Mandiant APT1 Report Appendix F Update: SSL Certificate Hashes

The following are MD5 and SHA1 hashes for the DER encoded SSL certificates released in Appendix F of the recent Mandiant APT1 report. We are releasing these to aid network detection of APT1 SSL-encrypted malware traffic.

SIGNATURES MD5 SHA1
ALPHA 6b4475ce9f9c5c4b9d2e7edc8bdbf849 b054e26ef827fbbf5829f84a9bdbb697a5b042fc
AOL 9588bf142248bb8ddda05567f159b1a7 7bc0cc2cf7c3a996c32dbe7e938993f7087105b4
AOL 455f8979143415b9eed0e0d6fc153c1c 7855c132af1390413d4e4ff4ead321f8802d8243
AOL 80c982508b78d4b5bf1d64a181d477f9 f3e3c590d7126bd227733e9d8313d2575c421243
AOL 98153da6e11ee7c6132345ac8b716679 d4d4e896ce7d73b573f0a0006080a246aec61fe7
AOL 8d9ef1704857fcefc6f476abc3690597 bcdf4809c1886ac95478bbafde246d0603934298
AOL 3d3d57b3c4ceea9985f4e00daef40239 6b4855df8afc8d57a671fe5ed628f6d88852a922
AOL 62e1450f0ce0d80d1148ca25d805537b d50fdc82c328319ac60f256d3119b8708cd5717b
AOL 428584cbf6c150f794e1eb505f0ae03c 70b48d5177eebe9c762e9a37ecabebfd10e1b7e9
AOL d50189fd73a18bd9af3b5a7208c3a353 3a6a299b764500ce1b6e58a32a257139d61a3543
AOL 2dece470908e49b7dfc067a7371b0f83 bf4f90e0029b2263af1141963ddf2a0c71a6b5fb
AOL 039d81836dfb02f5299a7053f8908207 b21139583dec0dae344cca530690ec1f344acc79
EMAIL 0189e307c3abe5dd56937eeb06badaea 21971ffef58baf6f638df2f7e2cceb4c58b173c8
IBM 22da947f2df649c802ed496b2ccf4bc1 04ecff66973c92a1c348666d5a4738557cce0cfc
IBM 38e7c187b6dbbc329ad70d23c92f51ef f97d1a703aec44d0f53a3a294e33acda43a49de1
IBM e179aa7e3e1a3dbb3f56ee9ecc1b23a8 c0d32301a7c96ecb0bc8e381ec19e6b4eaf5d2fe
LAME 773ec2b9047beb82497e499c1be2c2fd 1b27a897cda019da2c3a6dc838761871e8bf5b5d
MOON-NIGHT 2d3c66e46930fe1d959f28c8a45f0282 d515996e8696612dc78fc6db39006466fc6550df
NONAME 0ef1386ec78e966beb4e6a199ca5abf0 8f79315659e59c79f1301ef4aee67b18ae2d9f1c
NS 9619fa9d77e7e1daddf677085ed6e27e a57a84975e31e376e3512da7b05ad06ef6441f53
SERVER (PEM) 249d75f0d70818204f9130be59c95cad b3db37a0edde97b3c3c15da5f2d81d27af82f583
SUR 71cdf4068e9ea76c853bec4701700da6 6d8f1454f6392361fb2464b744d4fc09eee5fcfd
VIRTUALLYTHERE bc1fc00b050d812eac595e802b363fa7 b66e230f404b2cc1c033ccacda5d0a14b74a2752
WEBMAIL cc9893cdc79c15127ff52ee0ee85a771 4acbadb86a91834493dde276736cdf8f7ef5d497
YAHOO 596f3e7660e0a5bd79c33f7a50c17565 86a48093d9b577955c4c9bd19e30536aae5543d4