Malware Analysis IOC of APT task

[didodid]

Hello,
I am new to cybersecurity and I have a task to solve.
I should create an open .ioc file containing indicators of APT29 or APT39. (I should have minimum 5 indicator types).
My resource is https://www.fireeye.com/services/freeware/ioc-editor.html
Could you help me where i can find reports containing IOC of APTs or some guide for the task.
(I found some information about IOC in Mandiant.com, but its not enough)

 

[silversurfer]

That may does help you, IOC related to APT29. As usual, you have to scroll down until the end of this report below...

Indicator

Details

1326932d63485e299ba8e03bfcd23057f7897c3ae0d26ed1235c4fb108adb105

TrailBlazer SHA256

2a3b660e19b56dad92ba45dd164d300e9bd9c3b17736004878f45ee23a0177ac

GoldMax SHA256

• StellarParticle is a campaign tracked by CrowdStrike as related to the SUNSPOT implant from the SolarWinds intrusion in December 2020 and associated with COZY BEAR (aka APT29, “The Dukes”).
• The StellarParticle campaign has continued against multiple organizations, with COZY BEAR using novel tools and techniques to complete their objectives, as identified by CrowdStrike incident responders and the CrowdStrike Intelligence team.
• Browser cookie theft and Microsoft Service Principal manipulation are two of the novel techniques and tools leveraged in the StellarParticle campaign and are discussed in this blog.
• Two sophisticated malware families were placed on victim systems in mid-2019: a Linux variant of GoldMax and a new implant dubbed TrailBlazer.

StellarParticle Campaign: Novel Tactics and Techniques | CrowdStrike

This blog discusses the StellarParticle campaign and the novel tactics and techniques used in supply chain attacks observed by CrowdStrike incident responders.

www.crowdstrike.com