We didn't look at the hashes or using hashing to identify anything. It's quite a story actually:
The report provided a Yara sig for PHP malware. We used that to search our own attack data that we log and we found the full malware sample that matched the sig.
But it was encrypted. It's a small piece of PHP that gets a key from a POST param or COOKIE and decrypts the executable code and runs it. Quite smart actually if you want to obfuscate code. So we needed the key.
We looked at our attack data and thankfully we logged one of the attempts by an attacker to access the malware including their key. It was just 4 lowercase chars so we could have bruteforced it.
We decrypted the malware. That gave us the name and version. We googled that and found the distro site. Claim they're a Ukrainian group and the version DHS has a Yara sig for is several versions behind.
We downloaded it. It's a standard PHP 'shell' malware which means it's just a utility to manage a compromised site. File management, upload, OS info, OS command running etc. Nothing super scary and the most common malware we see. Nothing that would infect a workstation in a watering-hole attack.
Regarding the IPs: No we just did a PTR lookup and assumed they're Tor exit nodes as they say they are.
Mark.