Malware campaign attempts abuse of defender binaries

May 30, 2024, 2:39 p.m.

Description

The report details a ransomware campaign that modifies legitimate security software files from vendors like Sophos, AVG, BitDefender, Emsisoft, and Microsoft by overwriting their entry-point code and inserting decrypted payloads as resources. This allows the malicious files to masquerade as trusted binaries and potentially avoid detection. The eventual payloads observed include malware like Cobalt Strike, Brute Ratel, Qakbot, and Latrodectus. The campaign involves abuse of expired digital signatures, malicious downloaders, and fake installers, suggesting involvement of multiple threat groups.

Date

Published Created Modified
May 30, 2024, 2:20 p.m. May 30, 2024, 2:20 p.m. May 30, 2024, 2:39 p.m.

Indicators

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97

fe229d6d580b0838a58082bfebabf8ff3285e643fec476262c012776bcbecca2

feb418e7eeeaba19070b713f704ed4d5d68452b8dc854c7f8dcc4cad61bc1a68

fdbbeaa4431ad3c4436a8eaec4e9fcaae03cc9ac20c135cc29ad637f7357b7ac

fd9c64bc502873090d94022832589fc7904f9b071e2fb0881d79a6edbf941c8c

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92

fd8ff76d72e4dee7c4c58e7edd3a3fb1325251b868bba2ffdc8874c0e14bc2e3

fd108ed07aa34cf1abf3b6b0b77128d4d03d5b572aee19aa4b062601a856c4a8

fcfd78f9c5471d2ecc90338c27827ffa70fb0324355be7b91be48805c00b1bf2

fcae624d68af2ab0c47c1d8a1983d20301a17bc81fccc88fea8c44612f6cb412

fb20fc4e474369e6d8626be3ef6e79027c2db3ba0a46f7b68c6981d6859d6d32

fb8e3ef19f0a3ad298b8d315a716aae1151332c1f097296962a3a04017f940ae

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc

fafdd87991351ff0fa2b888a9d22fc058f1a08a6c08651d7ee0164740c70ec51

faea4ccd802391bf9a6d71bc6052f269b6ca370c124bfe4d2faae55b43a5c0c8

f9aee9f92ca0406c7cdb37f83cccbb6cda725a374b7caea190c7d30ef03bdff0

f8ae1b5944b96622f3f0d26f67298779c2540a01145ad19a18c921703d109a9d

f7965de629197d244a42d126ded05b3749ee6b39eaa19210ca03bc43a3557c9b

f6a07d4163ac30f76760ddaf26938bd3134094e409d99d8f788f885be5852f4c

f6bfb065ebe1443fea656d03dbcb91abee90620f59deb645e61165b0647bcccc

f66e87f4bcbe9e28f77d39a3f46db9e47ffb422510be160276ef80a93ed674db

f666229e2893ba8b4f687ac81b3a34a372347137405ce3fe38bbf7516612aa90

f522fe57036fd9d5563b00688221158ffeb66ca3e10fa4990998582729249c33

f4673b8db5634b2c632ccf32661ee0576ddb61d01ed329a894cc46edd777e362

f33dd2435d3d9c2158d65bcf5e0563efb07e9646917c56c7cca8d721e7d8fc24

f07a8ce68fd76d6a7d0d878ac11f72630b746f1f33df1b5aba4ef717ae36edbe

ee59e202b12cb9c0f0f8049c43fddc0800bd1af2a39b1e6a05fe441d8cd4e98f

ed1d7d8f9ddd9a6e17325c60b75ea7a3ac3d70deaec789a4ff29fc50ea24cde5

ec7bcf048cc605f66b9e2ce320784347a12f4fdefab250f2347bd521ec2ba361

ec2c279eaa06d246afe32a3c3115adcfdb6847b864dbc3c5c9a943927c2bcd97

eb8f76efb2f9bf4e84f1f2a54671ed891886e698ad05cf08b061244f5affa6e6

eb6b8894e774e359fb250e253904071a2b33730bf88557312f093eb682611dd4

eb0f8d6767d6a7ec48448554aff219de8b19d717761ede54836b3a8e290d4640

eafc954cb541b7d3c3aee2b9afeef470b58b19d94774501cc3675ac52b9e113d

e929332d89b093125296d34c9bafff2fdfab75ac1b949ef4003d210b1b65946f

e840809d54e39e4896f573395e186c7cb87b7772ea64661e86616d3e368960c7

e757aec8c626828d80558f2b47b35507bd3439630ba8eb2aa48e9dcdf7dd6805

e6a80688bc43148dd965c852e4a7a44dd54af3f18ea1782769e00bf8b7b34c7c

e5aae5e2ea955c02ebdae08292dbb25015d2ec4ae5327f493e73f1fcb4b9ecb4

e59534a7d111600139b3ded6d4dd04d9aedba9a0a4fbab3c8ff4bb1a95d01526

e4151746f0d818479c399e118c9f6a412cba02de65e070e4895f27d9178d88f9

e3ce6070c719b35ad72d6bc47f3f015fa6d67f3a292c0290e3ff3f928d1df4a3

e396716fcb268502143a94a4563f9c514ed24a39531e1d57e4046316bc102f66

e310ee1e1d64de20d8c77643225c9334cd9249af33533be6bac9e1331a8fd747

e054153819d00712c4e34319b4021fe64ccf85c1f472816f4ca2251175e74b5b

e245bfd31e4933168488fc0708f090cfb3717c13181170701d6cda201d5cb986

e049124a50abaf07902bf5095ff218130f70254609751384c4ec916842b7b256

df63ad289440573c16c81a9105907795148d5ae60b659a52c71aa20d013d7d7f

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699

de163b4595169d92d7d4738f7fbb45ecf3513c390c060ff518cd8ea8fd3d048e

de11292975a66e8e95e0d348bfcedd9fdd30d7b2d6b37e385908d12f1d35473a

dd2b6e3aa75de8460730862f2dc739537734a7dfc9e673b6a23ee58430348ddf

dded6630fd552de8ad1e2ee56435e9538c8005128deeb935e33122e467b7e648

dcf173c812b85f0c890122d27b7e3b2e8b311a105106c89c6e33debc40cc8f3e

dc50491b564dd8464d6be3b5605e0b55016acb8341b6b21ced5858baecc22f65

dcbbe31e1100edad1738c3f997543c5085b5b2a5b610dd08ada35427827c1231

dbc2e39cbee0266495160ede50c23925ecd140ce2ce4a404ed266b6c31b4193a

dbbe8aaab05fd5b59b57fee83c686b1c52687ac268cdaccd239cfaf07eb3823d

dab746b6a81d30ecd619c73d79f7547a8504a164b1a78d221a068c7716fbcb38

daa63ff5c21ea27e498f4761232593da00180e72b512de133d9a880805d1bed6

d7af61987667498e6f49c334e4f2c98438079d9beec6378a7e00b2f6bdb365db

d5bbd0ee3dba60ce9d267d68e9e271c0934a628b12a73f9edad4756025e0e1e4

d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65

d0183ef7b6efd3a68c5d77b9e56a9a5011b37d390e7220c635c9da4e0211c936

cfad6ed582b6ff693ace379d528a7a5d7eacf7260b610205ad42034589e0ff40

cf5945f06e66c4ab2147ce60c26ffcd30afec0d73a332a34acafe81a975aec6a

ceda57b3613c2f45dfd8a1dba6934bd2ae32baf565edf752b4044c6d03339e51

ce79c488866ea23c1ca3d57e197cd5a90b7a9cbfd23387f1aa7beacf7641a3ac

ce056ace14b47eb50d4ece1a9de21aacc2d425560236eab9ba067954a67fe7e0

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee

cce2c944c38e496a4b6ea34f81fcad15e9052874b30496940ff11baee55c952c

cb8bda0768f75671cf49fe5669d1253729e48a45b1c31dd92d9f28612837c485

cb3542fee954da4218471287154be9b09236f2099a0d65c07a5b742f8539f2ed

caae3a24c2f02c86cff5fcc3d720078ebbe85eaad9dee68a4ba03d16a212dbb4

c97afa425b4aaf68c3441cdef9d40b84019b73270f2cef2b208b34da4640eb76

c935b82862464a7821ae3605d32506226dc70e51dbd75b7ea98c4fa4e06a7f15

c9159fe9c3845bdf97efcd20c5f1bfe252c6429878768709fb59fb71a5312378

c8f686cd58ab02adb7261536a3f21ee0fedbd155ed33e887e3914a48dae5f40d

c6b1c96cf3ea2aa5373ebdaab3ea9815100e4b8febc009bf464771531892a5e4

c6af21e4f260264279190d2a042809c8342ecadbc4cc3d6882e6105a58fead3b

c67ac406fa56bb4bd65b005b472e36a283d9b300506e743dbef118e9a26a2b1c

c4f7e8d339aa588d30f2169e67aa33113e9778f7b22c7d2fe080e3ab6ebba5f4

c4e8bbfa30ed64b57cf5b0b3733c84efe0170057e3f4382c8b2606681db46f21

c4c026138e11e9fdf6e24643b4914a530d30fbe944d1c11bd054d6238c8a4e7e

c2ee8889a71ca9754cf4b0b7851e9db50f5c9097b1283ffdc5c87433244269b9

c2da4321d091d414568343cccc8006f780987d5f4c70af264039f736536c266c

c29379f23439cf047d4839072856b4d5c598a0d06061347c535514a4c0f8cf83

c22b8c9f0e7cfb4c64651324eb1fbe8aef0b7d72cad9197280fec101067b19e3

c2191d815d4fb2d9785ba67ce149af0f6749574bf8b4f7b3ab4881fbfdcf1afe

c1abb495a5e3c1355c441cb3e11dcbe17f51d39e81e5699b963c5e08007ac384

c15fe5e6fbddff903837a08e70da7d7bda57e003561df11420009461af621536

c0fe9600ecb15e739cc6950e10ea56c31c1d47d0e990dec0b61a263f623f1043

bed5afb1bbaa3736166e03893e27a54c5effd4ab414e948c92dd348c6b01e19d

be992d892d7448e2fe6d6bb0f6de72fbb247ef068e6cbb8c302a2486a8aceebb

bd012c215761b13c55b2ff254c2b18f29af006e188862849719ae73a0387e968

bc4c4b37114da088688083566f45a8afa07b756ac7e02522797ae7c9faaaa127

bba10bcb1fc8fab16c3bbf52a55961f1b02434f8ba94a9707ef86ecfe5c2a25a

bb04ae24b09d50c9a138cc3d902b3c017896e4c30384b1e2e8e7882148792ec3

baa9171650c7d1f24e51e70416005a9068db6bcaf0c7aa756bec39f87c86a07e

ba68161393c1f32446b07f0cad103f1fed3bf73dff2c53c2e7a3283901fa96cd

b9c74fa7a1df2b36657a889be96c1783f0cb5a4b9778d33c51926af767f2fcac

b991bea14708bd703a46fa6f42e166c427b93157060f97b0284301274bb55767

b9185338cae8a11d86f15adec1f5d9be7ec4e03bc8128971aa2892b86b70c8c5

b90c804b11c532cb97d2e306b29b64f80dc890121bc73ceb4b355e9fd65fdcf3

b8fff702a96c25105a0c2d375a69bd379c6441a2cb138ae2fea94e2d6034d551

b6e56b2d1d48fe9ba93a8ba5063a9a232a37f6bd1e8eb63e3fc711d95a89b5ed

b67eb16e375407648c85fb731366af82f938f771e8eb77e060164da305fcea59

b5d968deba0914f000d9a281d94088b7c83c04b15f3b8d58205849ad6df57721

b59c99e41c8d7ff8f5a2265caf51325cbe7b5c0e3024e75cbb23bcc384f1ff7a

b3882d70f17a0ed12a5705810c72438b9fd0b1fbb7d81c2abff4651ae91629f0

b26e4662c6a1c61ebba9abf6c4a96f5256158846542401a539af1d8d597a8d29

b21b51d73369355bd32901c1e73021f01cb088556d32a6cdbf46821e78e90432

b13ebb1dd390e34b47c61b27ebfe57f4fbd01a9fb71fab79636ed5734c59874f

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e

af9049e31eb0d43ff8d83fb8f67a6415b156d7f71cef6c7b784d0d167629a462

af56db1df2063d34711b826d47929086933568781d34f6152b122dd7d08d0e67

ac851c7c20500893d64adf7522f565d02b443f6ab6173963f1bf18b470355287

ac60c0a4a174797bccaafed23d5076cda1182bab72ff778bec389ad27fa0094a

ab30baabbf795728863b02eaf649b389fcf91ec7262565059de1b1cd57f68537

aab9e3d3f923f7c17694df3bd395aea1112f87e63580c1762579c43056d3b2da

a976728c8b3844328f0f7032c88071a33061f01df85c39a87aade7c2695455f9

a9677832e0b19aab863d243aec2245a0be5d916477bd58ae10b8674b912161b2

a866b0205aedfc7677e88e7b8eb71f02c3f46337df277206423e657cdfeae2d6

a83f6e7a71d300c1f5dd457d848a9859eebef336b3447e5623c37fc8077fa42f

a7794d56213aa17da06c4104f97c3822f08f1c8e02b38ec0190e7812c2c76972

a7504addd9879ff171030b24a35c7454a39a997021a6056f4d58314529e07268

a7563ce92657f350f78789a63bd1f6fe837536a0ac37b945b5bb820c4c8b3de1

a64dcff78fae79cc878f62d832916752d97326a2588693affa6edb1f192a748f

a59707803f3d94ed9cb429929c832e9b74ce56071a1c2086949b389539788d8a

a609089768fb1cd2d740cb4ff65c543b01e6da4bd5fa02011761490459227030

a115db9a3cb90187e62478feaddeccd5ac3b7a3685a617a55e14c7f2ce7d9c22

a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849

9fdc1c2fc0708a8ce04f318ad50734a34102b5c103101880f458a6ca7cd87e19

9f1babaa14639b38d21283856887f68d943ce4336f89cb6b900f948998df3e39

9da59e3ec0f0386d09a20328b481bbb7431da0cdfa1214ef254a7f8c5b800a49

9c4e1f52f354a73b6a8cd7091f7338c3567d6d510c8971a749b9d608abd105b6

9af31121df664468c186cc379bbd786d1a2d9a33518c1967c550e1bf354866a6

9a3cc5c5751da0bd60baad3bdb18f9a730bab009c8724228ea2ffdc933377bb3

99878eb949f92b1df3d0b3071edc5c1391dbb5f979d69637fe64a23a104604c9

98734d3ad1484aaa9405652bf8952e5f429e1298710647d6be3f9a2a53dc48ca

980b3b2fbb864eafdf0979040dbe2cbb8aa47c3ae3c35d3dbe4747164a1e051d

97f18268b17e76ed76e2c0b67b9aa1a15d4f3a7a07adf5c274fcbb8df210e456

97d6b0703a5a9e1ded6aff722c8a77c275268b40c18c424e4f007bd6238d1482

97ba5eeeebfd5e2bc6dffdba7fd2100498eeb494092b3fd4a6c98ca98d18fdeb

966137fc7db3f3596601f70e4f0518dc461ef780025f86dbe4d32a9fe298cd4c

96465ce935015f6b1ddcfbcf378a8ec5b314ca9034210c6ec908ea38283fa2f7

953ba5f2beb3948bae7311a3b8730ea0f5a3c4a2dd0a83805261c4fe089c0697

94cc8b757164067fd4e7290ad491b8eb9bc8a7b4da79c1a71b7bac28e3e16c4d

94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a

94a6d70189a393ce905525e04fee0f6fe011ab8acf89273c9315d0fea75bb12f

93f6b49806d6b05eacd787c25325b788c51d09f21e018b2794554364e5f091fa

93f7e95461c18aee7b56651069104710c76f9e3d6543a0b3248a21b236859d99

93874aedb277292457e11b91acc41e0d31f9f695a13325ccb279e1e835c9c89e

93a215b08cce42249341816df7a85edac12d4bcef166b15da64bb238637f6e76

92aba7c651b8cfd923a9a56e6cfe4d9ccded591e897a415e7f5594a94a8fb561

92448bf680c6c38962d84f20c1f6633d0b7ef07261ebb6beb39d1974dd195142

91b4fe66f4a1c73dda730c752a4aa2895ace4458094ddfe8e064662766672a1c

919ccfa399f0b60f9b0680b0325b3415ab7ef4a357765c305756d56017b1ea9b

916d16da9bd18fd1cba74c3753f67b6d11fc9dfd8dc4079f99cd65c0b33e667a

90f1511223698f33a086337a6875db3b5d6fbcce06f3195cdd6a8efa90091750

8ed1ba513b298c2dea57d5d47b3bdb8dc3d622e8e8b64ed244633ae8ccab8cfc

8ed02792a35827502abf017c6f2406b9bb6ff33869e995a5dcaa3746dee0c76b

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806

8b02958c34c861285bfb221cb75f83a0ce628311591f8160cae309bb67bd4513

8ac71c7562494dc0d6c3b8318cd32932240cd69620470694f695a2075579fcfb

8a2edeef9978d454882bfb233d9cd77505618b854f7899b27aeb095ff8ebb3f4

8a038d42f1ac477fb6013d92326c362f33f4d315b6477ca0647958493f909aa1

8910550c45d5943d4d61d94ac4747b6f2a8a910e8c37dc480598686e3dcbad78

887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798

88e0a270764afac00d5d82476d9bc6a683bf5bf23de749496b1c309cb9522b25

88102f0a4d32b84c312282f0bdb95b52c6ee20cdc988b843f322392443a50a7d

87bb816cb95827fc2617039f07deb9b0f0fb1f90d3ae57f33c3372c998276d7d

879803d1f559e2ef57e857fabaa03f7809b973fea3a2ce97d26aaf5f50925f78

84aaafbeb7656207f9ff6dcb7e9804cf6a8c490dc60305759746827ff0235c8a

846791a6a27072476ac541a916139020586efbca26de02bbdb04ffc129d4f942

847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934

839550463e4e5ce3fa738378529b1e818405967413a4351d3790eee5c10a3ef2

833463eb043b206d9006535e3db749a02e3d68c260594d96a1b798b665d93cee

81fcf54f9a9a9973bd734e203623f329dbef09789e2c25c78ef1c19a6f0c72d1

81f816aae3d326da8d73f33f10297f24cc79482c6a1e87393af64d496a7912f1

80edceafa37bfceab49851b072f72321e2744c64779d5d688b6f34b23c811069

807f8b57ff50a1158db4b93f4f0a2e980fa45856ef33a3d1002c35f9486f03ad

801b529ea3173ca504af6c8ee1b48f731c5d83c4771677b0752af779a0f3d0a4

7f5f9eb144478aebb4665c675fa41429abe70c82af15815b027ff7fc19993a0e

7ee8c73eba7c4b78d9dc8a270fbc7634f2159ca50eb6ffcb462079a4f261cc8c

7eab72e3aeab30a0eb219dd975a21aa5f3bd7d416ddd92d5b71f1eec690ea7bd

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296

7d225fa2486a16079542adc6e3682ad6420fd26472679d68f5b753494e222106

7d026daf10da5c5f08136dbe73cd8d9d8f785809623db082dee1552cb0ead47b

7cd19784b1099e07063e70f9e7455920d4fe94f62f374a25017b480df938fd4a

796fe6d21fad602d57b7f6c1eced4a098531df9e96e56356d60451df024cbe12

794d6f72c25d52964dec11d638751728806a5dcfa98d49ba68830f38b438b439

78802d5b705042a8bab3ecf8597c611f58a37b9bc1a55f382c551ac6e35ae928

78eb9d6019066636d069d3a3b49e46f6c59db4e4a0131d752b381981aaa9e605

768aa58c7e2395868a5a80008dab980cc44a05eb557db3071773f5358e9c8d6f

7551c09f44dfad5e66a148e9cb410ee8b7c66ef75a6062e64773bfc74f1a0882

7502eaf57d05fd06b7d8161f16dc67b3d156cb1c723b7824cf6759a2c77d3394

74bbb2320f687034cb63aaffb8c72cf7c4f45b13fc9736c32715bca325fb0322

74a19a12a8d5ec89f985cc23b0f93daa91fb1ac4cb1daafac2fafc68c1b4d852

73774861d946d62c2105fef4718683796cb77de7ed42edaec7affcee5eb0a0ee

72ea8e468aff56cb124844f3916c2b5b91639e65245f53e2875620e35f1557ef

72e0fcfa4cf6766f88df74da16a71ac04e78f6219804037d9d3f1639a81ed066

723d65282654f712d54a9174ff56379f10a74f2a2d759ea49b8b2b66970cb7dd

6ed0478ddc8cbe4fe99236a6960575e39420bde28bf79c3b8858940d806bd455

6c1df9be76ce31b48cf508644ccaee044cf8c8a3535a6e0a6a6216f0dc9a5f02

6b98e37546c7f016f007c48042022138fb28c4677941700bd7f7d1dac4930870

69390012180a34df94f1d2f0e10f98a2f7666389c053a2ed5ff4986c30519b14

6a28b2f6f6e69dcd7f709b112a87a8453cfb425176bd9057f53d679f4b4a1f6e

68325268b75be1a1435e012364c0c10a4bd460b43e276f5973865425ba298737

67ee8b52692857acfc54c96fc67b3b092858ddc9568f49abaaa5d5c786a17163

67c9b66f6845b5a7f6b32d56bccb420502fb901bd460f0f19ac548f30abf53c6

678fd0c9e3eb849db27b2e005af7c1015adfdd77fd1e4d7a10ce45bd26490a4d

674d7c224094184c8ba0113b94819c51402f396a65b2eb684a9198f6e69dbd60

6727b168e1f6f47455d68bcc694b11a4eed88572637e270f3d507ad2128f2cbe

66ee017ecd7196a00940503950bf4882dec3c61c1ddb3d8be2f87675c72fadf1

65d7ec22b961663df40883f5a851296d017e2866064e54c276fb4b044736a1ad

653a8d9f8233baeb4907a6c0030c6be64689d2fa4c80ff22d8c06e49de1f91af

63e589eeeaf22d2903778e9c42e41e4d67d9bceb8bb07f3491a1ada741408c35

6397376b99e8c8f7999df75eb88c379e5065529b827ad84f4a677f29bbe26c89

626f50c73b3ddbfabadef6a5523e1c0b9285e8cc11cb2cc0bb84bb712720d069

61925bfd71b4d2be670b0bd373b33645d6af062e5d41cb2b6f6c984acbd69de3

6191f417f6fd4f18af1b2ad592ced0d5658d214bdaeafa94dcd2b83979d8b77c

60ffa2a4c96b8f2a95602fc190cabedf4c5860f8514a648b601f0a96fc6da7de

6025287605e660ff65f34ee9081d2a8a25cfdca61fdd584479c2812dad84030a

5f9c156ac89f910b527a71ae3395006cfe2c8d2fce6ba4712b324149f0707f1f

5d7308cc88668337c12188f7b1597114fcfc737c6ef5353ac7a4b31303dbf662

5cbd3154967e870e55085e4679415ce2d9448916169e6640d468cb17c47bafee

5becad2dcfad4b96563b2cc9da05eec3a6511cb5f6f0072c967144ce6459cb29

5a941af0b30095133b88c69be312ec6a04a409ee2dd331e781f9642cd97347f0

5a730112a38ce1f1ae7f7ce29c2cfa85abe1d544784674d748316e5734cfecc3

58f0839d429c0aba51420e113c44889f248ede5bf44318dcab59d09642e73f56

58c15b6ead753c7740c08232f79dbb0eaab74b613052247e49bf5d6abc8ae046

5872bb7848f6be37f47188a6c28e5e8204b868909bf1df16369e4a376f4d5595

570347bb7de5d391c57abca86d6092944e7e4b2b17a1645bdbb8c3d143096d98

57b598a67e80efa4b2564e7319f3a0851d104234dbab55426140e7049a42e305

54e1c8b4d18b6b7e986ab989b47e0abe35c1045e5b61f8beb984acee7f09c7ba

53e7cb80537de9f0c5c73bf21373fbc90a98d34053a2c42ebc08a942e8df4389

53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

53ac258fddd0aa1c0b13518c4ae7eee145360c73bfbb61ed9fd71ca775d27d09

52cace55b98328553c36a62bd288b737c66a2412524286b8bcf751fc14f634a6

518e4e2959bbc4deed8d4283973388314e226c2b45896f7bc50dfa2e0e0a5a95

513e17579b0b155256d134940ea03d8ab7a0d1f71ebe188954e2450cdc6b7d99

508b33fe10057ec4e03b0ef5a4bd7dd6ffaf6579f822839fa0b85faa5e71c53c

506d409ddde519031c4866b1d6c582ef59de476f4c001716c6dfca4715ee875b

4ff60df7d165862e652f73752eb98cf92202a2d748b055ff1f99d4172fa4c92f

4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576

4f153dfe5f594a305abda5ec32ca158217231ab4a8f1e6722be62d38d87caed6

4eab39d0ed20d70b8a534ffe370285100a77107e87c326a45a49c65b4037c7fb

4d501bb98bd6338c0c3a7986aae4dbe1e9d436b69a6a0bf4881e0f5355898795

4d0ad334ad00318b71122eafc0269db6d5cd63e7fe6f2889a5c46cbe37ed6592

4d2c373183b07dcbfdbd812ffd010e569d17b97d69ab4e82e57efc8a0c71c98a

4d342e60d65e89342f46683acdd0cfd40d9dba9a9ac337df64641dd757814c53

4c924a040bcc5cf2a8dce0ec931d4ae1877b7d29023ed94821ee03c486a721d6

4c6c79daae20f9b97095a08110ae91eafd87452524a537b2f8c0520055ed54f2

4c6b54a9eef6fb238f01c2fc97c9fc09a52db0a110732d9c046822511f79a1fb

4c1efb66c263e391086bc2a59eee7b1a4e2b47d850aabaeb0adc76e709e14d75

499a48d50ec19ebe6f40dbad033a8067d3d0e5b3311a8832721ef0c26d8cfc42

4933d95cdb4e7460469832a1ea0b42573978b6c86dfa119eea078509e6de01d6

484463c464111eb6cca5f2463ffefe0a16d57e4919fc74713adcb55e26fb59bf

47bb8a605056140781c84c1915efcf142855bf116112d48024fa72f6e5cf04ce

4786daa0dd9fb810aff225d752e6fef24f91fbf1071d8e814315ab9bbe78b502

43b8db8162375a1d73192d45beb0199f959cd8404f3d409d3015bb71c10982cf

43a3fbb1c0a7b5885eca1df579077db3ec8cbf672985b17e6372a69c80326520

4372aaa1b6d3a95dbd74efb6cd0b19a9de9de829b6cab96b827ab0342ffcf549

42a5fa86e9a20424e02c560591a122dd3f00fc49ed0482075193baafc4dbc5e3

40c618788ae9c62899614a39975515500c0f3f2620d536233a4b2976c42b6980

4001ca434aef1efa8738bcdce056820150a9abc45e8ce3690d9cfc2188e96f0e

3ed098f6101a96a18329ec446027b39397e2b19501b3ffde98a55b361c3c6440

3e2f5aa0ac14191d983982d46ac1a77c9e4b36b6d5fd71cc26bf19cb29c4723a

3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa

3cfedcb5187a7f9d5a2a2498e06f649d1fdacc1f78b8b7702ddf6624485d3ca4

3b9d0641932d1a50d008c339bef637d84f0c8a8d67e3d52b62745f24b1db2a31

3a993c44e39c426239051b00aa692b7e7d1b6092a2087af04b3f3bc3a3c79208

3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f

3a6886d07c120fbf501abfa40f763c05d3e8c374e1391d9f8ad1364dfd52c8a2

3a8c5efd2a0aa42c1cd0dd264242fdb1ec466b585504cd7bbd032737956ebb43

3a5e3ce50c994518cbecf2b65175a50444c4aae0893cc08a7c98b1b7b393e2ee

38358dcb68df0e12ab3b068a56aead03800bb6cacaecbabadaca18c37e13a52b

396308b7abf201b80232084a7313d5438b80b9167b91f0bfca4c8da8c7b3fd7d

379d66833203af4b057306437671e50b9720f6f5e6a86843c3d766ba26570473

34e2957a0bf800a5ad1be4f6af06b55feca2c944a80b6ab13ebf9c30f8fe14c8

3536f2ec65a6459dca56d3146c29359b422027bc446c3759d74c49c0e229ccc3

328b07e33759c6666d7cce2f181430f3cfa53690bb3c3360dc314ac6bbd3700b

34a88c22ab8ffde7228629911fef336c3c175a4c0688cfa5f64586472892225a

33609f17db804ab7ca6976a2bc6ef29d495f5ad7ad6a0043756c8a591a4ef269

311a2300281d2a6234dece639dba335e7c6451685ddfa683ef3bd767331bc1e3

326a84702468acaaa4b6aa0eecab55dcb8f443ddac5a6dfb66a4120a4e42ab49

315de897b025f9b77fc6cd1d91fc3172f1fd68f79373dab02d1428b6e4f724cf

3028bb7bbb0ee74ec59322a6e00f44c52d4d06c23296a8ea2c78e2ba16b8ebc5

302f30d2062d5e1e0322ab5a0f047be27bd1b1715ad257411ca1cd7bd4df6633

30a98dc57205976c73da2f404890c899c7d84db61572e1dce0e80b3f06b48934

2fa2588d455fb9e8cd582e47fa6d37e15d61b8dab9a56998fd19ef1f32e9c5e3

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d

2f2c4affbbc92bb3dd14c8c3a202f05caa3faddf2dc235ccb3ec8ce577526ba8

2e078766bc68f65ac87fbfdb9ccaa3981ee097a8ca0729b9be552f09c9497693

2d52b8bbe1af82a599cd155494c73eb1fd2adbf8920f280d46b9ff29bfd4d139

2b78c2b7d2c9a8f5d1e785e8afc92a03da52a53879d93238207e8434ddb661db

2b54e08741771d8d859030402647fcb2e765bc2313bfb559c58154ad2ff9eb30

2ab68c0f85723801a23ed52536e66a2a063dcb4bb43bbf6d8ceff75e29823ccb

2a6c12965cd10eec9972db4a12a01f2479f7b8fff463857f126762d965fd2ff9

29e5978e5e9f8156005fd7ede90d31b4e436803e1a92d2aa5fd5a1de3a5e1782

28d318a64d06bd5c86c11002be6805ebd114600b2f1e28f136924668b915e77b

28a56ea1847ea41d63ec52dc576cc4d2925d56c8674ea65d46d7d29f87d1a279

285248be52ad6d59a7250c048c91a3cf31adf3a6b9d1967de595e4545e34323d

27d6114488074e064ea7ba6524683a7037a67c55fae1beebca412c304a781a5c

2707610b0eba853264e3cce793b35162d40359a57ff94d998a31524bc12a508f

261a07a99230b34e215997ebe1c12abacd92aea2eb222944dc1d4965f7b9434e

25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052

24da03a449dec4cb42ab051913d1187bb85ea5ac2870271c54d2b1e2c2afeeff

23ba8f3df5acbc3d415081885cdc31bbb1c2f036d1230c01530e2385a7bf9016

238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646

233815d80ef296b355d37815565e4279b22e8849298e059db2036adf7e18520b

231c2762d2e2ba3d2d18d22c6fcd86528fe51435db57e26458f6351a380f0152

22bae1e1d7d3897a6ba983e0d8c55cbac7cb49ea90760ba71bc0c1470efbf1ec

202ce2355b1064459c88daed93bdcc39bea2f0c86aeeba6c72889bcf137769e5

1f421a7b26672dbc3fbf44228707d71c91e8e354bd4ac2f0581ac6a3cd54b4fb

1e69e27b535dc21998b6ff09980dc2405fd7a708bcf4196821abae77e8609c50

1e10dc67146c5aa2fdd6913670dd06c59bb021a4ddfc8b1713e7464d43d2189e

1d8673e3293e7f87d73e7bce176f562343297cf0f88c13f92402b73c9eda0fba

1bad86039f7189f0c143033ddc28121ffe9a4c438becbcec123bfb6a01a11885

1b924153518efd3da8d0504e3743d7ac8b9df391ab6df57fbc2468c718fe3122

19f1f81142a02fa639d523cc3b93ea90957602403f079832e604c09b49743666

1902ac59e680d6d338c09e68fbd7181a3a4fda9ed9ecd88751eec0e04741ddfc

184e53af04ff158a22facbe4499694223462bfed7d6c96e83ec1be69272348e4

182e08bf5ee5ea1c32270979ce3db9f12bc300922b89715222db003f75dded7c

180255b13cf2100dc91e2b0bc45ebcd6dc8b2b58d4e1fd5e60802a23b02467ae

17d74e5ae960e61f455c750dbd00c0350f18a16f1ae867b0361cd53a633c8f14

1776bed93c0cc57b81c04ee042c11b2079e8dc9102452251e81e298d074462c6

16ea0323c740dda2dae2f9dec15b86942aea8f9032a6c7035709edb9880c7f48

15b65cce1b662600baf0995c766f301ee6aec500925a0576fc1b7219a7a36a9c

15287c2e2b3d5ae03c15eabf1b78b814502f6654e1ae9b9db3aaa34a69549540

143b3adcb01d337cd9d919d90eba0bb87e38fb169c3e72d5074c9ef55abcc8c8

14e8ce52f228f9398ba357fa4c4e7aaf3a33dd79948636c8aceaf829475040cb

13ca1445f252cfd3d31708e1d110a0bd0234b56b78a4e2c18b550ac8113ddd71

12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305

11d437174b38cae5ff70223c5ed7018945019b3caf8fdf127a8d705bcf57234f

11bd2f957e6e59703bd92d284c5c832c109b40b8a5842d3983f870906618f8f2

1137b149e0bced9e6700658b526bd7eb27f59e0850bef8ee843359d887f6f131

0fda29f0c20f799d9dcd6ea205533066da4be578e2014fc6824abd26130c3ba0

0f0757d1baa3bd0341d282bb0afcdbdb522676db05814a3c3051c08829151b52

0f880e89384b2203198c2a9012ea0fd774c4cd316d5c0862ec6ec650744464d0

0e244c6cec7b9ffb12e2d0bca91ccd7a4633189e96b508ea32be7b9eccf186b3

0cb924f8ec2c2c7aacde92b9ba77c1e02ca49a7957f71de6f2ebe6cbcd221bd5

0bcb2701a08bed8d577d3667ab8322464f0c6a5505496ed5cd2ec085f63955dd

0ab19bbc26cc7470f6151c09300ea6998d29ccb03dab4265f342af88b3f92068

09ffc4188bf11bf059b616491fcb8a09a474901581f46ec7f2c350fbda4e1e1c

0842f86cbc502c279ed5fbdca472a373720d5eed1bb05d8878a578f512dacf39

0700cae07b1231b575051b8e29e74204f67082afb8a8e2a65de53726d54511b3

06ceadc86262215a62d01a860e596fd1e7d76d93b712683bb750fe030f0c51d4

0551101a6be6b0432f965d6a070871759ae79c1feacfc04d382a632a4566d35d

068cbd45c48718a36730cb3ba91fca2a659321516a4f57286f21369ac8d2631d

04ac22d83d8f0f26c1f73e59fa4ed386698533130a9b76ad1a78c64d86a91037

048e04a9c02d041edcc6ef18d16f1d6dec1b608ca27202e4fd410cbe6af0d9ec

0454f88103ec28a7e5257540ab70135b82214354272e50f4e4c957923b3c7e0f

040fd4dd34c3d372d1ed41375a8c27c7ec17bda9e4a2d05a6dd9b3a3e2111ddc

036c8363e4bd89c72883921e766ee2d679a7ea24ba5533941bf3e71b4b8050da

02f9e68c32246b0cfb98f07117050c52ee0a648ece2cd4fcd55d1c7861723fab

02b617be7df8b017c2bd62a07a822b1c00fb357b9f79dd503ffcad91b19c7695

02ad28baee8ea9a31f32d8abb73bc979900d4844e880c59d084369829a31b6b6

02536d95f6b28f7bbeaa9a2dcfee44272d4d304c40bbf3e5b67e6124f724753c

0205997723697f8a60c04dcd7475f1e0a9959f3f7a26110beee6d303ad618168

0136cc97bb63176b9e1615a9d552b619931fcf2b332511578f7a8d5e82598d40

00f0dd868985d99193730621e6b1138d83daac0ee0934fe8ea37190c24cf9af5

00e18b6dd077d1653a31266e11465e1a9c66362f35eff47c4403850de9370824

00dedb250301a3639bd552acbb03f145c7c36b5c5b89a6a8336593b475bd5ab8

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c

ae35666999bd6292bdb0e24aad521c183bac15543d6b4ca27e0c8a3bcc80079c

86ebfe9d8b3c928fcf80642e88ea3b195b2ba23c6a5c17fdb68de13baac75cd1

6a67cabf6058aa8a2d488a6233d420658eb803cba9da04f14b76e2b028ab30bf

617709e9e728b5e556ef7f98c55e99440d93186855b4a09d59bc4526a6fd82ae

28738aac83c5534b5c3228ece92abc3b12c154fdad751a2e73c24633a4d6db71

25e24385719aede7f4e0359b389a9597cc26df20e1b3a6367bbc04d5d4982fe6

214540f4440cceffe55424a2c8de1cc43a42e5dcfb52b151ea0a18c339007e37

18303e4b327cb47d131b0a3f3859e4e90d8fa0c40cf961bad7a34b550160e919

021921800888bc174c40c2407c0ea010f20e6d32c596ed3286ebfe7bd641dd79

8501e14ee6ee142122746333b936c9ab0fc541328f37b5612b6804e6cdc2c2c6

fad25892e5179a346cdbdbba1e40f53bd6366806d32b57fa4d7946ebe9ae8621

ff5e40fc794e56fd78feb6eb6b30794970f7cdb4a767c4095e2d20a90bb0efe8

f8fc9b40b946b742d6044f291914439727e1a7f53ea87562446f682b26cce65a

f5bf914415faf7587958bbdc3312536fd9abea647f1541d44d2e757f0e683650

e8e76b851fc78d87fe58ad7d29bc6356a8965236d1b96c5f572334dd695d5de9

e8979741f0355a47dae575ead8c829df47f282b4533ec1be4d63086515f9c449

db265ea1732935f61e8d0f7a20a8adc54e20af71b3cf4a737714cd3377c838f6

c172abd808cc6216b309bc307fe69b821c7eaed35f874fd4684ab33b4291f95a

c122596e25a4dad1d46d4ab983f4ef15bfa7b65582b7c311f404036766498105

ba3fa920708db856737a66f70e2c7e86bba73c73836f7f30c2ce42cd70d0c5bd

b9dbe9649c761b0eee38419ac39dcd7e90486ee34cd0eb56adde6b2f645f2960

a557f891f4d50e458d745c7eaf7d0be3eceea36f0398097e977cd3f6ec463875

9fc48724cb9f70f774f7ed9e809e49979bd089dfd641896d8d5e3026f049b0af

9856b816a9d14d3b7db32f30b07624e4bcda7f1e265a7bb7a3e3476bfd54a759

8f7a90b540f38712c9c1a5359c6333bbe1091102d6f621b22321e08352c84cfc

96212917b7b0dc881332db7ece0bacfe21d9ac713af1abe078f6d3e74baacd01

7dff08656413a737483ecee2a50e412338ebfee3d36a1a5c04e74b25949b2306

7dbebb7c76511fc063b5ace0a9359b655f66a55a494200b8fd11905c78b5fb90

75db4709428310c76656bf76f5de267ab490e43284312b374baf7582108300a9

7206eafc475f246e7c9c258afdaaa64b5193c1c7427d927be417e53dec890078

6e892aa13cbd4b71a1c476207abddb1ef830be04999809b4ef569488a37e47e0

6d7a94b7551f15732e193a07357375b98b463f0dce6b1fed871a42fcbdde9f48

68e1caf530366b1890993185157c01161b3d625063d75a41c88d2d1bb8edfe02

5fb093a9348fcf4a81befda978c948796a8319fcabe7899c2cf5ba1419ec9d35

4f52b4a2a781f366ed534d8c4b2fafef48a7848c4c20b4229b98747ca8ab06d3

4d9274cfe7a2bd9a125352271d1634708e1f9b1d70b056d1c1950cb98b8f91ff

3584ca9c1e7e0a38e47f59bb16c21203a60833d0f826294d535a98e7ca76d9c1

2b026343214c3d2c10fdfa9b04b7694e57ee8d3605fbf9a2e127fe6fa9a58309

2118c5b95d5d57492b2e8b8c0403e23b21acc4ff50282f8b6007ba89adfaa992

17ddc339b14845bc9d67c5c3cd9a0e617387cc0569131ff3641035d82043effa

0ede3cbe821e4f083fc119274f069c77e64a6a7e8a2c16530317b826a0939979

09e7f7428e6ecc68ef036c0751f53985882f6760cf3892f1d26af44f3b9730de

0737fa0b403fab17331c9835497a4f3b2955543e2fac85009dcc66df41a015f8

aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9

7b1c5147c903892f8888f91c98097c89e419ddcc89958a33e294e6dd192b6d4e

ee1e5b80a1d3d47c7703ea2b6b64ee96283ab3628ee4fa1fef6d35d1d9051e9f

aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c

9c27405cf926d36ed8e247c17e6743ac00912789efe0c530914d7495de1e21ec

9a8847168fa869331faf08db71690f24e567c5cdf1f01cc5e2a8d08c93d282c9

97e08d1c7970c1c12284c4644e2321ce41e40cdaac941e451db4d334cb9c5492

5d881d14d2336273e531b1b3d6f2d907539fe8489cbe80533280c9c72efa2273

3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567

0d185ea3b0a49c2fa65bfd2757c9d0705657f0639fd36f196ac394fcd38c361d

555687ca3149e23ee980a3acf578e0572da556cf34c87aecf48596834d6b496f

45.95.11.217

45.140.146.156

185.250.148.46

206.166.251.114

185.234.247.14

149.248.79.62

64.95.10.243

185.117.91.230

185.219.221.136

45.95.11.134

95.164.3.171

178.23.190.199

5.252.21.207

Attack Patterns

Trojan:Win32/Pinkslipbot

QakBot

Cobalt Strike

T1053.005

T1059.007

T1036.005

T1055

T1140