sha1: c321233155af13a53ecd746eaab84cc6ac69d510 sha256: ef17d44cde003c17c28137c6d4692eb4a1b42f86e5d6995f2f06a05e363f044a


md5: c1be341ffc0f58bafdf4e5210b881106 sha256: ef17d44cde003c17c28137c6d4692eb4a1b42f86e5d6995f2f06a05e363f044a


md5: c1be341ffc0f58bafdf4e5210b881106 sha1: c321233155af13a53ecd746eaab84cc6ac69d510


sha1: 6f8cc7abbf3185a085aa43186c5da332b04c3156 sha256: 42ef77391f20ffc1751ded79da25376bc20a007d03e501049fff37f781df5403


md5: 9a6b1bd3b7f13d30d1595b874f513744 sha256: 42ef77391f20ffc1751ded79da25376bc20a007d03e501049fff37f781df5403


md5: 9a6b1bd3b7f13d30d1595b874f513744 sha1: 6f8cc7abbf3185a085aa43186c5da332b04c3156


sha1: a7de9de3774ad507e7d1ddfcce4924625a600434 sha256: cae7622a5f1ed791d317db0b3bc791a8ab71a9c68837282435f5db6bab540615


md5: ab6a57e40ba74135de9fc6b8f37efa7b sha256: cae7622a5f1ed791d317db0b3bc791a8ab71a9c68837282435f5db6bab540615


md5: ab6a57e40ba74135de9fc6b8f37efa7b sha1: a7de9de3774ad507e7d1ddfcce4924625a600434


sha1: 493e89a70c4176dcec50f34b79eaa4f910e50800 sha256: 2707602481a025da29438d01e894cfc9742389d419a5b08aa96ddc76bde38cba


md5: 7949b560ecf60644e2b537199589d67b sha256: 2707602481a025da29438d01e894cfc9742389d419a5b08aa96ddc76bde38cba


md5: 7949b560ecf60644e2b537199589d67b sha1: 493e89a70c4176dcec50f34b79eaa4f910e50800


sha1: ab64d32da52a1e516b0c874aad006db404f9c21e sha256: 5311e4fd3329945496962c6417b74da919f5e50ae20ba7ab0d5983012c956f4b


md5: 81de205ac5e44e1167c0c01c7207c6c4 sha256: 5311e4fd3329945496962c6417b74da919f5e50ae20ba7ab0d5983012c956f4b


md5: 81de205ac5e44e1167c0c01c7207c6c4 sha1: ab64d32da52a1e516b0c874aad006db404f9c21e


sha1: a3225a0bbb66b5babf52466ae23a1538407f0cef sha256: dc3c1df20d73a62e8219ed6193ecf1229845dd0a6e42d32eb11cbaee04cfa7df


md5: 4fdb78de4da91c06e5778feb560750f4 sha256: dc3c1df20d73a62e8219ed6193ecf1229845dd0a6e42d32eb11cbaee04cfa7df


md5: 4fdb78de4da91c06e5778feb560750f4 sha1: a3225a0bbb66b5babf52466ae23a1538407f0cef


sha1: c5c844582c0590cdc901c253a121568251154c61 sha256: 70e43da5c5b6a8cfea8fcad768a2e5cfdf532b49b5ac87ec8ca9d05d83e0e915


md5: 2ec55245fbe57cae1a045f9106ca709a sha256: 70e43da5c5b6a8cfea8fcad768a2e5cfdf532b49b5ac87ec8ca9d05d83e0e915


md5: 2ec55245fbe57cae1a045f9106ca709a sha1: c5c844582c0590cdc901c253a121568251154c61


sha1: e49d21f1e66268715efc6003c4e2d3b98cee666a sha256: 1473fcf2297376a819b6cccd50dc709fb61f48f70dc9a0eaff741c893b33d670


md5: ffc18496b2b1563e081beefc9e884769 sha256: 1473fcf2297376a819b6cccd50dc709fb61f48f70dc9a0eaff741c893b33d670


md5: ffc18496b2b1563e081beefc9e884769 sha1: e49d21f1e66268715efc6003c4e2d3b98cee666a


sha1: 28ed17b046e0bed3d1cde67eccf241ecf01fe3c4 sha256: 67f7faf0161fdac7ebb619a2aa0c73a4a08def05d7752dfdd698d24410d9989e


md5: ef4d35b1780cb1799eadb648f4e7b5b5 sha256: 67f7faf0161fdac7ebb619a2aa0c73a4a08def05d7752dfdd698d24410d9989e


md5: ef4d35b1780cb1799eadb648f4e7b5b5 sha1: 28ed17b046e0bed3d1cde67eccf241ecf01fe3c4


sha1: aa42f3758dc599e6184894a2911e774c2e16b92d sha256: 7c11eecc2fef6a2ad2e5d80156946d7bdcb9c345d542781c3116141f10eb490f


md5: 01b596051d1fa4785ef4e73dc3f08ec0 sha256: 7c11eecc2fef6a2ad2e5d80156946d7bdcb9c345d542781c3116141f10eb490f


md5: 01b596051d1fa4785ef4e73dc3f08ec0 sha1: aa42f3758dc599e6184894a2911e774c2e16b92d


sha1: 57b138f2bb4731b1c50a034aff3013bce735267c sha256: e2735841dd8ae66a825182d6d06629821c49aca44357e5980c3bfb97ace7ebf0


md5: 54c7f04fc5418553812910db8adc6995 sha256: e2735841dd8ae66a825182d6d06629821c49aca44357e5980c3bfb97ace7ebf0


md5: 54c7f04fc5418553812910db8adc6995 sha1: 57b138f2bb4731b1c50a034aff3013bce735267c


sha1: f95deea8d824ee681341f9457e0a86129ec4eb91 sha256: 374fff9a48949254d72bfe34b9b62129da1cfafb74623d187791ada09d976e7d


md5: 824fbfa8b35f19152a834a1bfff9ef54 sha256: 374fff9a48949254d72bfe34b9b62129da1cfafb74623d187791ada09d976e7d


md5: 824fbfa8b35f19152a834a1bfff9ef54 sha1: f95deea8d824ee681341f9457e0a86129ec4eb91


sha1: 1749f99443b345860dd037940505421c45156950 sha256: 86c17c549433223f3b59f5ee3e4f2694ebf4e6aabd66508a9a6fec1bdf830c61


md5: 48097e614cdf1f9c908b7449cd1119c5 sha256: 86c17c549433223f3b59f5ee3e4f2694ebf4e6aabd66508a9a6fec1bdf830c61


md5: 48097e614cdf1f9c908b7449cd1119c5 sha1: 1749f99443b345860dd037940505421c45156950


sha1: a8808089c37faacebc19bafd2677ba011afffc49 sha256: 22c6d07b64d40811ef31113faac7293348845ab6a06f7319a653ca694c26e94a


md5: 3cf999dd950af82cad3f8c6eb5430bd5 sha256: 22c6d07b64d40811ef31113faac7293348845ab6a06f7319a653ca694c26e94a


md5: 3cf999dd950af82cad3f8c6eb5430bd5 sha1: a8808089c37faacebc19bafd2677ba011afffc49


sha1: 154da55173f97c50e41e48157bc94515cc6146ec sha256: 8c8f9fd17d1c28b471bcc4c870ab53a3b4b260ae2fd123b0ef2a2a819ce1cc78


md5: 6d3ce5d4003ce4c9af3048826638ab82 sha256: 8c8f9fd17d1c28b471bcc4c870ab53a3b4b260ae2fd123b0ef2a2a819ce1cc78


md5: 6d3ce5d4003ce4c9af3048826638ab82 sha1: 154da55173f97c50e41e48157bc94515cc6146ec


sha1: 89375a28a96286584e321401915bff2860190470 sha256: ff9a833d34ff89660c1c5f3fa71d4d88c287c183235f714e03ccbdec7a3a6b17


md5: b33e5e2e14b0fbe319f6a8b719c43c1a sha256: ff9a833d34ff89660c1c5f3fa71d4d88c287c183235f714e03ccbdec7a3a6b17


md5: b33e5e2e14b0fbe319f6a8b719c43c1a sha1: 89375a28a96286584e321401915bff2860190470


sha1: 3caf909e6590a4ae2db99ae577d5585d854ad15e sha256: 87d36c48bf6d1d9a3b157aaab45ae162b78b79b0c956383a670dcc7d9d7c14e8


md5: 8ec966f8b441fa20225e08ffd5e83f94 sha256: 87d36c48bf6d1d9a3b157aaab45ae162b78b79b0c956383a670dcc7d9d7c14e8


md5: 8ec966f8b441fa20225e08ffd5e83f94 sha1: 3caf909e6590a4ae2db99ae577d5585d854ad15e


sha1: 7abf05ccdf0709aacae2ebe07b7104c81b19abe1 sha256: 0992aa7f311e51cf84ac3ed7303b82664d7f2576598bf852dbf55d62cb101601


md5: 3381df84cf05826aff084002ba323774 sha256: 0992aa7f311e51cf84ac3ed7303b82664d7f2576598bf852dbf55d62cb101601


md5: 3381df84cf05826aff084002ba323774 sha1: 7abf05ccdf0709aacae2ebe07b7104c81b19abe1


sha1: fc6b59571353c74d4d8cbd254ea7b216f8449208 sha256: 8756f0619caff132b0d4dfefad4387b8d5ea134b8706f345757b92658e6e50ff


md5: 8a7b4985db84e9093e169c237b853adc sha256: 8756f0619caff132b0d4dfefad4387b8d5ea134b8706f345757b92658e6e50ff


md5: 8a7b4985db84e9093e169c237b853adc sha1: fc6b59571353c74d4d8cbd254ea7b216f8449208


sha1: b85fec5a965785830af1cf5534ef6a3b437542c2 sha256: aafb0a46610064cd88ba99672e0f18456ed827cf46b2d3064487c45bac75637a


md5: 5e25310d2ada344715cf8edd5e64a848 sha256: aafb0a46610064cd88ba99672e0f18456ed827cf46b2d3064487c45bac75637a


md5: 5e25310d2ada344715cf8edd5e64a848 sha1: b85fec5a965785830af1cf5534ef6a3b437542c2


sha1: 8ef130998044df15395dcf50123e5a1d8f6ce208 sha256: 50c34013472f3848abb0fb280254d0514e83a65c1ce289ae199389795dcfb575


md5: 0c19d2e8bc1429fac245dd6c870afbe0 sha256: 50c34013472f3848abb0fb280254d0514e83a65c1ce289ae199389795dcfb575


md5: 0c19d2e8bc1429fac245dd6c870afbe0 sha1: 8ef130998044df15395dcf50123e5a1d8f6ce208


sha1: ec5394b93c376e359a8a2c380622e3a9d033d0de sha256: f3f122aee9cd682074cdc757844dfd4e65d6268c2a71430d77265cf369deb774


md5: d0ea84204096109f18a2201fae1c4f30 sha256: f3f122aee9cd682074cdc757844dfd4e65d6268c2a71430d77265cf369deb774


md5: d0ea84204096109f18a2201fae1c4f30 sha1: ec5394b93c376e359a8a2c380622e3a9d033d0de


Infrastructure


Mimics the legitimate


IPv4 Hosts C2 and additional payloads


IPv4 Resolves to


IPv4 Potential Storm-0978 infrastructure similar content


Second stage malicious Microsoft Word document, Second stage malicious Microsoft Word document, filename: file001.url


Second stage malicious Microsoft Word document, Second stage malicious Microsoft Word document, sha256: 07377209fe68a98e9bca310d9749daa4eb79558e9fc419cf0b02a9e37679038d


Second stage malicious Microsoft Word document


Lure document, Lure document, filename: Letter_NATO_Summit_Vilnius_2023_ENG.docx


Lure document, Lure document, sha256: 3a3138c5add59d2172ad33bc6761f2f82ba344f3d03a2269c623f22c1a35df97


Lure document, Lure document, filename: Overview_of_UWCs_UkraineInNATO_campaign.docx


Lure document, Lure document, sha256: a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f


Malicious Word document


Exploit payload embedded within the lure documents, Exploit payload embedded within the lure documents, filename: afchunk.rtf


Exploit payload embedded within the lure documents, Exploit payload embedded within the lure documents, sha256: e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539


VICTIM_IP>_<5_CHAR_HEX_ID>_file001.zip Payload generated for victim


Potential Storm-0978 infrastructure similar content


VICTIM_IP>_<5_CHAR_HEX_ID>_ Payload generated for victim


Referenced by loads content generated for victim


Loads


Lure document


Victim specific CHM payload containing and


Hosts C2 and additional payloads


Exploit payload embedded within the lure documents


Potential Storm-0978 infrastructure (similar content)


Payload generated for victim


Geofenced download


Encrypted LHA archive


Packed BlotchyQuasar


Simple indicator of observable {webhostwatto.work.gd}


Simple indicator of observable {starbucls.xyz}


Simple indicator of observable {crypto.hondchain.com}


Simple indicator of observable {companydeck.online}


Simple indicator of observable {docsend.linkpc.net}


Simple indicator of observable {104.168.167.88}


Simple indicator of observable {64.44.141.15}


Simple indicator of observable {jaicvc.com}


sha1: 3cc19cef767dee93588525c74fe9c1f1bf6f8007 sha256: ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41


md5: e2699d59c3602893698c5958f485c6c2 sha256: ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41


md5: e2699d59c3602893698c5958f485c6c2 sha1: 3cc19cef767dee93588525c74fe9c1f1bf6f8007


sha1: cd8f41b91e8f1d8625e076f0a161e46e32c62bbf sha256: 4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16


md5: b7cb512be2f564a77608b4ffd57af9da sha256: 4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16


md5: b7cb512be2f564a77608b4ffd57af9da sha1: cd8f41b91e8f1d8625e076f0a161e46e32c62bbf


sha1: 8a1b32ab8c2a889985e530425ae00f4428c575cc sha256: de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500


md5: cdc7ae6934b904c62c942b6803ee31d6 sha256: de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500


md5: cdc7ae6934b904c62c942b6803ee31d6 sha1: 8a1b32ab8c2a889985e530425ae00f4428c575cc


sha1: ed4f16b36bc47a701814b63e30d8ea7a226ca906 sha256: 7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8


md5: e169d95fffd8ab489f5eae02365d39ca sha256: 7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8


md5: e169d95fffd8ab489f5eae02365d39ca sha1: ed4f16b36bc47a701814b63e30d8ea7a226ca906


sha1: 69f24956fb75beb9b93ef974d873914500e35601 sha256: fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69


md5: 029456110598a8fddefbf942d6f50cc4 sha256: fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69


md5: 029456110598a8fddefbf942d6f50cc4 sha1: 69f24956fb75beb9b93ef974d873914500e35601


sha1: 831dc7bc4a234907d94a889bcb60b7bedf1a1e13 sha256: 7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387


md5: 352715d5770b53768bf9f23d810ad55f sha256: 7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387


md5: 352715d5770b53768bf9f23d810ad55f sha1: 831dc7bc4a234907d94a889bcb60b7bedf1a1e13


sha1: 182760cbe11fa0316abfb8b7b00b63f83159f5aa sha256: 9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747


md5: f90b544f89cfbe38aee18024d7c39e40 sha256: 9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747


md5: f90b544f89cfbe38aee18024d7c39e40 sha1: 182760cbe11fa0316abfb8b7b00b63f83159f5aa


filename: Invitation – Santa Lucia Celebration.msg


Invitation – Santa Lucia Celebration.msg

sha256: 966e070a52de1c51976f6ea1fc48ec77f6b89f4bf5e5007650755e9cd0d73281


filename: Invitation.svg


sha256: 4875a9c4af3044db281c5dc02e5386c77f331e3b92e5ae79ff9961d8cd1f7c4f


filename: Invitation.iso


sha256: af1922c665e9be6b29a5e3d0d3ac5916ae1fc74ac2fe9931e5273f3c4043f395


filename: Invitation.lnk


sha256: a8ae10b43cbf4e3344e0184b33a699b19a29866bc1e41201ace1a995e8ca3149


filename: CCleanerReactivator.exe


sha256: 59e5b2a7a3903e4fb9a23174b655adb75eb490625ddb126ef29446e47de4099f


filename: CCleanerDU.dll


sha256: d7bda5e39327fe12b0c1f42c8e27787f177a352f8eebafbe35d3e790724eceff


filename: CCleanerReactivator.dll


sha256: 7fc9e830756e23aa4b050f4ceaeb2a83cd71cfc0145392a0bc03037af373066b


filename: 孙继超-北京大学-硕士.pdf.lnk


sha256: d5a8b6635240cc190bc869a2a41bc437a48bfbfcce0d218b879d9768d85d1d6f


filename: aaa.bat


sha256: f1f6bb1bdf41217d26ec33e00e1e52fbc479e636b5d43671736905210fc4d734


filename: aaa.bat (DESCIPHER)


sha256: a5a0bee3304c77bdb5b6dcc4edafbfc941cdc0b5153e3d82e2689150e83b1329


filename: mbp.tmp (appvisvsubsystems64.dll)


sha256: 6b13519a3aea8747400932191048d5dab7daccb3fd45a3f5e0ffd34c32aed35d


filename: appvisvsubsystems64.dll (UNPACKED)


sha256: d465f6da893f2f76cdfb7089c3b9292d09a201e7d0faefb0f88a8b8ba5fd3fba


filename: wda.tmp (OffceUpdate.exe) [Legit]


sha256: dd657a7a3688d039f0a208f39b1128ec447689ee664c6695d5c7e384dcdc1014


filename: 孙继超-北京大学-硕士.pdf (Decoy)


sha256: e15ee2e8ed2c3f37c1b47bf67e81aa2e89b0ce7b3159918a32da2e30420e6819


filename: 2023年体检项目.exe [Legit]


filename: appvisvsubsystems64.dll


sha256: fc6847a8b62af02c2d1eff1d77f7d8b90cbd34654aff38c671d86194d351cd6e


sha256: 4c750b8471bfec0ed2dcf1a856163601fc140eb892710b8415d505a9088bd7f3


filename: 北京市交通委年终总结报告-模版1.pdf


北京市交通委年终总结报告-模版1.pdf


filename: aaa.bat


sha256: f7cc627464981b8918347487bdc73c2026b645fd31a1fbab4d5fcc03cbe88901


filename: aaa.bat (DESCIPHER)


sha256: 256357877ae60db9ad247aef686aa3aaecb7de0fdb84ed35ea91b28be9725e36


filename: 北京市交通委年终总结报告-模版1.pdf(Decoy)


北京市交通委年终总结报告-模版1.pdf(Decoy)

sha256: 7ee465b6132819063b741d7f60246a539a1624e0667098bb162e22de0d06cf2e


derived from Smooth Operator sample MD5s C2


derived from Smooth Operator sample MD5s Exfiltration


derived from Smooth Operator sample MD5s: Name given to downloaded payloads, filename: UpdateAgent


md5: 5faf36ca90f6406a78124f538a03387a


derived Malware containing Victim ID and next scheduled time to beacon under XOR 0x7A


Malware file containing Victim ID and next scheduled time to beacon under XOR 0x7A, filename: main_storage


md5: 660ea9b8205fbd2da59fefd26ae5115c


Engineering Vulnerability


Qbot


sh.py


Macos.Hacktool.JokerSpy, filepath: /Users/Shared/xcc


Macos.Hacktool.JokerSpy, sha256: d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8


MacOS.Hacktool.Swiftbelt, filepath: /Users/Shared/sb


MacOS.Hacktool.Swiftbelt, sha256: 8ca86f78f0c73a46f31be366538423ea0ec58089f3880e041543d08ce11fa626


sh.py script, filepath: /Users/Shared/sh.py


sh.py script, sha256: aa951c053baf011d08f3a60a10c1d09bbac32f332413db5b38b8737558a08dc1


Sample


Extracted Script


Simple indicator of observable {appointmentmedia.com}


Simple indicator of observable {hosting-wordpress-services.com}


Simple indicator of observable {webmanufacturers.com}


Simple indicator of observable {toppaperservices.com}


Simple indicator of observable {stablewindowsapp.com}


sha1: 8eac64944ebb7aed3d3a1f256d8b9133cd899625 sha256: 4e3a88cf00e0b4718e7317a37297a185ff35003192e5832f5cf3020c4fc45966


md5: 0403c1ef68593f4127b9a660b38a773b sha256: 4e3a88cf00e0b4718e7317a37297a185ff35003192e5832f5cf3020c4fc45966


md5: 0403c1ef68593f4127b9a660b38a773b sha1: 8eac64944ebb7aed3d3a1f256d8b9133cd899625


sha1: d81f69e7cfc19208064d08826492b760eec6579a sha256: 7b5e56443812eed76a94077763c46949d1e49cd7de79cde029f1984e0d970644


md5: b5a06ff6b41ca6bf4f00cbc0e7099a30 sha256: 7b5e56443812eed76a94077763c46949d1e49cd7de79cde029f1984e0d970644


md5: b5a06ff6b41ca6bf4f00cbc0e7099a30 sha1: d81f69e7cfc19208064d08826492b760eec6579a


sha1: 6852777dbd21562869e57937dc61185ac6bc13ba sha256: 5191fe222010ba7eb589e2ff8771c3a75ea7c7ffc00f0ba3f7d716f12010dd96


md5: 795dc022c8897e290b26f620b0124e5e sha256: 5191fe222010ba7eb589e2ff8771c3a75ea7c7ffc00f0ba3f7d716f12010dd96


md5: 795dc022c8897e290b26f620b0124e5e sha1: 6852777dbd21562869e57937dc61185ac6bc13ba


sha1: e4b1bb4057a2017e1b67009f2fea1a226365a628 sha256: 56d2d05988b6c23232b013b38c49b7a9143c6649d81321e542d19ae46f4a4204


md5: e4e927c949b4f820dcee4dd82083a4e4 sha256: 56d2d05988b6c23232b013b38c49b7a9143c6649d81321e542d19ae46f4a4204


md5: e4e927c949b4f820dcee4dd82083a4e4 sha1: e4b1bb4057a2017e1b67009f2fea1a226365a628


sha1: 805d0d48bf12bb8cadeccedb87b47479063d6546 sha256: 7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb


md5: 67b447f52eaa9e133b19d7954dad18c8 sha256: 7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb


md5: 67b447f52eaa9e133b19d7954dad18c8 sha1: 805d0d48bf12bb8cadeccedb87b47479063d6546


sha1: bfc0093ee0a89e72367cbf3c90ec138359c9e2ef sha256: d1c32176b46ce171dbce46493eb3c5312db134b0a3cfa266071555c704e6cff8


md5: 5128d0e41d625c06a07cf86e24462823 sha256: d1c32176b46ce171dbce46493eb3c5312db134b0a3cfa266071555c704e6cff8


md5: 5128d0e41d625c06a07cf86e24462823 sha1: bfc0093ee0a89e72367cbf3c90ec138359c9e2ef


sha1: c919f492c85a84beee99f9fcd086e5c2e6bb7dd3 sha256: 4775fc861bc2685ff5ca43535ec346495549a69891f2bf45b1fcd85a0c1f57f7


md5: f7128f7bfe103cee226af89f7ba3c70b sha256: 4775fc861bc2685ff5ca43535ec346495549a69891f2bf45b1fcd85a0c1f57f7


md5: f7128f7bfe103cee226af89f7ba3c70b sha1: c919f492c85a84beee99f9fcd086e5c2e6bb7dd3


sha1: e054c29688a15e67fbd0675c024d42583c90cdbd sha256: 2482c7ececb23225e090af08feabc8dec8d23fe993306cb1a1f84142b051b621


md5: 30ba174fbbe29a271027175b92934ba9 sha256: 2482c7ececb23225e090af08feabc8dec8d23fe993306cb1a1f84142b051b621


md5: 30ba174fbbe29a271027175b92934ba9 sha1: e054c29688a15e67fbd0675c024d42583c90cdbd


Example malware


StormKitty / Prynt Stealer, filename: svchost.exe


StormKitty / Prynt Stealer, sha256: fede8f2bc1985107197319816287218a3631460e2f8205cf119ce406d7c3b2d7


AddStartupTask, filename: AddTaskStartUp.exe


AddStartupTask, sha256: 469e25f46030d6fb3b04e83b095b5c8e09017e39c40bc584920e324fd87d0700


Icarus, filename: svchost.exe


Icarus, sha256: 6b4ea42c1de9777847d7b6f980976310abe46d2de9792045a6eba54b032b8520


Highlander


HiddenEyeZ HVNC Dropper, filename: Installs.exe


HiddenEyeZ HVNC Dropper, sha256: bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683


r77 (Install), filename: rk.exe


r77 (Install), sha256: 4604e501fb4efb5ce862e81232c61b29e4470b5313055efb291593d66f23af7e


r77 (Uninstall), filename: rkd.exe


r77 (Uninstall), sha256: 6c1b2c9ae4887ff134bd098cab3e6c5ada1482f45a129ccc858733a545a10619


r77 (Dll 64 bits) r77 (Dll 4 bits), filename: r77-x64.dll


r77 (Dll 64 bits) r77 (Dll 4 bits), sha256: 2141974f665f4d8fecb6d8ea06add624b57f320f901368847175570ee716fd8e


r77 (Dll 32 bits) r77 (Dll 2 bits), filename: r77-x86.dll


r77 (Dll 32 bits) r77 (Dll 2 bits), sha256: ed3ee849ae71001941d03983a65eacdd726be75d91b076475a89a3a75e79d82e


HiddenEyeZ HVNC


HiddenEyeZ HVNC, filename: rescale.ps1


HiddenEyeZ HVNC, sha256: a10479eea5f9d85ac00db77c0e090de2db64cdb163055e7b42fbcb2c97a66898


HiddenEyeZ HVNC Dropper / HiddenEyeZ HVNC


StormKitty / Prynt Stealer


HiddenEyeZ HVNC Dropper


Icarus


EML


Docx


XWorm malware


Filenames


Filenames: / Herramienta Seguridad


Filenames, filename: 7684jasdtg.xls


Filenames, md5: b262b36c3b09ebeab66c95e121be4c73


filename: ot.crypt


md5: b10b9f1f286f7ae29d9e87c5391d3653


filename: proxy.crypt


md5: 500b1c312163009fefec3f8fe7861258


filename: steal.crypt


md5: 594804aa21887ee9d7b1b888f482d60c


Filenames, filename: pay.txt


Filenames, md5: 1c50c6d0aeaf8071f528b76b1ab242fe


filename: 7684jasdtg.xls


md5: b262b36c3b09ebeab66c95e121be4c73


Filenames: / ot.crypt


Filenames: / proxy.crypt


Filenames: / steal.crypt


filename: pay.txt


md5: 1c50c6d0aeaf8071f528b76b1ab242fe


Sample (Jan/Feb 2023)


Sample (Mar 2023)


Sample (April 2023)


filename: Output.exe


sha256: 7beb3f5dd622520c95241c27a48c3728ff3e77178870271f620e9c217850d4d2


filename: tester.exe


sha256: b701f623cfec2e92c0e40c931c633caaf2d5f0874dd162e4974603ea424c60ee


filename: Togwcstgxg.exe


sha256: 9f48cc23f86e01e52df1010eca7cfdf4732960cda26e952512e36f44cfdd0e6d


filename: virus.exe


sha256: f296b101028093e2c43930229590375a8a73335d08022c28d9c1cf0f84efb5b8


filename: ghostworker.exe


sha256: 5b3ca1f72cda154372f0e764ec90568398870810bf87639dfe3b287540750ed5


filename: Done.exe


sha256: 146555a86dc2bc2f218f3165de2420eba2f92f37b8ad76874da38a6d265c4a90


filename: hastly.exe


sha256: 51899759ef3bf90fd25511385d4f322bd7bdfef435bfab70d00f16bbfedaf1d1


filename: oALESESmIYUl.exe


sha256: 73c72b16f0bf37ce27acb0e8932101c548c71f1354648aa47a966580f01b1303


filename: Robine.exe


sha256: ac742aa21f66571acaa9bd4ab274a2b395f4d6e0de96b40a1fde71123930d813


filename: special.exe


sha256: 343e1a1aca9324842d03943b14e0fddf1c527473b719a75b91bf8b3fec0b35d5


filename: build.1.exe


sha256: 59da329cc7870ef0cf6e6a11554a7c32386eb14552b01fbb2b48b04dc9bd24af


filename: svhost.exe


sha256: ab7c26523fc6c5f0846bf3efcf6a3892228d2967f1aeec2aafdbc930df3324f5


filename: build.3.exe


sha256: 18b27eb6ec1898c6a8422e43e386f901eca8f09949eb63229d53f5041e5d2910


filename: steamsupported.exe


sha256: 7b755d9167c306a2a8ff28059605998d1f94a34238801a09d4befaf0984b90c5


filename: Heaven.exe V1


sha256: 2e0294a4bc72959fcec69fae965a6b314964d284d4b68161e3f935460a6db7e4


filename: use.exe


sha256: bec9513d216f5a4167b6326102f6e5aee3c8f9ca6929263175e684a28da20139


filename: JokerTest_1.exe


sha256: b24019a42b6b6147d537bd065e1b7ddc52e6f4b3b1236fba0b0889becd2ba009


filename: 2.exe


sha256: 1c7915202c240cf0b3c6e6ccbc92cc1dde4920ad64ec3e0bc2c109bd8c5e392e


filename: gggg.exe


sha256: d0b5cd03180337252aeea2a1bfecddd3f5df8c10c941b2f80170f27afa5aefb3


filename: oneetx.exe, y68ET32.exe


sha256: 13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4


filename: za654409.exe


sha256: 6e2d3d53c921fbc49c09ee7393734779d8fb92e752c2e6021367e2da31de911f


filename: xnKdj82.exe


sha256: 96dedf45d3f7a89e87a81833a26bc495180b14f0b9a3bcc44560808fd84fcbdb


filename: za836849.exe


sha256: febb97acacb7bb032738348c3c763217b849e8376e05e5a19781abf0d7d1c85e


filename: w14cQ83.exe


sha256: b218177ab526f9201a1fb16a92aee426b7247b20c12b51f8d6a8529e4292a002


filename: za559752.exe


sha256: d194131b60c1e0f2ae96f2b52b133703db16ded11febf423c052538697801798


filename: tz9349.exe


sha256: 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38


filename: v8477Wy.exe


sha256: c8f66776f2d487cc4d12a4ae1048a06194694453b4cef2c7999a6e34ed751c2f


filename: v123.exe


sha256: 8dd28c0f9fe3b978a2c6bdf85dde5f3af6056cee4ae0ed198f5cf1476a8585bf


filename: vidars.exe


sha256: 3c806d0324044d7d2adc3eda60299847e4b896e962b02aa0819ba878792ba854


filename: QkZoHEBKmB.exe


sha256: a96c1c6be687e8ac8e7e6c03760b4ce7ec91f80e5141766179b839cb970a958a


testt.exe


02.exe 2.exe


111_2023-04-07_08-22.exe 11_2023-04-07_08-22.exe


360_.exe 60_.exe


dheend.exe


Hillmen.exe


Installer.exe


Ndlvxzd.exe, installs.exe


Miles.exe


Yosdofwiqay.exe


TwmyfskeihCfnUdGQtgdgeLET.js


manifest.json


icône extension taille 1 icône extension taille


icône extension taille 2 icône extension taille


icône extension taille 3 icône extension taille


cc.exe


Lega.exe


clip.dll


BouldSpy Sample SHA1s


Command and Control


Album Over Night With Me Yuan


CCleaner Professional


C&C Servers


Backdoors


filepath: C:\spoolerlogs\


filename: spoolerlogs


filepath: C:\Users\Username\


filename: Username


filepath: C:\Users\Username\Appdata\Roaming \Microsoft


filename: Microsoft


filepath: C:\users\2>&1))


filename: 2>&1))


filepath: C:\Users\USER\Desktop


filename: Desktop


filepath: C:\Users\USER\Downloads


filename: Downloads


filepath: C:\Users\USER\AppData\Local\Temp\1303787165\MFVZ.rar


filename: MFVZ.rar


filepath: C:\Users\USER\AppData\Roaming\The Bat!\AccOrder.CFG OK


filename: AccOrder.CFG OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\Account.CFN OK


filename: Account.CFN OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\ACCOUNT.FLB OK


filename: ACCOUNT.FLB OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\ACCOUNT.SRB OK


filename: ACCOUNT.SRB OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\ACCOUNT.~FLB OK


filename: ACCOUNT.~FLB OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\ADDRBOOK.INI OK


filename: ADDRBOOK.INI OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\autobackup.$1 OK


filename: autobackup.$1 OK


filepath: C:\Users\USER\AppData\Roaming\The Bat!\autobackup.$10


filename: autobackup.$10


Zaraza bot binary


packed: / sha


unpacked: / sha


Downloaded File: / sha


Scenario #1 / zip


Scenario #1 / one


Scenario #1 / hta


Scenario #2 / one


Scenario #2 / cmd


Scenario #3 / zip


Scenario #3 / wsf


Scenario #4 / html


Scenario #4 / zip


Scenario #4 / img


Qakbot payload


weed.dmg


MACH-O


Telegram 1


Telegram 2


Malware command & control


Malware


Landing Pages


Malicious Extension Pages on Official Chrome Store


C2 Server


Malicious Microsoft OneNote


Hidden File Objects


Sample (Loader)


Dropped Payload (Ransomware)


Contact


CVE-2022-44698, Magniber


CVE-2022-44698, Qakbot


CVE-2023-24880, Magniber


Instructions.iso


C2 encrypted in malware


Resolved of thelivemusicgroup[.]com


tscon32.dll PHOREAL dll


Filenames


Proxies


White-listed


Exploit Servers


Distributed Samples


ipv4 / Observed: 2022-12-05 – address used for exploitation of R1Soft SBM


ipv4 / Observed: 2022-12-09 – address used for exploitation of R1Soft SBM


ipv4 / Observed: 2022-11-29 – address used for exploitation of R1Soft SBM


ipv4 / Observed: 2022-12-11 – address used for exploitation of R1Soft SBM


Threat actor contacts


Dropped, Dropped, filename: HARDBIT.jpg


Dropped, Dropped, sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855


Dropped


Dropped / How To Restore Your


Dropped, Dropped, filename: hrdb.ico


Dropped, Dropped, sha256: b565a7b25dc4227872fe972ceee9ff8fce91eb10b373ebc9401f4f32348244ef


SOURCE


PURCHASE ORDER91273_2.ppam


CypherDeptography.~+~


Loader DLL


Stealerium stealer.exe(Memory)


filename: Drivers.js


md5: 03a2630a1bb1ab1c895baffc49e9dea1


filename: OneDriveUpdate.js


md5: dba979f7dedbf00c8dfb89b554ad2905


filename: OutlookUpdate.js


md5: 6a170af7973e13d5a65e828d40648bb3


encrypt Linux 64-bit ELF


Shell script believed to be the original file, Shell script believed to be the original, filename: encrypt.sh


Shell script believed to be the original, Shell script believed to be the original, sha256: 10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459


Shell script, Shell script, filename: encrypt.sh


Shell script, Shell script, sha256: 5a9448964178a7ad3e8ac509c06762e418280c864c1d3c2c4230422df2c66722


Shell script, Shell script, sha256: 87961344f13a452fb4aa46dd22a9aa31c5d411b1d8d37bac7a36f94a5be9fb0d


EML


OneNote File


The embedded PE file inside of OneNote file (view.exe)


The dropped Visual Basic Script (new.vbs)


PowerShell Script (rr.ps1)


AsyncRAT


C2 Server


http[:]//www[.]


Names


generated by the DGA during 2022


Lnk file


Remcos


Lnk


filename: ofer.docx


md5: 74865c6c290488bd5552aa905c02666c


filename: word_update.exe


md5: 7c05cfed156f152139a6b1f0d48b5cc1


filename: fmTask_dbg.exe


filename: shablon.hta


md5: 1c3e1e0319dc6aa24166d5e2aaaec675


filename: zayava.docx


md5: 818beece85ecd90d413782dd51d939b1


2022-05-22 19:18:31 / 12.1-65.15


2022-06-29 13:46:08 / ??


2022-10-04 16:11:03 / 12.1-65.25


encryption batch-script (test.bat)


encryption batch-script (copys.bat)


Distribute batch-script


encryption batch-script


batch-script (cmd-webshell.txt)


bcfmgr.exe


Royal Ransomware Binary


Paths


Communication Environment


SSH-based Backdoor (Active)


SSH-based Backdoor (Early Version)


Tirion/Lizar


Loader Proxies


Carbanak


Cobalt-Strike Servers


Powershell Scripts/Loaders (.ps1)


DLLs used in Reflective Injection (.dll)


Backdoor Install Scripts (.bat)


These are the linked to the malware download


and Ports of C2


Route Disk


PCICHEK.DLL


ANSI32.DLL(Dridex) / Dridex


HKEY_CURRENT_USER:\Software\Microsoft\Windows\CurrentVersion\Run”,“ctfmon_”


Possible malicious DLL download sites


www.hbzyjxkh.cn, hbszyy.gcptrial.com


The last part is variable so it is not recommended to use it as a detection pattern


Android / Super Hero-Save the world! / com.asuper.man.playmilk / 1000000


Android / Arrow Coins / com.arrow.coins.funny / 500000


Android / Parking Master / com.ekfnv.docjfltc.parking.master / 500000


Android / Lady Run / com.lady.dress.run.sexylady / 100000


Android / Magic Brush 3D / com.magic.brush.gamesly / 100000


Android / Shake Shake Sheep / com.shake.earn.sheep.causalgame / 100000


Android / Number Combination: Colored Chips / com.yigegame.jyfsmnq.gg / 100000


Android / Jackpot Scratcher-Win Real / com.physicswingsstudio.JackpotScratchers / 5,000


Android / Scratch Carnival / com.scratchers.jackpot.luckypiggy / 50,000


Android / Ztime:Earn cash rewards easily / com.pocky.ztime / 100000


Android / Billionaire Scratch / com.free.tickets.scratchers.Billionaire / 50,000


Android / Lucky Wings - Lotto Scratchers / com.free.scratchers.luckywings / 100000


Android / Lucky Star: Lotto Scratch / com.free.tickets.scratchers.LuckyLotto / 50,000


Android / Shake Shake Pig / com.ldle.merge.free.coinspiggy / 100000


Android / Lucky Money Tree / com.ldle.merge.lucky.moneytree / 100000


Android / Run And Dance / com.tap.run.and.dance / 100000


Android / Lucky Scratchers: Lotto Card / com.lotto.bingo.lucky.scratchcard / 1000


Android / Pull Worm / com.pull.bugs.worm / 10000


Android / Crowd Battle:Fight the bad guys / com.crowd.battle.goamy / 5000


Android / Shoot Dummy - Win Rewards & Paypal Cash / com.shoot.dummy.fast.speed.linger / 10000


Android / Spot 10 Differences / com.different.ten.spotgames / 1000000


Android / Find 5 Differences - New / com.find.five.subtle.differences.spot.new / 1000000


Android / Dinosaur Legend / com.huluwagames.dinosaur.legend.play / 1000000


Android / One Line Drawing / com.one.line.drawing.stroke.yuxi / 1000000


Android / Shoot Master / com.shooter.master.bullet.puzzle.huahong / 1000000


Android / Talent Trap - NEW / com.talent.trap.stop.all / 1000000


Android / Shoot it: Using Gun / com.bullet.shoot.fight.gtommm.tom / 500000


Android / Super Flake / com.chop.slice.flake2020 / 500000


Android / Five-Star Slice / com.five.star.slice / 500000


Android / Sand Drawing / com.sand.drawing.newfight / 500000


Android / Mr Dinosaur: Play your Dino / com.topggame.facego.finger.crazy.dino / 500000


Android / Track Sliding New / com.track3d.sliding.new / 500000


Android / Beat Kicker New / com.beat.kicker.two.game / 100000


Android / Fill Color 3D / com.cube.fill.color.paint.turn.fei / 100000


Android / Draw Live / com.draw.live.milipop / 100000


Android / Draw 1 Stroke / com.draw.one.line.stroke.xipi / 100000


Android / Fidget Cubes / com.fidget.cubes.feel.like / 100000


Android / Girls Fight / com.girls.fight.fly / 100000


Android / Ninja Assassin / com.knifeninja.assassin.dltc / 100000


Android / Shooting Puzzle 2020 / com.my.bullet.shooting.man.hunter.youxi / 100000


Android / Pulley Parkour / com.pul.parkour.bbroller / 100000


Android / Chop Flake 3D / com.slice.chop.superslice3d / 100000


Android / Weapon Fantasy / com.weapon.fantasy.games / 100000


Android / Balloon Shooter / com.balloon.shooter.play / 50000


Android / Musical Shoot / com.ltcmusical.fun2021 / 50000


Android / Chop Slices / com.lvdiao.chop.slices.chef / 50000


Android / Ninja Slice / com.slice.masked.games / 50000


Android / Work Now! / com.work.now.slack / 50000


Android / Bottle Jump / com.bottle.jump.flip.challenge.fun / 10000


Android / Corn Scraper / com.corn.scraper.cut.pipe.siling / 10000


Android / Idle Wood Maker / com.idle.wood.maker.gametwo / 10000


Android / Pop Girls Schooler / com.pop.girls.schooler / 10000


Android / Romy Rush / com.romy.rushrun / 10000


Android / Spear Hero / com.spear.super.man.hero / 10000


Android / Dig Road Balls / com.dig.road.balls.play.games.ygygame / 5000


Android / BOO Popstar / com.boostar.boo.popstar / 1000


Android / Draw CompleteA / com.darwa.completea.ltca / 1000


Android / Rush 2048：3D Shoot Cubes / com.rushcube.puzzle.block / 100


Android / Meet Camera / com.magicvcam.hdmeet.cam008


Android / Auto Stamp Camera / com.stac.amper.qweaf / 100+


Android / com.find.five.differences.lvye.xsl


Android / com.mufc.zwxfb


Android / Roll Turn / com.roll.turn.song.wusi.pt / 1m+


Android / Hiding Draw / com.hiding.drawltc.games / 5k+


Android / Peter Shoot / com.ltc.peter.shoot.tslgame / 100k+


Android / Design n Road / com.ltcdesign.nroad / 1k+


Android / Draw Complete / com.ltcdraw.complete.fly / 10k+


Android / Thief King / com.ltcking.thief.game.tsl / 100k+


Android / Downhill Race / com.downhill.race.redbull / 5k+


Android / Draw a War / com.draw.war.army / 10k+


Android / Rescue Master / com.rescue.master.gear.mechanics.wushi / 1k+


Android / Spin:Letter Roll / come.letter.roll.race / 100k+


Android / Helicopter Attack - NEW / com.helicopter.attack.shoot.sanba / 500k+


Android / Crush Car / com.crush.car.fly.delivery.lingjiu / 1m+


Android / Relx cash / com.tycmrelx.cash / 100k+


Android / War in Painting / com.painting.war.inpaper / 100+


Android / Bike Extreme Racing / com.bike.extreme.raceing.bikegames / 50k+


Android / Player Spiral Maker 3D / com.player.spiral.maker.d3 / 50k+


Android / Match 3 Tiles / com.blocks.tile.matching / 10k+


Android / 2048 Merge Cube - Win Cash / com.cube.merge.shooter / 10k+


unknown


Lucky Now! Scratch, Spin, Play Lottery & Win Money / 1,000,000


Wood Carving - NEW / 50,000


Draw Color By Number / 1,000,000


Happy Color By Number - New / 1,000,000


Fire In The Desert / 500,000


Jump Jump / 100,000


Love Saver / 100,000


Plant Monster / 100,000


Desert Against / 10,000


Musical Shoot / 10,000


Happy Mouse! / 1,000


Props Rescue / 1,000


Initial Sample


GuLoader Payload


kbfvzoboss[.]bid/alien/fre.php


Command and control


Malware


Malware CVE-2021-3493


Malware CVE-2021-4034


Malware shell script


ppercepciones anuales.xlsx


CmRccService.exe


RegistryManager.exe


p.exe


umxn.exe


oidz.exe


Sample miner configuration


Malware and config server


Unresolved


Note SolidBit ransomware payloads are potentially victim or affiliate-specific


Malicious and


Downloader Shell, filename: brokeskid.sh


Downloader Shell, md5: d54b92f364fafc14696e85f94a36c9f2


Downloaded Payload, filename: m-i.p-s.Sakura


Downloaded Payload, md5: ed791ae9ce23f0c6e616baae7413e1cd


Downloaded Payload, filename: m-p.s-l.Sakura


Downloaded Payload, md5: 128f8db23313c1a235afdcbe6d48f2b6


Downloaded Payload, filename: s-h.4-.Sakura


Downloaded Payload, md5: d631da4b98ab26d97809916919bb2ea2


Downloaded Payload, filename: x-8.6-.Sakura


Downloaded Payload, md5: fa529519c03d91e1a3dad8c988107559


Downloaded Payload, filename: a-r.m-6.Sakura


Downloaded Payload, md5: bdc90be7d1e8048d54d8d91c73051798


Downloaded Payload, filename: x-3.2-.Sakura


Downloaded Payload, md5: 79fa8fb7b375d376176013756c046b26


Downloaded Payload, filename: a-r.m-7.Sakura


Downloaded Payload, md5: 850cb3c08f5814d3b6f103aacc88de93


Downloaded Payload, filename: p-p.c-.Sakura


Downloaded Payload, md5: 5cade583b82921a1d81185a5916eb6d0


Downloaded Payload, filename: i-5.8-6.Sakura


Downloaded Payload, md5: ea0458e07a7283f6081755772decbe80


Downloaded Payload, filename: a-r.m-5.Sakura


Downloaded Payload, md5: 6e84fc3c5279d72216f54950d3e7599c


Malicious and


Country: France


filename: w0kapn5k0.dll


md5: 93f34fb60a180a3a80ca758b97c2e551


Serpent Backdoor


Dropped


Leak Management Infrastructure


Public Leak Servers


filepath: /etc/vsftpd


filename: vsftpd


Initial Sample


Dropped samples


Smoke Loader C&Cs


Fast Cleaner / com.census.turkey


Fast Cleaner / com.laundry.vessel


Fast Cleaner / com.tip.equip


Fast Cleaner / com.spike.old


Main C2


Backup C2


Overlay C2


Emotet C&Cs


XLoader macOS


XLoader Windows


XBinder Builder


Kit Varients


data download links points to the


real address of Conti’s TOR hidden service


communicating with the subject Conti server


threat actors identified as members of the Conti team


Xbalti Phishing Kit Variant


Active C&C Server Domains(for March 2021)


Active Back-End Proxy Servers


Fronting Servers


Post-Exploitation Servers


External Post-Exploitation Scripts


2020 initial lure document, filename: Tabel_premia_N20.docx


2020 initial lure document, md5: f745d6e3c811c9c06acb2ebc45a174ba


2020 embedded table in initial lure document, filename: _____Microsoft_Excel_97-20031.xls


2020 embedded table in initial lure document, md5: 5dd05f94ebdeb7afb494b541b317eb8c


2020 remote template containing malicious VBA, filename: Dc2.dotm


2020 remote template containing malicious VBA, md5: 60cb0e31510a9cd747daae323d28f489


2020 VBS payload, filename: backup.vbs


2020 VBS payload, md5: 0a62afe0dfe369b5280c432533671aa0


2019 initial lure document, filename: zanpoc_energy.html


2019 initial lure document, md5: fb848fcf49054871f62bbf9b5f5c9282


2019 malicious HTA, filename: ENERGY_PRODACTION.html.hta


2019 malicious HTA, md5: 669190300c47c141c35ea3867061512e


2019 minimal VBS payload, filename: backup.vbs


2019 minimal VBS payload, md5: 54a4302989bf0f3ae42d2aeddca50e1a


2019 VBS payload extracted from registry, filename: diagnostics.vbs


2019 VBS payload extracted from registry, md5: 3e38a347b3914893cb5fb92d12558003


REGRU-NETWORK, filepath: /wp-content/energia/wp/


REGRU-NETWORK, domain: bibigreen.ru


REGRU-NETWORK, filepath: /up/up.php


REGRU-NETWORK, filepath: /wp/up.php


REGRU-NETWORK, domain: hesheflowershop.ru


NETERRA-CINFUCOM-NET, filepath: /wp/521/patch.png


NETERRA-CINFUCOM-NET, ip: 94.156.174.121


NETERRA-CINFUCOM-NET, filepath: /wp/521up.php


CrownCloud, filepath: /wp/521up.php


CrownCloud, ip: 185.243.112.18


CLOSCO-LTD, filepath: /521/patch.gif


CLOSCO-LTD, ip: 5.9.242.126


Related


applications containing the Brunhilda dropper


Impacted IOMap64.sys driver


Malicious JavaScript Downloader, filename: Form_Ver-11-58-52.js


Malicious JavaScript Downloader, sha256: 3ac8decd825d1ed7a86ed86d7789b44c0f0c467d4f482ab0863df1b7b1e3e8cc


MSI file, filename: vpn.msi


MSI file, sha256: 4586250dbf8cbe579662d3492dd33fe0b3493323d4a060a0d391f20ecb28abf1


CAB archive containing packed BRC4 Badger, filename: disk1.cab


CAB archive containing packed BRC4 Badger, sha256: c89d15789fd9e0b23e62bbf038d2ddbcea5618573517f3382790b4b0434933df


Packed Brute Ratel Badger, filename: aclui.dll


Packed Brute Ratel Badger, sha256: c5dc5fd676ab5b877bc86f88485c29d9f74933f8e98a33bddc29f0f3acc5a5b9


N/A, in-memory / Unpacked Brute Ratel Badger Stager


Latrodectus 1.3, filename: N/A, injected into explorer.exe


Latrodectus 1.3, sha256: dbd85d5dd501bb7fad3990f0801d32da438a5bc60bd7cf6999d5bc535291146c


Latrodectus Stealer Module, filename: N/A, injected into explorer.exe


Latrodectus Stealer Module, sha256: 44ccc3fbd3e15e8bdb063616d9baa37b1f9ab9121759fd467c943b7611860f72


Latrodectus C2 Endpoint


Latrodectus C2


Brute Ratel C2


MSI used by JavaScript Dropper