCP Ports

636

989

990

992

994

995

3269
 8443

Appendix A: SSL Certificates of Cyclops Blink C&Cs

032b81932632de35c638fb3a162e61a859ec96a7 6/13/19 6/10/29

1d78109c682633a692d97e3a0e445ac346204eb4 6/13/19 6/10/29

3438ba29aa7326c06e2d0d1fdf4677fc3f890579 6/13/19 6/10/29

3a938bf9cdb34a50b10227e1452b3a2382f1cfbf 6/13/19 6/10/29

5dde5b3c50e897fa98daff8fe6bb90d0bccf7410 6/13/19 6/10/29

645b4017bb86b3cd9adf87d78b6c2cf32257332a 6/13/19 6/10/29

9749568682af219c4a7edc3f1f5e077fea3b3199 6/13/19 6/10/29

9ae317167849c02294b1d1f5cc42a26d1e112a0a 6/13/19 6/10/29

a2850e272e78d4ec72c3997593696a9201e6ea3a 6/13/19 6/10/29

fc6f3f7343bd028f7e9aefd5fc239a4456e08a24 6/13/19 6/10/29

341fba1927b3367bb562e2561047cca1b6e10355 11/6/19 11/3/29

97e07c31ae997c73d0bd5b989c4d457ec43222fe 11/6/19 11/3/29

c37c2e56aff660b1445105de510506c3a648b679 11/6/19 11/3/29

fe4aaacdf2d36691ca4065f59ea4103d73797830 11/6/19 11/3/29

78c911793dcd9011f99ffacd145fc31a4b8aed47 11/7/19 11/4/29

3781d0b7084bb8491b1c05f325252aebd0f41c86 11/20/19 11/17/29

3a243509406a802a25cb54b8c91f760a7818b053 11/20/19 11/17/29

561ba51b42834e4117caa2ccacc316f8842fdf2d 11/20/19 11/17/29

59d414fda0be25c2cc62c23f0cf73e992699e3d2 11/20/19 11/17/29

6a862edfafe169621fd0205ac4cdfb75e8d0237b 11/20/19 11/17/29

2dbeb423407a5e465b3150c5cdc5037fe08f918c 1/10/20 1/7/30

dbea1a0ac979df94f04431e9a8b10a63d7881b6c 1/10/20 1/7/30

ed30a5645350a75de6ac80699a068444f6426929 1/10/20 1/7/30

5fdd710e8f514a30bd73ba466f5f36caa0e0b591 6/8/20 6/6/30

6df2b3368f17ac97060986ae83c1753af087e152 6/8/20 6/6/30

80b899d4ad0d0062357aa1fc64568602aed4a650 6/8/20 6/6/30

8689ec491dec95a72a56d5c61fbe396fc38f89c4 6/8/20 6/6/30

8f2d4b671412f4f110625374e379bd698bda5160 6/8/20 6/6/30

9ca27e887b6809ff2d41a936b1453e4da7ab1092 6/8/20 6/6/30

e0febc8fe7ff14bdb5d070f7510964b88473576f 6/8/20 6/6/30

f349504661e647fb7b431fa4934a8623cc1661d2 6/8/20 6/6/30

f7922b3b9bca298b41260100f45e93974e6f1eba 6/8/20 6/6/30

b842552d6f19fb05fc2283e015122878d459c60a 7/15/20 7/13/30

47bf0f22402bb85c33720ec1a9a5ed85412a69be 1/15/21 1/13/31

57efcc6b354bfb23e0dc4f6e828e0dd50905be4b 1/15/21 1/13/31

821c012e736a45ffca188f8f77d9e6a34c177bbf 1/15/21 1/13/31

9b85aed5497d7b63619494fe5780e10cd564db15 1/15/21 1/13/31

a1930fef8f879fadf218661967d7ec97f048d1c0 1/15/21 1/13/31

c008fda4b34dfcdf35faf0ad7850ccece13fdd10 1/15/21 1/13/31

d5a7f453a577b2d38b0adf26612e6a4197dea064 1/15/21 1/13/31

fde64cec72d21dbfad2d29aed997bea562912245 1/15/21 1/13/31

14cfe6615b4198d7c948ad32b9a16a73e00a42b3 1/18/21 1/16/31

1db4a62936f13aa12d56bbf48811ba0d12cb43e1 1/18/21 1/16/31

713a6024f483b6669798a1666962ca9b842f0d30 1/18/21 1/16/31

9a7bc345225dfc8ef4c06ab6741345f44cc3eede 1/18/21 1/16/31

223ef00e4c351831ab12f986b8b205f8d845ecee 1/20/21 1/18/31

4005125d4d437b91e9531e7397233d5e1cbfbee3 1/20/21 1/18/31

4510ef44b806ed718f7c87d6993a4cb22e93000d 1/20/21 1/18/31

49d89c7f1b304d7f12ccf0a7d6cbea830e44c4f9 1/20/21 1/18/31

5ea1e512c0d3708cafef682fffc84d193ec36add 1/20/21 1/18/31

7350e6fa073c65ac8e7f26aead5e84792e358910 1/20/21 1/18/31

a397af8074cc1a19d57cbaf0230b1b7c9880ddbf 1/20/21 1/18/31

7339f3584a2d8d63e3b78136d530dda6ab3b6749 2/10/21 2/8/31

408da97d8e4911b2461b44792dc7c2c253efc91f 12/20/21 12/18/31

88ca87a3b38080d85690538f3dfe7843eefbce19 12/20/21 12/18/31

TREND MICROTM RESEARCH

Trend Micro, a global leader in cybersecurity, helps to make the world safe for exchanging digital information.

Trend Micro Research is powered by experts who are passionate about discovering new threats, sharing key insights, and
supporting efforts to stop cybercriminals. Our global team helps identify millions of threats daily, leads the industry in
vulnerability disclosures, and publishes innovative research on new threats techniques. We continually work to anticipate new
threats and deliver thought-provoking research.

www.trendmicro.com