Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

A Global Perspective of the SideWinder APT
Summary
AT&T Alien Labs has investigated the adversary group publicly known as SideWinder in order to historically
document its highly active campaigns and identify a more complete picture of targets, motivations, andobjectives. Through our investigation, we have uncovered a collection of activity targeting government andbusiness throughout South Asia and East Asia spanning many years. Our findings are primarily focused on
activity since 2017, however the group has been reportedly operating since at least 2012. Alien Labs alongwith other security researchers have assessed with low to medium confidence that the group is operates insupport of India political interests based on targets, campaign timelines, technical characteristics ofcommand and control (C2) infrastructure and malware, association with other known India interest APTs, inaddition to past cyber threat intelligence reporting and our private telemetry.
SideWinder is a highly active adversary primarily making use of email spear phishing, document exploitation,
and DLL Side Loading techniques to evade detection and to deliver targeted implants. The adversary activity
remains at a consistent rate and AT&T Alien Labs recommends the deployment of detections andretrospective analysis of shared indicators of compromise (IOCs) for past undetected activity. In this report
we are providing a timeline of known campaigns and their associated IOCs, in addition to a large number ofcampaigns/IOCs which have not been previously reported or publicly identified.

Page 1

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Analysis Purpose & Resources
AT&T Alien Labs authored this report to share information and improve the understanding and collection
potential of SideWinder activity. The purpose of providing this report is to help defenders in retrospective
analysis objectives, provide guidance to researchers with our own findings, and share a foundation ofknowledge on a specific and unique threat actor for defender identification and future industry reporting.
The primary resources AT&T Alien Labs used for this analysis includes private Alien Labs telemetry andintelligence, the Alien Labs Open Threat Exchange™ (OTX™), public file repositories and sandboxes (OTX,
VirusTotal, Any.Run, MalShare), and multiple infrastructure analysis supporting tools (BinaryEdge, RiskIQ).
Additionally, as can be found in the “Past Reporting Timeline” section, we have used publishings on
SideWinder activity to help supplement the details of activity and identify noteworthy multinational patterns
outside our own perspective and data.

Past Reporting Timeline
Below is a timeline of relevant and noteworthy publicly reported activity on the SideWinder APT group. Alien
Labs has reviewed and tracked SideWinder with the help of the many sources referenced in this timeline. It is
important to note; some past publications have contained errors we have retrospectively identified. A
complete list of indicators (IOCs) from each publication can be found in Appendix C. This list has been curated
and supplemented with our own findings. Additionally, we have provided secondary links through archive.org
in order to provide past content archived and available to future readers if the publication from a source is nolonger hosted online. It is important to note all sources, including the authors of this report, are limited totheir own data, telemetry, and knowledge at the time of publication.
●

●
●
●

●

Page 2

April 12, 2018: The first public naming of the SideWinder APT group was from Kaspersky on April
12th 2018 [archived], in an APT Trends summary. According to the Kaspersky blog, SideWinder has
been active since at least 2012 and has been potentially authored by an Indian company. Kaspersky
also released a more detailed private intelligence report in the first quarter of 2018, according totheir blog post.
May 2, 2018: Tencent Security published a blog [archived] on SideWinder. In this blog, they namethe actor “Rattlesnake” and “T-APT-04”. The blog shared an overview of the attack process using
malicious documents as a delivery mechanism for a RAT (remote access trojan) install.
July 16, 2018: Sebastien Larinier published [archived] an analysis of a SideWinder-linked malicious
document. The analysis breaks down the exploit and infection process, which is related to activity
previously reported by Tencent.
July 31, 2018: Sebastien Larinier published a blog [archived] with a newly identified malicious
document that makes use of a similar malicious document which generates a toolkit linked topreviously SideWinder activity; however, in this case the malicious document was potentiallyassociated with the Chinese adversary group “1973CN,” known for their Vietnam-focused campaigns[archived] in 2016.
October 18, 2018: Sebastien Larinier also shared an update [archived] on a new infection process
observed in a SideWinder malicious document. We excluded some of the IOCs in this report, as we
assess with moderate confidence they are not related to SideWinder activity.

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

●

●

●

●
●

●
●
●
●

●
●
●
●
●

Page 3February 5, 2019: Anomali first publicly reported [archived] on the shared rich text format (RTF)
weaponizer used by multiple Chinese APT groups, with links to known SideWinder activity. This
shared toolkit has since been primarily referred to as the “Royal Road” or “8.t” Weaponizer. Anomali
presented various intriguing assessments, such as a potential shared exploit and weaponizer supply
chain used between Goblin Panda, APT40, and ICEFOG (Chinese APTs) and then later withSideWinder (India APT).
February 15, 2019: The Government of Pakistan’s NTISB issued a “prevention against cyberespionage advisory" (no. 3) [archived] which contains technical indicators related to a SideWinder
campaign targeting Pakistan military organizations. The adversary was not identified in this report;
however Alien Labs was able to attribute this activity to SideWinder.
February 20, 2019: The Government of Pakistan’s NTISB issued an espionage advisory (no. 4)[archived] related to a SideWinder campaign against defense and intelligence organizations within
Pakistan. The adversary was not identified in this report; however Alien Labs was able to attribute
this activity to SideWinder.
February 26, 2019: Tencent reported on SideWinder [archived] activity potentially targeting Pakistan
government organizations, based on malicious document lures.
April 1, 2019: The Government of Pakistan’s NTISB issued cyber espionage advisory no. 8 [archived]in which SideWinder masqueraded as the Ministry of Interior in a campaign against other Pakistan
government organizations. The adversary was not identified in this report; however Alien Labs wasable to attribute this activity to SideWinder.
May 8, 2019: The Antiy CERT team published an analysis of SideWinder activity [archived] targeting
Pakistan government officials of Pakistan. The analysis summarized findings of attack methods using
English lures involving the military of China and Pakistan.
September 6, 2019: Rising Network Security Technology company of Beijing, reported on a
SideWinder campaign [archived] they discovered that targeted multiple embassies in China, in
addition to an unnamed Chinese defense technology company foreign representative office.
September 9, 2019: Tencent published an article on the summary of India/Pakistan attacks[archived], geopolitical context, and general actor overviews.
October 4, 2019: SideWinder and its use of the Royal Road Weaponizer were further references in ajoint Anomali and Proofpoint presentation at the annual Virus Bulletin conference (Slides[Archived]/Video). This presentation adds further clarification to a Feb. 5, 2019, blog by Anomali. The
author's discussion on the Weaponizer lifecycle is a noteworthy detail to consider in the past
relations of supply chain / relations between the various Chinese actors and SideWinder.
October 18, 2019: Rising reported on more observed activity [archived] targeting additional
government and defense organizations in China.
October 29, 2019: Rising reported on a SideWinder campaign [archived] targeting militaryorganizations of Pakistan.
November 11, 2019: The Government of Pakistan’s NTISB issued advisory no. 22 [archived] detailing
SideWinder as an Indian APT, in addition to sharing technical indicators and recommendations. Thisappears to be the first public attribution of SideWinder by the NTISB.
January 1, 2020: Shadow Chaser Group published a 2019 summary report [archived] of SideWinder
activity.
January 6, 2020: Trend Micro first publicly reported [archived] on new SideWinder Android OS
malware, potentially active since March 2019. The mobile apps were available on the Google PlayTom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

●
●

●
●
●

store and were mimicking camera and file management apps. The apps operated in a multi-stage
infection process, using CVE-2019-2215 and resulting in a full compromise of victim devices.
January 17, 2020: At the Japan Security Analyst Conference, SideWinder and its past use of RoyalRoad Weaponizer were detailed in the presentation titled “An Overhead View of the Royal Road” by
Rintaro Noike and Shota Nakajima of nao_sec (Slides [archived]/Video).
April 14, 2020: Tencent reported on SideWinder taking advantage of the of COVID-19 pandemic[archived] in a campaign against Pakistan military organizations. Some of the same details in theTencent blog were also released in advisory no. 5 [archived] from the Government of Pakistan’s
NTISB on the same day.
May 20, 2020: RedDrip Team published an analysis [archived] on the SideWinder campaign against
the Pakistan Government reported on April 14th. One noteworthy detail This report included one of
the first public references to SideWinder operating phishing websites.
July 12, 2020: the Shadow Chaser Group publicly shared details [archived] on a collection of more
recent SideWinder activity, including an analysis of the infection process and potential Bangladesh
and Chinese university targets.
December 9, 2020: TrendMicro released a blog [archived] with a detailed analysis of SideWinder
credential phishing websites and targets, in addition to identification of mobile applications
potentially being built for future attacks.

Targets
The SideWinder APT has been targeting governments and businesses throughout South Asia and East Asia
spanning many years. Specifically, there is a recurring effort of targeting military and governmentorganizations. Primary targets of government and military targeting has been Pakistan, China, Nepal,
Afghanistan. There were also many smaller operations observed targeting other nations in the region, such as
Myanmar, Qatar, Sri Lanka, and Bangladesh.
We assess with moderate confidence that various businesses operating in the national defense technology,
scientific research, financial, energy, and mineral industries of the same nations were also targeted in
SideWinder campaigns. Its critical to acknowledge that this is not the complete picture of the group’s
operations, and they are likely conducting operations against other targets.
Our assessment of the targets are based on infrastructure design/naming trends, government notifications,publicly available files unique to specific sources, phishing pages, previous public reporting, and Alien Labs
private telemetry.

Technical Campaign Details
Initial Access
SideWinder has been observed initiating attacks with spear phishing emails against their target organizations.
Attacks are primarily delivering malicious attachments, but credential phishing has also been a techniqueused by the group. The December 2020 blog from Trend Micro does an excellent analysis of the phishingwebsites. Ultimately, these websites are used to collection credentials and occasionally deliver similar files tothe attachments detailed below.

Page 4

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Email lures and their attachments or links are often uniquely crafted to the target organization, which include
content that the recipients would often expect to receive or benefit from reading. Since the group has
primarily targeted government and military organizations, email lures are often related to political events
and/or private documents generally considered standard for such organizations to receive. Figure 1 includes
a screenshot of the complete content from an April 2019 campaign phishing email (SHA256:
be71f2d17037a1a1fbbe8d7f3f4b45c72132a64224e3d3f13aa66a2249df9232) with attachment (SHA256:
ac4fd2681c3a9d087ff4cabb44b93753711e81c6574c837ca33f74fef37f3cf4).

Figure 1. SideWinder Phishing Email Screenshot captured via VirusTotal.

Malicious attachments are the standard approach over the use of malicious links in phishing emails.
Attachments have most commonly been RTF files, and less commonly DOCX, LNK, and ZIP files.
Code Execution
The RTF files continually use CVE-2017-11882 to exploit the target host and initiate the compromise. LNK files
are used for code execution to download remote files from adversary-controlled infrastructure. ZIP files havebeen observed simply as a way to supply LNK files, potentially an attempt to evade automatic email filtering.
One example of a ZIP to LNK delivery method was also detailed in the Government of Pakistan’s NTISB
advisory No. 22 of November 2019. The ZIP file contained a malicious LNK file (SHA256:
61669c7e59036ae95a2886cf5a42a89633ff8c53cf75e7cb89e0be9f6d4030f4) which performs a remotedownload from paknavy.gov[.]pk.ap1-port[.]net/images/E7B62E1D/1182/2258/fc8fe2b4/692cd02
to ultimately download a malicious HTA file.

Page 5

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Figure 2. Scan of NTISB November 2019 Advisory, via National University of Technology Pakistan.

The HTA files themselves vary over the years, often evolving with each campaign in attempt to complicate
analysis and detection capabilities.
The HTA files generally have the same role in each campaign. This includes:
1. Act as the downloader to initialize the infection from the C2 server.
a. Further HTA Downloads (multistage) or direct loader DLL download and execution.
2. Load encoded lure document (such as PDFs).
a. Often a decoy document and shown to users while the attack is conducted without theirknowledge.
3. Report unique host details to C2 server.
a. Basic antivirus checks
The scripts shift between being JavaScript, PowerShell, and VBScript. Additionally, the amount of code
obfuscation and encoding within the script has increased over time. The scripts have also benefited fromusing versions of open source toolkits such as Koadic and StarFighters to maliciously deliver the final payload.
Ultimately, the many unique implementations of the HTA file scripts lead to drop and execution of the loader
through the DLL side loading technique.

Page 6

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Trojan Analysis
DLL Side loading Execution Flow

As part of its infection chain, SideWinder is using a technique called DLL Side Loading to load and execute its
final implant payload on target machines. The malware is hijacking a clean file, by forcing a system program
to load its malicious DLL rather than its original one. This approach allows the implant to reside only inmemory of the victim machine, avoiding detection through generic file scans.

1. The script copies a clean system EXE file, which is often whitelisted from detection, to the malware
directory. In the case with various SideWinder methods, this would be the legitimate rekeywiz.exe
Windows OS application file (SHA256:
fa86b5bc5343ca92c235304b8dcbcf4188c6be7d4621c625564bebd5326ed850

2. Next the script sets its own DLL file name to the same as a clean file the application needs to load

during execution, which in this example is "Duser.dll". It is then placed into the same folder as theclean application.
3. A configuration file is made for the system exe file to avoid conflicts with DLL file versions. (forexample: "rekeywiz.exe.config")

Figure 3: Directory containing clean application of the copied “rekeywiz.exe”, the malicious DLL “Duser.dll”, and the configuration file to avoid
version conflicts “rekeywiz.exe.conf”, captured via Alien Labs threat analysis.

Figure 4: Content of “regkeywiz.exe.conf”’ to avoid version conflict when loading ‘Duser.dll’, captured via Alien Labs threat analysis.

4. The script will execute the clean EXE file, which will then load and execute its malicious DLL as if itwere the original clean version, which itself decrypts and loads the final implant into memory.

Figure 5: Malicious “DUser.dll” loads upon “LoadLibrary” API function call of clean program, captured via Alien Labs threat analysis.

Page 7

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Malicious DLL Analysis

Next, we can follow the execution of the new Duser.dll file through the DLL Side loading technique. Duser.dll
is responsible for decrypting and executing the final payload into memory, which has been written as arandomly named temporary file (.tmp) on disk. This process is completed through the clean systemapplication used for the side-loading technique, regkeywiz.exe. The Duser.dll does not contain malicious codeby itself, but rather acts as a component to load the implant.

Figure 6: DLL reads the content of decrypted file ‘MpyutHk.tmp’ and execute it in the memory of the clean application “regkeywiz.exe”,
captured via Alien Labs threat analysis.

As mentioned, the content of the temporary file is the encrypted final and main payload of the infection
process. The first 32 bytes are the decryption key for a XOR loop. The function below can be used to decrypt
the file.
def decrypt(input_file, output_file):f = open(input_file, 'rb')
data = f.read()f.close()file_length = len(data) - 32
xor_key = data[0:32]
arr = bytearray(data[32:])
for i in range(file_length):arr[i] ^= xor_key[i % 32]
f = open(output_file, 'wb')
f.write(arr)f.close()Page 8

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Final Implant

As mentioned above, the implant is an encrypted temp file, which is initiated by the loader through the DLL
side loading technique, decrypted, and then executed.
The implant will save its configuration file in the original malware folder and decrypt it in memory. Similar tothe previous DLL, the first 32 bytes are the decryption key in XOR loop.
A decrypted configuration used by the implant, which includes the configuration file name, malware
directory, C2 server, file extensions to collect and more, can be seen in Figure 7:

Figure 7: SideWinder Trojan Decrypted Configuration, captured via Alien Labs threat analysis.

The full malware configuration parameters used are shown below in their declaration state. We can noticethat in a switch statement if it does not have any C2, it will set one as default.
Following execution, two timer functions are set. The first timer function is responsible for querying the C2 to
get the new configuration needed for the malware and collect its associated information. After the first
request, it will start processing the commands it received by following configuration settings:

Page 9

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Figure 8: Sample of Configuration Settings, captured via Alien Labs threat analysis.

Page 10

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

A complete list of available capabilities with added context:
1. Collect system information, and save it to file to be later upload to the C2 server.

Figure 9: System information collected, captured via Alien Labs threat analysis.

Page 11

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Figure 10: System information collected, captured via Alien Labs threat analysis.

Page 12

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

2. Collect drive information and directory files based on configuration. The malware can list files basedon extension.

Figure 11: Drive and File Information, captured via Alien Labs threat analysis.

Page 13

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

3. Collect files and save to a temporary file to later deliver to the C2 server.

Figure 12: File Theft capability, captured via Alien Labs threat analysis.

Page 14

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

4. Update malware configuration with one received from the C2 server.

Figure 13: C2 Configuration Default Check, captured via Alien Labs threat analysis.

The malware will collect information from the system, and save it as a JSON file on disk, and later will send it
to the C2 server.

Figure 14: Json collected information file, captured via Alien Labs threat analysis.

Page 15

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

The second callback function, is mainly responsible to upload files to the server, collected by the malware
based on C2 configuration and request:

Figure 15: Upload Files Function, captured via Alien Labs threat analysis.

To send data to the server, the malware makes an HTTP POST request, as shown below:

Figure 16: HTTP Post Request Configuration, captured via Alien Labs threat analysis.

Page 16

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

SideWinder Relations and Shared Resources
There are various links to other adversary groups observed during the investigation of SideWinder. AT&T
Alien Labs assesses with moderate confidence there is a close relationship between the reported Indiainterest APT known as PatchWork and SideWinder. This relationship can be identified by an overlap in actor
built C2 infrastructure. The October 2019 Android activity also presents an interesting anomaly for
SideWinder introducing potential links to PatchWork attack techniques and infrastructure.
Additionally, SideWinder was observed using a shared weaponizer toolkit. This shared toolkit has been
primarily referred to as the “Royal Road” or “8.t” Weaponizer. As noted in past reporting, many intriguing
links can be made to the various APT groups' use of it, such as Goblin Panda, APT40, and ICEFOG (Chinese
actors) and then later with SideWinder (potentially India). Such a shared exploit and weaponizer toolkit
provides a limited insight into the supply chain used between many APTs. From an analyst opinion, this may
mean the supply chain could be a central, for-profit organization, or there are potentially deliberate sharing
efforts between various state-sponsored organizations. Royal Road samples include:892859ea9d86fc441b24222148db52eb33cd106c2ac68eafbe83ab0064215488
22062b6bcda194e3734285fed6b2de341c694c52a8f60c9f389f880cefab7644
9001056791a03ec998f26805d462bc2ca336b2c3aeac2e210f73ff841dfe3eec

Lastly, the July 12, 2020, findings from the Shadow Chaser Group introduced a potential additional clue oflinks to a shared supply chain with the DarkHotel adversary group. Specifically, the unique variabledeclarations and specific parameters used in CVE-2020-0674 exploits are similar.

Conclusion
After extensive investigation on the adversary group known as SideWinder, AT&T Alien Labs continues toobserve the group remaining highly active. SideWinder is targeting government and businesses in Asia withuse of phishing campaigns built for their specific targets. Through our investigation, we have uncovered acollection of activity targeting government and business spanning many years. Alien Labs assesses with low
to medium confidence, the group is in support of India political interests based on targets, campaign
timelines, technical characteristics of C2 infrastructure and malware, association with known India based
APTs, in addition to past industry reporting and private telemetry.
We express gratitude to the many organizations and researchers for their public sharing of SideWinder
activity and recommend readers to make use of our Past Reporting Timeline in their own analysis andconclusions.

Page 17

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Appendix A. Mapped to ATT&CK Framework
•

•

•
•

•

•
•
•

Page 18TA0043: Reconnaissanceo T1589: Gather Victim Identity Information§ T1589.002: Email Addresses§ T1589.003: Employee Nameso T1591: Gather Victim Org Information§ T1591.002: Business Relationships§ T1591.001: Determine Physical Locations§ T1591.003: Identify Business Tempo§ T1591.004: Identify Roles
TA0042: Resource Developmento T1583: Acquire Infrastructure§ T1583.001: Domains§ T1583.004: Server
TA0001: Initial Accesso T1566.001: Spearphishing Attachmento T1566.002: Spearphishing Link
TA0002: Execution
o T1059: Command and Scripting Interpreter§ T1059.007: JavaScript/Jscript§ T1059.001: PowerShell§ T1059.005: Visual Basico T1203: Exploitation for Client Execution
o T1204: User Execution§ T1204.002: Malicious File
§ T1204.001: Malicious Link
TA0003: Persistenceo T1574: Hijack Execution Flow
§ T1574.002: DLL Side-Loadingo T1078: Valid Accounts
TA0004: Privilege Escalationo T1574: Hijack Execution Flow
§ T1574.002: DLL Side-Loading
TA0005: Defense Evasiono T1574: Hijack Execution Flow
§ T1574.002: DLL Side-Loading
TA0007: Discovery
o T1087: Account Discovery§ T1087.001: Local Accounto T1083: File and Directory Discovery
o T1120: Peripheral Device Discovery
o T1069: Permission Groups Discovery
o T1057: Process Discovery

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020•••

Page 19

o T1518: Software Discovery
o T1082: System Information Discovery
o T1007: System Service Discovery
o T1124: System Time Discovery
TA0009: Collectiono T1119: Automated Collectiono T1602: Data from Configuration Repository§ T1602.002: Network Device Configuration Dumpo T1005: Data from Local Systemo T1039: Data from Network Shared Driveo T1025: Data from Removable Mediao T1074: Data Staged§ T1074.001: Local Data Staging
TA0011: Command and Control
o T1071: Application Layer Protocol
TA0010: Exfiltrationo T1020: Automated Exfiltrationo T1041: Exfiltration Over C2 Channel

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Appendix B. Detection Methods
The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or
deploy detections in their own environments or for aiding additional research.
SURICATA IDS SIGNATURES
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"AV TROJAN APT SideWinder
Malicious JS/Shellcode Inbound"; flow:established,to_client; content:"200";
http_stat_code; file_data; content:"<script language=|22|javascript|22|>";startswith; content:".indexOf(str.charAt(i++)) << 18"; distance:0; within:300;
content:">> 16 & 255)"; distance:0; content:">> 8 & 255)"; distance:0;
http_content_type; content:"application/hta"; classtype:trojan-activity;reference:md5,3f03cea9aafdee3e1f741d7585578d1c; sid:4002009; rev:1;)

YARA RULES
rule SideWinderRTF {meta:author = "AT&T Alien Labs"
description = "Detects SideWinder RTF Files"
reference = "https://otx.alienvault.com/pulse/5f21d5b84d529ed134127a66"
strings:$s1 ={4231304346313330354139373337464545333630353636383742443139424436333144393535453639
44463146453045314235373143434143463342373741433630434538314341463630303332354234443
131384336363441313543344637454637}$s2 ={303036313030303130353030303030303030303030307D7B5C726573756C7420207D7D7B5C6F626A65
63745C6F626A}$s3 ={4433433043373132394239423235374642394243414238363836463646394338454139424436453835
45333338463235313331433734344334423039414133464430434131444633433038413043463738393
0364537304531334543353846303933}
condition:
uint16(0) == 0x5c7b and all of them}rule SideWinder_loader_dll{
meta:
author = "AT&T Alien Labs"
description = "Detects SideWinder first dll loader"hash = "113c1c5e176cebe42e452e7ec6ded434c8f620372cef7ae7bfdc6b9469c1b3a4"
reference = "https://otx.alienvault.com/pulse/5f21d5b84d529ed134127a66"
strings:$code = {06 0A 06 8E 69 1F 20 59 8D (0E | 10) 00 00 01 0B 12 00 1F 20 12 01
07 8E 69 28 04 00 00 06 16 0C 2B 16 07 08 8F (0E | 10) 00 00 01 25 47 06 08 1F 20
5D 91 61 D2 52 08 17 58 0C 08 07 8E 69 32 E4 07 28 03 00 00 06 80 01 00 00 04 2A}//$tmp = {2E 00 74 00 6D 00 70 00 20 00 20 00 20 00 20 00 20 00}$tmp = ".tmp" widecondition:
uint16(0) == 0x5A4D and all of them}

Page 20

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

rule SideWinder_implant{meta:author = "AT&T Alien Labs"
description = "Detects SideWinder final payload"hash = "c568238dcf1e30d55a398579a4704ddb8196b685"
reference = "https://otx.alienvault.com/pulse/5f21d5b84d529ed134127a66"
strings:$code = {1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00 00 06 7D 12 00 00
04 02 02 FE 06 23 00 00 06 73 5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 13
00 00 04 02 02 FE 06 24 00 00 06 73 5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
7D 15 00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D 02 28 1F 00 00 06 02 7B 12 00
00 04 16 6F 0F 00 00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 1200 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06 02 28 21 00 00 06
02 7B 12 00 00 04 16}$strings = {2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00 63 00 00 1B 73
00 65 00 6C 00 65 00 63 00 74 00 65 00 64 00 46 00 69 00 6C 00 65 00 73}
condition:
uint16(0) == 0x5A4D and all of them}

Page 21

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Appendix C. Associated Indicators (IOCs)
The associated IOCs are provided in the table below and are also available on OTX™:
https://otx.alienvault.com/pulse/5f21d5b84d529ed134127a66

Type

Indicator

Note

TTP

Possible Target

Domainntc-pk[.]net

FileHash-SHA256

899b12d4e4391773a42a627e6bb800bb274469de83781614
1171322bbdfab7de

LNK

FileHash-SHA256

01405597bf04496592b93a24a08fb9ed08159ab18b48c733
b9d448a32e9e051a

DLL

domainsrv-cdn[.]com

FileHash-SHA256

152b406ad59b472186bf00c33825ffb0fb63c1324f36aa0f
59df86cad57c667a

Domainfb-dn[.]net

PK GovJanuary 2018

Domaincdn-edge[.]net

PK Gov

April 2018

Domainms-update-server[.]net

PK Gov

April 2018

Hostnamegoogle[.]com[.]d-dns[.]co

PK Gov

April 2018

FileHash-SHA256

08b9b5b7592004b8733544df1029e2fc085d82db1ba488a4
3830df49bbbc73b6

RTF - "Scholarship
Details.doc"

CVE-2017-11882

FileHash-SHA256

892859ea9d86fc441b24222148db52eb33cd106c2ac68eaf
be83ab0064215488

RTF - “2018 BilateralTraining in China.doc” Royal Road v3

CVE-2017-11882

FileHash-SHA256

778A862816F51590E7D7AE26451CABED22A8358BABC3C44E
00B0372BD50C215C

DLL

FileHash-SHA256

6ba990e6b738195296552a419c28f75307168c1cc01e7ba6
94b99782c05de4e7

DLL

FileHash-MD5

fe2d78d90cea90477776a36fd8e57deb

DLL - Private

FileHash-SHA256

94a9c88e878fa42d9bfebe838aab3a858d7c2f8606d534a5
69243ba38ee41f2d

DLL

FileHash-SHA256

22062b6bcda194e3734285fed6b2de341c694c52a8f60c9f
389f880cefab7644

RTF - Uploaded in sept,likely originated in april- Royal Road v3

CVE-2017-11882

FileHash-SHA256

ec558a2175deb1cb6c79a72a2b0b5a89f77b8a12a799f7e4
36dd04ae49b5799e

RTF - "Fund Allocation
Policy.doc"

CVE-2017-11882

FileHash-SHA256

b8cbdb36ccd666adaf2ba3628cc79578d3a05119c71dce1b
b16aa39e56dea3cc

HTA - "final.hta"

FileHash-SHA256

8315956b587032db14ba4e700400dffeaeb4119ef509ecf0
df1bb4e80a496b59

DLL

FileHash-SHA256

13497aab3521abbaa654b51f375114e419b1bb774caa8c67
cf52775095b17423

DLL

Domaincdn-apn[.]net

Page 22PK GovFirst Observed
Activity
November 2017

PK Gov
LNK to Remote Download

November 2017
PK Gov

PK Gov
PK Gov

Script - (HTA)

PK Gov

November 2017
November 2017

November 2017

April 2018

PK Gov
April 2018
PK Gov
April 2018
PK Gov
April 2018
PK Gov

April 2018

PK Gov
April 2018
PK Gov
April 2018
PK Gov
April 2018
PK Gov

April 2018

PK Gov
April 2018
PK Gov
April 2018
PK Gov

April 2018

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

Hostnamenadra[.]gov[.]pk[.]d-dns[.]co

PK Gov

FileHash-SHA256

b8a0ecbc61b2ad5700b8f4b920b6addb37e1d3b953915a7c
7754b9718b6cff12

Domainap-cdn[.]net

FileHash-SHA256

9001056791a03ec998f26805d462bc2ca336b2c3aeac2e21
0f73ff841dfe3eec

Domainwebserv-redir[.]net

FileHash-SHA256

35392341c9b2e731357b97c32c91310a63524345f4c3191f
a04f83536fefde6c

Script - (HTA)

FileHash-SHA256

98e21e6c4ba25a26bc9967f20804864629e25ac3280d0fad
259e19fa43517b20

Script - (HTA)

FileHash-SHA256

8c16ebad57e0288077ae58607b2967bf7b40761b20d78381
4d655280e9779e99

PE

FileHash-SHA256

828c1bae13f1c91f0b448cc4b38c9ebe4ba5f7dd35ed2df6
5de2fec65edc25c6

DLL

domaincdn-src[.]net

FileHash-SHA256

805263da772476ffac0486d10c1774dff7cbacbcf68e26e2
b62d6c7534b10de8

DLL

FileHash-SHA256

1ca25ffc4b20c3773777c5faea3e1505d55ff4fc601fa288
35ae7bd7ba621256

RTF - "pmo.doc"

Domain

RTF - "CALS Renewal
procedure.doc"

CVE-2017-11882

PK Gov

PK Gov
RTF - "main.rtf" - RoyalRoad v3

CVE-2017-11882

Unknown

Unknown
Unknown

Unknown

May 2018

May 2018
May 2018

October 2018
October 2018

October 2018

October 2018

Unknown
October 2018
Unknown
October 2018
PK Gov

October 2018

PK Gov

October 2018

PK Higher Education

November 2018

cdn-load[.]net

PK Higher Education

November 2018

domains3-cdn[.]net

PK Gov

December 2018

FileHash-SHA256

7ef5250d5576abc7247e70e1478ce6580c9387107dee67c1
c92bb9c40c2b5fc3

Script - (HTA)

PK Gov

December 2018

domaincdn-dir[.]net

Related to Oct cdn-load.net
activity

PK Higher Education

January 2019

FileHash-SHA256

04385479e70d851e39822b8ce729a3402966c84ec03807a7
2a585d58d029a34a

DLL

PK Higher Education

January 2019

FileHash-SHA256

0030c333e91a803befacf80c27b04fbc7ae8218aa02056df
599115cfaa732dc0

Script - (HTA)

PK Higher Education

January 2019

FileHash-SHA256

b3db16261a427468c87ecb61a1b063cf2d16238e02e43e34
8cf7dfd885920c17

Script - (HTA)

PK Higher Education

January 2019

FileHash-SHA256

dfb2b510b4013d749247b10f36560784bde8c6dba15d3729
8ae804f886f32a58

DLL

PK GovJanuary 2019

domaincdn-list[.]net

Unknown

January 2019

FileHash-SHA256

bee62fab37071a8c0e58d7b360fd1a286db6951aeb3e200d
93195a881b01b2fb

Script - (HTA)

FileHash-SHA256

a99a821ce7367d5c3a506436d64fdbf4342ff078d17c4868
3658534264886ac8

Script - (HTA)

FileHash-SHA256

4418f829b17c79eea51170434b7343c2632f9c17eebde881
50d162f3cdf4a42e

Script - (HTA)

FileHash-SHA256

1b7cf8af4a008dd69e93033be3df2949f52cd4da7033a316
f9cbe38e441e8aca

DLL

FileHash-SHA256

2105f83123eb999a54f0182c298dc0ba65ff33460c7913e8
1e1e75725f1a6767

DLL

Page 23

CVE-2017-11882

Unknown

January 2019

Unknown
January 2019
Unknown
January 2019
Unknown

Unknown

January 2019

January 2019

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

d17cf7fbdb7adafc94a527bbbc2233cb028ec548c1b488de
724e5fa79685938c

DLL

Unknown

FileHash-SHA256

bfeca94e9f639ca825c617962923d80127a3266f152e4e3942c48ca2ae7fa1b1

DLL

FileHash-SHA256

ca177e929202d46d5926660708139cad320ebf4a12930f3d
f957ac086bd28315

DLL

FileHash-SHA256

c58bd87b7cf530e39e48c3fe86b2c3004311dac1bdc5c117
369cfbcf089ef5cf

DLL

FileHash-SHA256

7b6ec46bc619de754be553970c8989af55d4195a443beac7
3c04bd3a99b0aca7

DLL

FileHash-SHA256

6193a395f8d0702efdc1ee1541bb4e29ef5063bb769f093a
b75e4d8cd5dd7804

DLL

FileHash-SHA256

47e4f48f07e722950ed18f30035a9d83fe33d59bf1e0495c
c14bb1be3efd13d0

DLL

domaincdn-dl[.]cn

Many subdomains - various
campaigns/months

FileHash-SHA256

0ad6474d721b9bd93ca9720fa0e3a03d9278b3ebe46e0821
3c2824db23f8ace9

RTF - "20191001cal.doc"

FileHash-SHA256

70e9ffe2f025ae747d20849e85a64fe0aeb2198c0a8d0deb
e66a66a71a02f141

DLL - links to CN C2 transcan

domaincdn-re[.]net

FileHash-SHA256

4bdfb8ac58caf9df6c6eecff9f366f2f27f948670940514a
86bbda594a3132ca

FileHash-SHA256

January 2019
Unknown
January 2019
Unknown

Unknown

January 2019

January 2019

Unknown
January 2019
Unknown
January 2019
Unknown

CVE-2017-11882

January 2019

PK Gov / CN others

January 2019

PK GovJanuary 2019

PK Gov
PK GovJanuary 2019

Script - (HTA)

PK GovJanuary 2019

ee3d356f51f98d78cef7603914e768b327c6e65292539259
b6ff8fcad7b4600c

Script - (HTA)

PK GovJanuary 2019

FileHash-SHA256

80daf84616205653219dbac962634a75906d1a15d7e4f050
7a35869a4dc091c0

DLL

PK GovJanuary 2019

FileHash-SHA256

1b7cf8af4a008dd69e93033be3df2949f52cd4da7033a316
f9cbe38e441e8aca

DLL

PK GovJanuary 2019

FileHash-SHA256

0cc10dd6f4b3aa0848ae08b6ec32e2b3e7136e4f5fc7762e
cc4d44c837b6019d

RTF

domaincdn-do[.]net

FileHash-SHA256

0cc10dd6f4b3aa0848ae08b6ec32e2b3e7136e4f5fc7762e
cc4d44c837b6019d

RTF

FileHash-SHA256

c208dc54cdec0339af316dacc108b1b8377661b9a2876f53
d7e42af5864bd917

Script - (HTA)

domaincdn-io[.]net

PK GovFebruary 2019

domaincv1-cdn[.]net

PK GovMarch 2019

domaincdn-bin[.]net

PK GovMarch 2019

FileHash-SHA256

e13c926b2011945a0aa90b4b5e85b17ea16debee64b87006
5d7ad3284bde27e0

RTF - "MoICalender2019.doc"

CVE-2017-11882

PK GovMarch 2019

FileHash-SHA256

d95c92bacaa3b730ebf7712e55a95d7153843d1cbf310928
f56a6bb029c63c59

RTF - "nadra-calendar2019 Copy.doc"

CVE-2017-11882

PK GovMarch 2019

FileHash-SHA256

015dc215ffd87c2cf62f4445bc4ed22a1f8cbd2f1b7b1eda
b319036e2e04b5b8

DLL

PK GovMarch 2019

Page 24

CVE-2017-11882

Unknown

Unknown

CVE-2017-11882

Unknown

Unknown

February 2019
February 2019

February 2019

February 2019

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

1c1e3dc701a305653d098770b0c46929c2a211ec4ec54505
c04a085366dbb4ce

DLL

PK GovMarch 2019

FileHash-SHA256

03ec3575bf40aa594e3ed42b68d7db1f1aab96f2e7650dc0
6bba2c7b608bdd9c

DLL

PK GovMarch 2019

FileHash-SHA256

6c8ecf19945fbc4756cd5b2d32af592a5d9a855e145b0d27
31ea6faa1a9e1ade

Script - (HTA)

PK GovMarch 2019

FileHash-SHA256

b8fa52f0f873cccaac88f9bcd6a6926e66a92f03adbbf21e
c652e4fe4acbe0e8

RTF - "MoICalender2019.doc"

PK GovMarch 2019

domaincdn-port[.]net

PK Gov

April 2019

FileHash-SHA256

5e1ac5f28b37afc3b2a1902ee7c68485b3fcc55d648ff9e5309646a77ff53882

PK Gov

April 2019

domaincdn-in[.]net

PK Gov

April 2019

FileHash-SHA256

be71f2d17037a1a1fbbe8d7f3f4b45c72132a64224e3d3f1
3aa66a2249df9232

Phishing email for April PK
campaign

PK Gov

April 2019

FileHash-SHA256

ac4fd2681c3a9d087ff4cabb44b93753711e81c6574c837c
a33f74fef37f3cf4

Docx - "STANDING OPERATINGPROCEDURES FOR POLICEEMERGENCY THREAT LEVELS AND
COLOR CODES FOR OPERATIONALREADINESS.docx"

CVE-2017-11882

PK Gov

April 2019

FileHash-SHA256

fa0e06f5b0499360f1ed3da1fe6ed565363544f8ed43029a
513064d3a1ad27ba

RTF - "main.rtf"

CVE-2017-11882

PK Gov

April 2019

FileHash-SHA256

39f8cf0d4badfbc69a016b02fb475035b0fa88688234a9c8
3c17265d9f56710a

Script - (HTA)

PK Gov

April 2019

FileHash-SHA256

97865bbb0828efbf2800f068ffb5f3db6240cbf1a8031c5a
c753490bb2bd28ea

DLL

PK Gov

April 2019

FileHash-SHA256

db97a48939eaa50921ffe293084af77b173c2a1b05cd632e
279165fc64cea718

DLL

PK Gov

April 2019

FileHash-SHA256

81df5952c95dc5ac7145f90b75cf9ba5c59445b098eff8c9
9c63262a4285e7d0

DLL

PK Gov

April 2019

FileHash-SHA256

f42aacea2a2fb59fb309e5dd5263cb4aa7c3f215e8f7154b
1d8ae507c7aa77da

DLL

PK Gov

April 2019

FileHash-SHA256

a8ca6d51653866e8cbf5f63df5ac8220f829b5a1ec31e561
496ad1c47cfff244

DLL - Talks to older
domain. Potentially older.

PK Gov

April 2019

domaincv1-cncdn[.]net

PK Gov

May 2019

domainap1-trans[.]net

PK Gov

May 2019

domaindel-pb[.]net

PK Gov

June 2019

FileHash-SHA256

6a7cc6d83b686c4e19a66a8d99847f9645cb1b4f687db49f
6fcdbabb85d043b2

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

59e2b2acf9f2162e7b4eed8a3f9544be207e4773b3bfee3c
cabd73763f2256b7

DLL

PK Gov

June 2019

FileHash-SHA256

7a42ddab754c8bd206c3984e6bdca1cd61f0b2dd4fac4c75
e94276443a6a662b

DLL

PK Gov

June 2019

domaintrans-aws[.]net

PK Gov

June 2019

domaindel-ivery[.]net

PK Gov

June 2019

FileHash-SHA256

b65f2cc9af10ee4d59660875a7bd82d3bb860c8c089f8a7d
79f41394c54e5edb

PK Gov

June 2019

Page 25

CVE-2017-11882

DLL

Script - (HTA)Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

d69d24991a49766702ca73ed08d1aa8f9e293b8fe6cb1d31
6ae6b304365433c4

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

8f749613521e25b6ba59739f798532507633b402a8bbcd21
fe6cf4c95c6e61cc

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

cb79da6635e0e29451e79fdada01a25b0a4d913d71ec9b95
4ae9719fdc00e174

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

224129ba3f9782d92d3fe3deec422348ce8a2d193f8b23a2
47cc8a78fe66aba4

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

92f9b4ebea8f3fcc65ff2e6b53eb9cc56f97dacfc4f36042
8c4e7311b0ace280

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

1becc433abee1fb2c682a51d587d7de24d33e48441ae18c7
2317c29ed53d5e73

DLL

PK Gov

June 2019

FileHash-SHA256

7b810ac05c0579071417d57d15865ba2966e4f9b6aa8f581
938157158d6a8832

DLL

PK Gov

June 2019

FileHash-SHA256

268e74d0f87064dc857b010e4600a50bfb2778955cec4d33
ccc7c8846fedc7dd

DLL

PK Gov

June 2019

FileHash-SHA256

49bc168d6004d4a5b1de753f5fd3a98db31ae8dcb04fa059
2097ec2b938607ce

DLL

PK Gov

June 2019

FileHash-SHA256

9a5f7b67f804552bbc13644e4ad6db06303208ed8ee24859
063979c799be6b16

DLL

PK Gov

June 2019

FileHash-SHA256

5252f8ee39b9d501ef0bd858f47d1089da55b5d155e40a26
8239fc956312d9f4

DLL

PK Gov

June 2019

FileHash-SHA256

3f1ff47ec9a531aef3307efe3b1ad50fa010880ea94188ea
78b17715b46da46a

DLL

PK Gov

June 2019

FileHash-SHA256

c177627eb2018345492e5ae43fbee4480e691fb7a241a49b
26ec7f754e032895

DLL

PK Gov

June 2019

FileHash-SHA256

74caf33e062c32362de9893623868ffdb6b24cc3802f68ce
a643182bec073921

DLL

PK Gov

June 2019

FileHash-SHA256

39ddf6d6de5aae002da4517661b117d9635d879e3d97c1b3
70e67e4b9e1b5499

DLL

PK Gov

June 2019

FileHash-SHA256

cc8a8242cccf110dbf599274fbb7a29f0fb30ef08bfaff03b2718db40a3bd1c3

DLL

PK Gov

June 2019

FileHash-SHA256

9ec10829c371fd6118b263584f55344eafd0c443478f4592
a6880348bd512d4d

DLL

PK Gov

June 2019

FileHash-SHA256

9ff761dae8f2cfc9e00c9aef364100d39ec8e791c74a5759
ecf2ebcc2b6a435b

DLL

PK Gov

June 2019

FileHash-SHA256

713a28d568d4972a41f2c00eb6cecc5b4dbdf04f54150628
55f1d8cabb121861

DLL

PK Gov

June 2019

FileHash-SHA256

91d93c03c9ec2667af44f34a751f8cb692285c954c605001
5d66454733dd7b8c

DLL

PK Gov

June 2019

FileHash-SHA256

b1509b118d553d8d18c683c83eabdbce083a6d4206787d6a278b7eda5658f86b

DLL

PK Gov

June 2019

FileHash-SHA256

72af87036518a5da43f1ebe7d0b98ad5124a5a9cc398365b
516ee49f4e476ee8

DLL

PK Gov

June 2019

domaincdn-fb[.]net

PK Gov & CN Gov

June 2019

domaintrans-info[.]net

PK Gov & CN Gov

June 2019

FileHash-SHA256

a2cf704a4e794cddaedc0ab1e03b0015e7b87792cf914443
e588877fa6308129

PK Gov & CN Gov

June 2019

Page 26

Script - (HTA)Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

200d7df3d44a07daf66f015e0e13d68f4b77e8cdc4e475e62de6e8d0bb47e1ee

Script - (HTA)

PK Gov & CN Gov

June 2019

FileHash-SHA256

7151c15e9f2d897da2393081477e9cadafb28298c20a70c1
2c2fd5c0be8f9ab5

Script - (HTA)

PK Gov & CN Gov

June 2019

FileHash-SHA256

f488402e504a5ad527690c03fab9b93786837f324e882331
5d18dbd325d8436d

Script - (HTA)

PK Gov & CN Gov

June 2019

FileHash-SHA256

51a723fd25b6a85c2d6d6dd8fd8953bfdf5aa3d4a8ef413c
eb7e7f8d43e1a112

Script - (HTA)

PK Gov & CN Gov

June 2019

FileHash-SHA256

174caf63e4ce052665ae5384e620d8a99e9454d5cd5015d5
be28898c0c4ecebd

DLL

PK Gov & CN Gov

June 2019

FileHash-SHA256

041a3c867a4d438be9783d88f99aa837da9d47487fe415c1
02f701c9918e1d7b

DLL

PK Gov & CN Gov

July 2019

FileHash-SHA256

2a8c1b7fa343eb94428fa83da8c813b1c96caa2065de539e
42a3f416bc15f3a4

DLL

PK Gov & CN Gov

June 2019

FileHash-SHA256

312e2f2f71cef6aff8e45134b6912fdb9a04348225ffccfc
e7b9875bb60e6323

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

7b2d13ca2d4d1909b2b63546c9e1b05b65b3cfdb88722e85
0a1d8bb5584a20b1

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

7b80bf96950c3be63e8ef035820e8b61ca73a11a33527f2c
d904d110f4f5ef08

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

8dcf0fcc44b4c0dbfa148a8a736f54055b639b179ee2c800
2c46d3a934acca9c

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

afda067aee6aa9dcf6645710f890905ff936cda4249eaeab
8b7116e53769f827

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

b14abfbf5d149de8703357f959f4b2bd6e99125fd0641c84
0984bdc7f0d0b325

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

e78fa6154d5310aeb540f96906451068b39299e6172edb47
fe74c917074ba000

DLL

PK Gov & CN Gov

June 2020

FileHash-SHA256

f797c9697ac35aba9cc05703aeb3b35142349f9df7f8df00
d36ae21a233d0f03

DLL

PK Gov & CN Gov

June 2020

Domaintrans-can[.]net

Used in CN and PK older
campaign

PK Gov & CN Gov

June 2019

domaintrans-pre[.]net

PK Gov

June 2019

FileHash-SHA256

dfff054adfb3c4f4dbc6ee4222683ff6229c954ed0057c37
3bbb1bc52c79f468

Script - (HTA)

PK Gov

June 2019

FileHash-SHA256

355BDFDF5DF6478B1EDAFA2A37B1DABD3E86831454774132
B1338D536FD636BC

DLL

PK Gov

June 2019

domaindel-aws[.]net

CN Gov

July 2019

FileHash-SHA256

90aa7b90da08137826d216f4d61b6ef9f1d8f85c1e8cc526
965b4b2510e1a82c

RTF - "Fax of Foreign
Affairs Office of Ministryof National Defense"

CN Gov

July 2019

FileHash-SHA256

4743860DA4934BE1390984467FFE02A992EB1F4FCA2A7810
3F61A241D779D78D

Script - (HTA) - "1.a"

CN Gov

July 2019

FileHash-MD5

A94BE8863E607DC7988F34F907309916

CN Gov

July 2019

FileHash-SHA256

E38CEFE03F8FEC19F98CCE50C94A19938E709C1D084642B9
BF4DA850C5F46A96

DLL

CN Gov

July 2019

FileHash-SHA256

9031118D7CC8B40B54828BD9CE7D43D3E5AF438AA24506BD
07F34A5EC92BE83A.tmp

CN Gov

July 2019

Page 27

CVE-2017-11882

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

89899966ef870191df63c231098fe94f180520dc306a4709
7d1e7387bf20b6f2

RTF - "Fax of Foreign
Affairs Office of Ministryof National Defense"

CN Gov

July 2019

FileHash-SHA256

FA32A70113FE2805A7AE1F01A20A4D30B2D7387FADF2EC7A
DAE7A0A16519AEC8DLL

CN Gov

July 2019

FileHash-SHA256

135281948FD68FADA5810E3824B5C6952BB32E547E4A1679
4A05556F087C40BB.tmp

CN Gov

July 2019

FileHash-SHA256

9654121ADBC9904D7596F1E4D6134065980277C73DDA8137
6DE762E6C4F596E5

Script - (HTA) - "1.a"

CN Gov

July 2019

FileHash-SHA256

2309fd453e48241ed2305239750437df1317a256f40b0078
fc1ec64bf1c2cfda

RTF - "Fax of Foreign
Affairs Office of Ministryof National Defense"

CN Gov

July 2020

domaincdn-ps[.]net

PK Gov

July 2019

FileHash-SHA256

a324235c05e4c9351192e6b6ab252b0ca85434fddc8d882f
e44897f0fa6569a4

ZIP "PassportchangeProfession.z
ip"

PK Gov

July 2019

FileHash-SHA256

54f1450decbcec6fa14380c13532e06fb6cf976c5fd07db5
d4810636ba280b35

LNK "PassportchangeProfession.p
df.lnk"PK Gov

July 2019

FileHash-SHA256

863ddef1af72c82beae6456f407a88817c45c754fe86d09f
cb3c558653620858

ZIP

PK Gov

July 2019

FileHash-SHA256

bedbad32669259305b66f2a5b97c2facc6755a0f314fa116
b244e1a877306d80

LNK "PassportchangeProfession.p
df.lnk"PK Gov

July 2019

FileHash-SHA256

f89504b4a7736f2123ac8d4b9ecaf25aa869906b5d618bd2
758ef8ad14c8bbba

Script - (HTA)

PK Gov

July 2019

FileHash-SHA256

b92e86c193dde2f8fad7de2d6be7b2aba5e55f294c386230
7484f12d09102403

DLL

PK Gov

July 2019

FileHash-SHA256

c679b8ac687d2d55a0bb7ef03432d0eff09d4bcab9de5fdc
37d55d5f59e6c1d5

Script - (HTA)

PK Gov

July 2019

FileHash-SHA256

121648be6641269d626d4d2ad79d234c99b121e0e0588909
c05ba870308d9bc9Docx - "SOP CHINESE
SECURITY.docx"

CVE-2017-11882

PK GovAugust 2019

FileHash-SHA256

307665150f275e2346005a97eb621f6fc8f04ef95f9cd2ef
930acb65409c383b

RTF - Poly Technologies
Lure

CVE-2017-11882

CN Def Tech

August 2019

FileHash-SHA256

be823e05b874256b85f58e95f29d26de84fc781a897e202f
7e9084cc5fdceaf2

Script - (HTA) - "1.a"

CN Def Tech

August 2019

FileHash-MD58FD10BD711AB374E8DE9841CF8824758

Private - Script (HTA)

CN Def Tech

August 2019

FileHash-MD5

D4C3963B11E1732E1419ADF5F404E50C

PrivateCN Def Tech

August 2019

FileHash-SHA256

3F129C5B8F73852FAC0295B17932B88278FE8F66B753F94C
2206BC06CDC48088

DLL

CN Def Tech

August 2019

FileHash-SHA256

082EB89174DEE12BB60ADB1F9AECEA0012CAAE87603B47F3
81C043E8E8F2D013.tmp

CN Def Tech

August 2019

domainaws-check[.]net

Unknowndomainap1-cdnfb[.]net

CN

October 2019

FileHash-SHA256

b5a0917413007819da64d986367474cbb48e347521f416c0
fbcc2889f18daef8

CN

October 2019

hostname

xaddr[.]net

CN

October 2019

Page 28DLL

LNK to Remote Download

LNK to Remote Download

September 2019

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

64dabcc575056b7844658fc3b3f227d3bbdca97eb53f0732
ab1633fc34b3f551

RTF - Poly International
Holdings Co.

CVE-2017-11882

CN

October 2019

FileHash-SHA256

8ecd1539031e76cbb7f6cb3f4ef9c583e730f2a1b87fcebe
c9a137da2cde3d25

RTF - Poly International
Holdings Co.

CVE-2017-11882

CN

October 2019

FileHash-SHA256

81f0bf821b910a2620669981c786fd348ed7694a830d84ad
4a6eee4ff3dfa009

RTF - Poly International
Holdings Co.

CVE-2017-11882

CN

October 2019

FileHash-SHA256

8CDE021F7CC7090710F1680C2A0261D6B7A8395355C6DB99
70B36BCD8BBF95B3

DLL

CN

October 2019

FileHash-SHA256

2019A763362F07F6B83A521AF1DAF6D2BE28C670DA594C62
0EF903EBAFBC2540

.tmp

CN

October 2019

FileHash-SHA256

8F98AD9DA0ADC8280A6A03D6A9545958AFC9192AA7D9AF9E
993BB9EB34539C78

Script - (HTA) "1.a"CN

October 2019

FileHash-SHA256

b1417d7ee62878ef75381e4a3a4f388ac08ac4d4bbd9999b
126345691e82b0c2

RTF - Quality manual for
Poly Defense TechCo."zhengce.doc". Likely
September

CN Def Tech

October 2019

FileHash-SHA256

22DAFB2F83DFCA6B4FF04E48BB271D1ABC69EAB6BD8DFD08
CA005E886607CCC7DLL

CN Def Tech

October 2019

FileHash-SHA256

6C1F0712996D5F0CD273E116BD5B87D9AFBE7BBD5F8784F3
60FBF03EF2723C10.tmp

CN Def Tech

October 2019

FileHash-SHA256

C5FEEE527BB90926949C572BFE3FCEB862727A9F5CEE1FC5
80A11558253D624E

Script - (HTA) - "1.a"

CN Def Tech

October 2019

FileHash-SHA256

e7d3fb3c9bb87bca464d99919ee90d23173725ff13bc71a4
7483e14ff2cb3eff

RTF - "wenzhi_tiaoli.doc"
Civilian personnel lure

CN Gov

October 2019

FileHash-SHA256

4f915ab00694b9674febef920371f5a444a1cf650ef807e9
bb19f3191804fcc4

DLL

CN Gov

October 2019

FileHash-SHA256

86585476d013b75ec91d389f3fd4b10758c76928a719153d
c108acf251523b5f.tmp

CN Gov

October 2019

domainap1-port[.]net

PK Gov

October 2019

domainasp-bin[.]net

PK Gov

October 2019

FileHash-SHA256

61669c7e59036ae95a2886cf5a42a89633ff8c53cf75e7cb
89e0be9f6d4030f4

LNK - "Key_Points.doc.lnk"

PK Gov

October 2019

FileHash-SHA256

c2cbd91fde5d05590ad5075dea408fbfbaebd88dd1cdc4a4
da4f36b77e8ae2e4

Script - (HTA)

PK Gov

October 2019

FileHash-SHA256

885f93da6af60e70780117d01663fbf6c3650b40fe16110e
98eb33b46ee53244

Script - (HTA)

PK Gov

October 2019

FileHash-SHA256

270B38A754400B015896CE34BB195DEAF9ABA674A8AFBAD3
0FF934CF7B427465

DLL

PK Gov

October 2019

FileHash-SHA256

fbd8b1bb2b077320f9cee8e6bff632df0d4472e66861dd3e
dc311f545aa2fcc9

Script - (HTA)

PK Gov

October 2019

domainms-ethics[.]net

Android Campaign

Unknown

October 2019

domaindeb-cn[.]net

Android Campaign

Unknown

October 2019

FileHash-SHA256

ff4da194d9d43c5d97d6df0b093e9ce7288b321a85ba76d7
dc140ada9e719241

Camero App - Android APK

Unknown

October 2019

FileHash-SHA256

ec4d6bf06dd3f94f4555d75c6daaf540dee15b18d62cc004
e774e996c703cb34

DEX - Android

Unknown

October 2019

FileHash-SHA256

a60fc4e5328dc75dad238d46a2867ef7207b8c6fb73e8bd0
01b323b16f02ba00

DEX - Android

Page 29

CVE-2017-11882

CVE-2017-11882

LNK to Remote Download

Unknown

October 2019

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

0daefb3d05e4455b590da122255121079e83d48763509b06
88e0079ab5d48886

ELF - Android

CVE-2019-2215

Unknown

FileHash-SHA256

441d98dff3919ed24af7699be658d06ae8dfd6a12e4129a3
85754e6218bc24fa

ELF - Android

CVE-2019-2215

FileHash-SHA256

ac82f7e4831907972465477eebafc5a488c6bb4d460575cd
3889226c390ef8d5

ELF - Android

CVE-2019-2215

FileHash-SHA256

135cb239966835fefbb346165b140f584848c00c4b6a724c
e122de7d999a3251

ELF - Android

CVE-2019-2215

FileHash-SHA256

ee679afb897213a3fd09be43806a7e5263563e86ad255fd500562918205226b8

ELF - Android

CVE-2019-2215

FileHash-SHA256

a265c32ed1ad47370d56cbd287066896d6a0c46c80a0d957
3d2bb915d198ae42

callCamm App - Android APK

domainsop-cn[.]net

PK Gov

November 2019

domainsd1-bin[.]net

PK Gov

November 2019

domainreawk[.]net

PK Gov

November 2019

FileHash-SHA256

f1cdd47f7a2502902d15adf3ac79c0f86348ba09f4a482ab
9108ad98258edb55.Docx - "ADVOCATE.docx" Terrorist Orgs

remote template
injection

PK Gov

November 2019

FileHash-SHA256

f08ccc040c8d8db60f30a6d1026aa6523e97c6cf52b1b30f
083a830a0a65a3a9

RTF - main.file

CVE-2017-11882

PK Gov

November 2019

FileHash-SHA256

054a029b378b8bbf5ea3f814a737e9c3b43e124995d05d7d
ac45a87502bf2f62

Script - (HTA) - "1.a"

PK Gov

November 2019

FileHash-SHA256

920197f502875461186a9d9fbf5a108f7c13677bbdeae129
fbc3f535ace27a6f

DLL

PK Gov

November 2019

FileHash-SHA256

d8aa512b03a5fc451f9b7bc181d842936798d5facf1b20a2
d91d8fdd82aa28b7

DLL

PK Gov

November 2019ms-db[.]net

Unable to link to campaign.
Med. Conf.

Unknowndomainap1-acl[.]net

BGZ China subdomain, Links
to Dropping ElephantUnknowndomaindomaint10s1[.]net

FileHash-SHA256

54efd37bcd2a78db67319dcbf12cda2647f586d72fd68924
72c454e1e3c4ab7f

FileHash-SHA256

87882b884afd4bd6d4da1fb5e3f87d728f128f75fae32a27
20fe899ac7f23f5d

FileHash-SHA256

October 2019
Unknown
October 2019
Unknown

Unknown

October 2019

October 2019

Unknown
October 2019
Unknown
October 2019

November 2019

November 2019
PK Gov

December 2019

CVE-2017-11882

PK Gov

December 2019

RTF - duplicate of above

CVE-2017-11882

PK Gov

December 2019

d5c384ad75e7fea08b79bffef8046bd5711bef02b95b2839
b68a7232907792e0

RTF - duplicate of above

CVE-2017-11882

PK Gov

December 2019

FileHash-SHA256

c733dba9451c632c19aaad8d1de61e905dac88453b0839e8
900777e121de1755

Script - (HTA) - "1.a"

PK Gov

December 2019

FileHash-SHA256

0AF77780564DF43F44C13E1E2781648061E63537CACB3FD8
7FDD0AABFC64D228

DLL

PK Gov

December 2019

FileHash-SHA256

fcfa191e9058178e13042c5c485d87f8ce04f10435c5fb16
89e3d2d9f4bf9b50

DLL

PK Gov

December 2019

FileHash-SHA256

6c55747d24dcde061d889378282cd35703279af1e696fe9c
71e7fb02c167a8f0

DLL

PK Gov

December 2019

FileHash-SHA256

37cfbcc38e3de533c94f78632881a25e5b7663dad67c1b67
14534a7b509ed7ad

DLL

PK Gov

December 2019

Page 30

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

BC4A982F8E964EA2F7AE6B25C23F5A5B600179B02D6AEB38
883009D926F9DB05.tmp

PK Gov

December 2019

hostname

mail-mofagovnp[.]zapto[.]org

Phishing Pages

NP Gov

December 2019

Domaingov-af[.]org

Phishing Pages, Usedthroughout 2020

AF GovJanuary 2020

hostname

mail-nscaf[.]myftp[.]org

Phishing Pages, Usedthroughout 2020

AF GovJanuary 2020

hostname

mail-nepalarmymilnp[.]duckdns[.]org

Phishing Pages, Usedthroughout 2020

NP GovJanuary 2020

FileHash-SHA256

5977e8169436ff69f57bba8e1094dab77545ecd10039d6b7
3b9270ca4850e37f

RTF

PK GovJanuary 2020

domaincloud-apt[.]net

PK GovFebruary 2020

FileHash-SHA256

ba432fb78990a66b0536f6b3ba77e07116b134172dfcd82c
d6d0be7118ca6940

HTA -PK GovFebruary 2020

FileHash-SHA256

ED8E29D049FC9CFDA83F03030CF53D0138DB8AF5535520F4
32948EA0078C7EF0DLL

PK GovFebruary 2020

FileHash-SHA256

51b847eca682cdcfcf5035959fde51d6fc873b2fec30e19f
710f488bf6e91f65

Script - (HTA) - public in
April

PK GovFebruary 2020

FileHash-SHA256

CE83CB1C179BAAF31D96EA8ADC6753470C121853651192EC
78569048E3AE02DD

DLL - public in April

PK GovFebruary 2020

domainap8-micro[.]net

PK GovFebruary 2020

domainr410b[.]net

PK GovFebruary 2020

domainakamai-api[.]net

PK GovFebruary 2020

domain

gov-np[.]org

NP GovFebruary 2020

domainap-ms[.]net

Unknown

March 2020

FileHash-SHA256

0dd9d9638a59b6fbab792b7781962571b653c44ebae3d9b8
351937ec71f0af8b

RTF -FileHash-SHA256

20CE0C334633392AC54D7A5A1E8D358A1D3BBCDC20972173
A4B8EFE537A74E33

Script - (HTA) - "1.a"FileHash-SHA256

65A3F6D8E7DDA60823A6DB928BF50F20E322A7527447E92A
3CE0FBAF84D24291

DLL -

FileHash-SHA256

CC2C5CC4AD46C5CE3C733B0DF9235B1ADAB034E921E46C18
3501E735F5E6B6AE

DLL -FileHash-SHA256

5BC8A674FF835A6FDC43EDB90F68C6687F88E84009ADEB50
8794A7552DC5AE28.tmp

FileHash-SHA256

DF7704491BC98BF8AA6A865C2AAE2397CE3EC97CB5373DE8
C8487D13DA32A97B.tmp

FileHash-SHA256

57c3c238dcf6662b0b6383007017e7708540c46adac835c8
fbc9edbd417d9911

RTF - Duplicate of above

domainnrots[.]net

FileHash-SHA256

940921853FF39AB91B47F22E3FA629F3A830D674D9DD4CD2
892B5E780B4428B4

FileHash-SHA256

32FE6F67CDCA70420F91642D58E689C3D431117F385EFE32
1992F1CDB812EB81

Page 31

CVE-2017-11882

Phishing Page

Unknown
CVE-2017-11882

March 2020
Unknown

Unknown

March 2020

March 2020

Unknown
March 2020
Unknown
March 2020
Unknown

March 2020

Unknown
CVE-2017-11882

March 2020
PK GovMarch 2020

ZIP - "AD Test.zip"

PK GovMarch 2020

PDF "Additional_CSD_Rebate.pdf"

PK GovMarch 2020

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

f8b053e32eed9a5e814c89eec50e743a906f1aadc7a6f58e
25f0410863c5ec4a

LNK "Additional_CSD_Rebate.pdf.
lnk"

FileHash-SHA256

4725F5C38D0872013C3BA18911B6609BDFD33C3BD3AF0ACE
D120FD51DC098F2F

DLL

domaincdn-top[.]net

FileHash-SHA256

5e32cb3183264c30aad73a7af4524d178c289f9095c20dfb
f98b998adbb50deb

LNK - "tax.doc.lnk"

FileHash-SHA256

90d577264060a9d4ee5ba38bd071271cac6bb5840d4b8b9f
4c22dc67026c797f

FileHash-SHA256

PK GovMarch 2020

PK GovMarch 2020

PK GovMarch 2019

PK GovMarch 2019DLL

PK GovMarch 2019

3e183ee3acca18ba6b59fee72941b25e589478983d66670c
349540ab9d9259f3

Script - (HTA)

PK GovMarch 2019

hostname

mail-nepalgovnp[.]duckdns[.]org

Phishing Page

NP GovMarch 2020

hostname

mail-nepalpolicegov[.]hopto[.]org

Phishing Page

NP GovMarch 2020

hostname

mail-nrborg[.]hopto[.]org

Phishing Page

NP Financial

April 2020

domaincdn-aws[.]net

PK Gov

April 2019

FileHash-SHA256

6fda3ad56d1e341c8e7883d3e9f21181a141e7bf3d8b7323
d84954b0191a94d4

PK Gov

April 2019

domaind01fa[.]net

PK Gov

April 2020

FileHash-SHA256

9b0b837e2c4c06c0754824282b9f39dab7ab5681ff118ca6
a6f6e548df13dfd2

LNK "Pak_Army_Deployed_in_Count
ry_in_Fight_Against_Coronav
irus.pdf.lnk"

LNK to Remote Download

PK Gov

April 2020

FileHash-SHA256

9266f9cf97bafda3a1695335b2ae703a251a548fa4dbf21a
2d9d8b1412606c88

LNK "Pak_Army_Deployed_in_Count
ry_in_Fight_Against_Coronav
irus.pdf.lnk"

LNK to Remote Download

PK Gov

April 2020

FileHash-SHA256

d302e75752341090fcc9a04bdf8ae8300cc4746b2c4abf75
39daafaae275c1f0

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

eafcf556108c01ca395baecb1f016e1ead9f7bc5dc7e1763
26cf4f89b7400441

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

3d5f133790f807270f6a64743cb593673f820bca4aba406e
e08fda1429a340bd

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

a422e6df03c5d22bb2e48922f9e9400fc144f9dced2004f5
08255f02145c5c1cScript - (HTA)

PK Gov

April 2020

FileHash-SHA256

32E14747E18BD76B7203AE80751648F4DB60002001E7DB08
934C2E0DAE631099

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

6D47DFCB56CA03B661C75B3D56FF6AFF58991243C4237051
B27750283445702F

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

62045020CE232BC849EB29749E336E33617973E363A7F5F0
9BA9D6C6160EF83C

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

A0236E9D27AE575C6103287BF67C21E51CDB2600F16EA5A1
1564757789CF1D84

Script - (HTA)

PK Gov

April 2020

FileHash-SHA256

7664CF0F82DF374C168D919505C92736319D0E32685BF36E
FBD957D082B6F65D

Script - (HTA)

PK Gov

April 2020

domainfdn-en[.]net

PK Gov

April 2020

FileHash-SHA256

f961cfaf1173250c87e43392bc73c96cfda20483a180d52e
4c3a5742daa26922

PK Gov

April 2020

Page 32

LNK - "jobinstructions.pdf.lnk"

LNK - "darazcoupon.pdf.lnk"

LNK to Remote Download

LNK to Remote Download

LNK to Remote Download

LNK to Remote Download

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

e34158b6fd7c46d71c8a58993ba84cd884c4c6f68cab1c84
4bbad7fb2e0e2378

RTF

FileHash-SHA256

95EA32A6D9FEC22A8A4F860DB4A7B4C82977C1587D4BE4CF
6591C90DAFCA6ECA

Script - (HTA) "1.a"FileHash-SHA256

F44FD723398E148F7D437D22A417FD5B4C4F835A7B5A7C16
24706E942320AFA4DLL

FileHash-SHA256

8E26E4DF11C210E5A732A7FED503D07474E6558F655D8548
769E1DE1C577AC6C.tmp

domainlink-cdnl[.]net

FileHash-SHA256

e0aae3c1a0d247bd2f582c4edf2e89310c4f1b247947d960
621fc956bce7d8ad

RTF

CVE-2017-11882

FileHash-SHA256

8057829bd5f8fb2f40741c2fc32c46ad33ac21d144fef8af
db3ec8b743beb2a8

RTF

CVE-2017-11882

domainv1ew0[.]net

Unknown

April 2020

domainby0ts[.]net

Unknown

April 2020

domainpqn-rog[.]net

Unknown

April 2020

domainl1st0[.]net

Unknown

April 2020

domainms10t[.]net

Unknown

April 2020

domainclp10s[.]net

Unknown

April 2020

domainjt01[.]net

Unknown

April 2020

domaincont-del[.]net

Unknown

May 2019

domainkat0x[.]net

PK Gov / PK Higher Edu

May 2020

domainkm01s[.]net

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

e713b77892c3c4e3b2ba006edf5f17904096369e2de17ed7
31cd7b7f72ef739f

ZIP - "Policy Guidelines
for Online Classes.zip"

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

f7433b0391cb364581243faed48fbb0ee4ab0e76f069d907
92e31a5d6a744ea7

LNK - "Policy Guidelines
for Online Classes.pdf.lnk"

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

07e7ededc3107d2168c008eb461fc2825001fe15d6a7b92e
1518f4ce44a74915

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

E2D86999B3C3C84EE0EB6A6FA88CE51308C07DA0BDA2D101
19D9559F97CFBE4A

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

DF9509CC30E21FCF7E1DDAF3D110DC89D839F240084B2892
539B681AAB0E4743

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

a4793f14a72dcf53841833b3e1930cefb6f5a2affb899048
0b335842ee4b3d02

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

da8e174a4301c5da1591ebea023acec485062edccbf2dfba
e0956e2dc71d9b8c

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

92092b51db56cddfb13885642d12c36fa6d18d58caf8feb5
f5b33ce3c6b2f961

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

7a437ea5aaf336a69b78395bc8896e544280c2f1254a0076
438c88639c39ff9b

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

0cfa75e51af786066cf757f5e1cee5d190474be9b599787ce8bba7ef619a4fb8

Script - (HTA)

PK Gov / PK Higher Edu

May 2020

Page 33

Unknown
CVE-2017-11882

April 2020
Unknown
April 2020
Unknown

Unknown

Unknown
Unknown

April 2020

April 2020
April 2020

April 2020

Unknown

LNK to Remote Download

April 2020

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

0015F46CB701A771F613A7EF276DC6DA642970206D8900BE
D01AC929EC6FE9E1DLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

AB538AC5C823763E629F66049B7D1C8013D84A069929D18E
078EB3920172419DDLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

D7A10883419689A18340351884B6E5BCF527D0D278EF2811
5F41AAE37DF56F0E

DLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

2EC144303C0AE0A044787204C23DD9C8046F4E2CE692AC71
0942ED0D90A68CADDLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

252B2AC19CC1F9A371E131121C505ABBC21B5CF43A1EF21A
9B8F853DC0DDC390

DLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

BB1B69EFBBD711E422C5A8167888C72A0F76C7DAF63414E7
734B6AA648D0A44F

DLL

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

78E9C2BF6CDBF8C5456B7684A6184EEFB449DEF18EAA40DF
B4E8CD4B2DA75905.tmp

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

DC877602FE1DEF575C439D175C686DA9BC0AFBAE53E01C23
AD1C4D19E8911E72.tmp

PK Gov / PK Higher Edu

May 2020

FileHash-SHA256

65C42FEF3DF4A2B4974E9A1C907FA79B6C2CD96406C309B0
963F358FC4A7C23A

PDF - "Policy Guidelines
for Online Classes.pdf"

PK Gov / PK Higher Edu

May 2020

domainz3st[.]net

UnknwonMay 2020

domaints10l[.]net

UnknwonMay 2020

FileHash-SHA256

78ee88609c686fc3b5183b606cd0253320f9904ffce188ae
7426cd55c132b0fc

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

8881e03131ba5c85449a6b904b201201c899dc8477b45aa0
fcc040ae59094534

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

7d23be3b9f63806cf3537866089a7d940956ad33398dd268
ec16f1b4b41da3ba

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

d6c9d0c19ed59c5030966a08042f7a9843c0698842e031c0
bc1cb1feb24df0f4

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

ab54ff950ba0633e3b6fbc9dae8e7e886ab6bc2044d0b39a
f8dc2f216e12e391

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

dbe41238250010db2c32364d2e43e106f392a19f1df7c33c
41279bb12946442e

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

535ddd938e593d6e0a7c20b1de47b2e9290330f8cd8234f7
f388ec11f4f9e069

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

72f98a8e5376e334831b7d50aca2d9bb88b3f1e8fb7149b5
3139b89813fafdde

Script - (HTA)

UnknwonMay 2020

FileHash-SHA256

23c345c13f1efed1f1bdc2632e556af088d5c2226ad054a5
8b13b84d12c0e41c

Script - (HTA)

UnknwonMay 2020

domainr0dps[.]net

UnknwonJune 2020

domaink1g0[.]net

UnknwonJune 2020

domainchrom3[.]net

Various - Asia

June 2020

FileHash-SHA256

98af6635138045cae3f29995a587d0c8a7f14446a9d10564
677dd4a41372c3f1

RTF - Bangladesh Indenting
Agents' Association

BD Gov

June 2020

FileHash-SHA256

0D5A3DF529ADD0FF4B0ECAAB060BB1A2614B5B7478AB0CC9
9AF3596696789592

DLL

BD Gov

June 2020

Page 34

CVE-2017-11882

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

FE2CAAD6F83635F293149855D3D7EB5507C966A36DDC7A30
D18172D96121F107

Script - (HTA) - "1.a"FileHash-SHA256

e40a12e6e64fdd06abe843b2e70bfc59c279923cec7bc47f
8c8964b4d7a53b7b

RTF - Nominal Roll for BMAC
Journal 2020.doc"

FileHash-SHA256

2ed2fef9bdae1f9de8303453b978f20cbdb1bcbe3d29191b
4b965daff5181799

LNK - "AFC New
Board.pdf.lnk"

FileHash-SHA256

c39dd5986703192b78f9a85f674976498b3054498002c026
d6965226719185dd

FileHash-SHA256

BD Gov

June 2020

CVE-2017-11882

Various - Asia

June 2020

LNK to Remote Download

AF Gov

June 2020

ZIP - "AFC New Board.zip"

AF Gov

June 2020

623123BC86A5A7A32D7078DED44944C94E1BAF957C87C7B8
81BD4B3FB2A8528A

DLL

AF Gov

June 2020

FileHash-SHA256

BEB0E16F94A0C57B9286B46C52275B67F537212EC8A99EF2
B8E75CF12A20EA3D

DLL

AF Gov

June 2020

FileHash-SHA256

04e0d94b1a24d12d690c41a5142b8652cfb517454b0c52ee
e912179dceb52a9a

Docx

CVE-2017-0199

CN Research University

June 2020

FileHash-SHA256

373849c2c371bdf76b776fee44c7b7463205f9e17ba6d1d61040121092720689

RTF

CVE-2017-0199

CN Research University

June 2020

FileHash-SHA256

ea69aac447b83805c2e3b78e5d0512aacbc12d7edfdf5b6b
df99019473d474f3

RTF

CVE-2017-0199

CN Research University

June 2020

FileHash-SHA256

bbd231b7b6a3ced7c515fc11335cd7a353c0c9cd7f2f8404
50c6d7f861992a5e

Script - (HTA)

CVE-2020-0674

CN Research University

June 2020

FileHash-SHA256

DF8493F35549A5E0B533873B0F63D9CED4141860B06D4C20
EB5C846C53A8B01C

DLL

CN Research University

June 2020

FileHash-SHA256

EA0CB411AB1A5F6ADDD5565515A6425600F879363B6ECAE939207560CFE353AE.tmp

CN Research University

June 2020

FileHash-SHA256

36b653ede8d68fbb9a9343507aa437125e5915655fe12763
dbb109c97bed617b

Script - (HTA)

PK Gov

June 2020

FileHash-SHA256

e5e4cfdce04a98c723fb25f1e66794c61af617e9e68b866c
a4961eeb7520000b

Script - (HTA)

PK Gov

June 2020

hostname

tsinhhua[.]gov-mil[.]cn

PK Gov

June 2020

hostname

www-oimc[.]gov-mil[.]cn

PK Gov

June 2020

domaincdn-gov[.]net

PK Gov

June 2020

hostname

www-geneva-pk[.]gov-mil[.]cn

PK Gov

June 2020

hostnametsinghua[.]gov-mil[.]cn

PK Gov

June 2020

hostnamewww-pak-emb[.]gov-mil[.]cn

PK Gov

June 2020

domainfqn-asw[.]net

PK Gov

June 2020

domaincdn-m1l[.]net

PK Gov

June 2020

domainfqn-cloud[.]net

PK Gov

June 2020

domaintar-gz[.]net

Possible subdomains used incampaigns againt Bank andmultiple gov orgs

PK Gov

July 2020

FileHash-SHA256

813fa309502d719dced7b54162db4222025147e071bff641
6886587634e36510

LNK - "Hajj Policy and Plan
2020.pdf.lnk"

LNK to Remote Download

PK Gov

July 2020

FileHash-SHA256

53a4299b79bde7504d2b354c1d6c28660338ea7778723a9d
6ed1260c20b8dd5d

LNK - "Hajj Policy and Plan
2020.pdf.lnk"

LNK to Remote Download

PK Gov

July 2020

Page 35

Medium ConfidenceTom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

508c93c385ec5e2dcae48857acc36ba47443f8d40b2bc34b
cc12f857c7a200d3

Docx

PK Gov

July 2020

FileHash-SHA256

9fe8a99dff1b7264d17a022a08b675f9d0ea8c1377f75c30
a9bc275dcfcc4b43

Script - (HTA)

PK Gov

July 2020

FileHash-SHA256

113b4475ba47ca9ae724a41d1e03d8243aeba6ee4bd2975e
fca3cfea7ab9d12d

Script - (HTA)

PK Gov

July 2020

FileHash-SHA256

848ac4957702cde3ba91394e4f8deb221d67459f4502cc33
c6d96a799ff7bad7

Script - (HTA) - "1.a"

PK Gov

July 2020

FileHash-SHA256

E9A1A5395E6A542535A7A518E6D93B8AB854FEBF03EF3F03
E582E3979A09495D

DLL

PK Gov

July 2020

FileHash-SHA256

F80EEC1D986F34420AB0FB9C29AAE02A8442E79CB3B0C730
EDE7271337F55A15DLL

PK Gov

July 2020

hostnameeedow[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamepolyinc[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamepolync[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamepoliync[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamemofa[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamewww-mofa[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnamepk[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

FileHash-SHA256

28f08c790dcaef7216b52cebef37e436319c3e1a25ed2762
bdd14b8b41befd80

Script - (HTA)

CN Gov / CN Others

July 2020

FileHash-SHA256

58ece87d7521234153f84db973b2587ec6e999a8c2a56e8c
3ef88261415b03e8

Script - (HTA)

CN Gov / CN Others

July 2020

FileHash-SHA256

7987da89a461555c31a4c00990a6f776d14356eee6e52c5b
f26bbb1a1cd638ed

Script - (HTA)

CN Gov / CN Others

July 2020

FileHash-SHA256

56fa1ee04e45849ed69bd25f588cd3671c30006269487806
b380ca9cc451ad1a

Script - (HTA)

CN Gov / CN Others

July 2020

FileHash-SHA256

074e7ae3b52929b2533cb20d9da28a773dde527e17f64d64
6e47323a2acd254f

Script - (HTA)

CN Gov / CN Others

July 2020

FileHash-SHA256

0B3C3D94B5D3C3AFF770A089503034F7357110A2168E6995
214F5E0B708CA3DB

DLL

CN Gov / CN Others

July 2020

FileHash-SHA256

82C30E6D14B42B8492AC9EB4A13951A3D4C8F63929232DC8
1D821C0E513C286F

DLL

CN Gov / CN Others

July 2020

FileHash-SHA256

877D217390AD71763D3E6F062A097F2A8E64E066C6D63AA6
80BB9F6738491967

DLL

CN Gov / CN Others

July 2020

FileHash-SHA256

C0E6785C2319CD79D9C2276E38E51D65E539F548C72F4171
6F30F677098283B6.tmp

CN Gov / CN Others

July 2020

hostnamestinghua[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

hostnameee-dow[.]gov-mil[.]cn

CN Gov / CN Others

July 2020

FileHash-SHA256

012db1429d38232415b021ef951091d0894703724c26f50f
d38785e6c5813ad8

RTF - "BGI 43.doc" - Beltand road + covid

PK Gov

July 2020

FileHash-SHA256

113C1C5E176CEBE42E452E7EC6DED434C8F620372CEF7AE7
BFDC6B9469C1B3A4DLL

PK Gov

July 2020

Page 36

CVE-2017-11882

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

14CCF64395FF367670A34FA42F7703424ED5998E02056B2E
7562BEDBB3DB4535.tmp

PK Gov

July 2020

FileHash-SHA256

BE2820B9DBA31949D688565CB178A8620BAB6255C3227C17
02B865F57715BF71

Script - (HTA) - "1.a"

PK Gov

July 2020

FileHash-SHA256

e2ec505f88125cdb08c329187be5ed35caf81ea3a14267e8
ef2ce29c75d2634c

Script - (HTA)

PK Gov

July 2020

FileHash-SHA256

97d579713192e7ea04f8a698e2b77ed47d39b4a498fa9f43
eda002498ce2f5b7

Script - (HTA)

PK Gov

July 2020

Domainmil-pk[.]net

Medium Confidence,
unconfirmed

PK Gov

July 2020

FileHash-SHA256

6920bfaefa3d4b73390e895d21c796ee161464f84defb15f
4372c0cecc49d0e9Final payload

Unknown

August 2020

Domaingov-mil[.]net

Medium Confidence,
unconfirmed link

PK GovAugust 2020

FileHash-SHA256

1fd742baa9b2ab29e30780d9a92bc3e2db03d1a17f48f956
d74dfe6fb98a7aca

RTF - "Brief.doc" PK/IN
Relations

CVE-2017-11882

PK GovAugust 2020

FileHash-SHA256

63aba37a9291a75256b9f89cb5a999ee6ada020be4917caa
ed39382f7a637b18

RTF "FATFRTMG202010REV1.en.doc"

CVE-2017-11882

PK GovAugust 2020

FileHash-SHA256

a89189f1c7c101c8d9c2637e571c4f8546df3ea557a57609
0cde7b75009981a9

RTF "info_regarding_Police_Offi
cial_Infectedwithcovid.doc"

CVE-2017-11882

PK GovAugust 2020

Domainfilesrvr[.]net

AF GovAugust 2020

Domainasw-edu[.]net

AF GovAugust 2020

FileHash-SHA256

8b30570303dc26bc02fb95a42b4ce91ccf82a02998c67f73
340c50630a0aa5dd

ZIP - "IT Services Request
Form (1).zip"

AF GovAugust 2020

FileHash-SHA256

4aab7127a51af60267d2343dfa58cb50f3fb47ed565e0cfd
188f99d4821b7af2

LNK - "IT Services Request
Form.doc.lnk"

AF GovAugust 2020

FileHash-SHA256

46eae74e90b325bb29fb92810c453a700d705730a0c8e047
38b7d52d68fa00ea

Script - (HTA)

AF GovAugust 2020

FileHash-SHA256

990d79050246cda5427276ab3a5021c8729c0d4b37776d3a
3323d1f114226573

Script - (HTA)

AF GovAugust 2020

FileHash-SHA256

4c7fd224f8bc5442b81f2a19422ec9a18eacf91f131338b0
2a4b7559e86155cd

Script - (HTA)

AF GovAugust 2020

FileHash-SHA256

bf09f665d11fe682895081a9a30b48fe34c68a770037e521
5e350e9508dfc982

DLL

AF GovAugust 2020

FileHash-SHA256

4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee
69429c4c75d4c8b4

DLL

AF GovAugust 2020

FileHash-SHA256

f7eb8fdb6eabb2fb64314c898c621c4aedb8c167c50bd62a
d799fa2c0bc306b6

DLL

AF GovAugust 2020

FileHash-SHA256

8f954f75ff22ae242d8ffd4f4685e078a359851f714f6b04
6b5adee4c8681178

DLL

AF GovAugust 2020

FileHash-SHA256

319bd26ad751a79b1b1c474749d3d856277b712f1eca3b1a
88a8605a8f2facaf

DLL

AF GovAugust 2020

FileHash-SHA256

029743403524b570fd2965dc90f57c6ed367e3afc874eed0
5c2aa6b1551d1091

DLL

AF GovAugust 2020

FileHash-SHA256

18d3a9bc73fec8d5ffa5dc6a6f1d378797ccd947ea173ff2
14e18cfe2ed3c6ce

DLL

AF GovAugust 2020

Page 37

LNK to Remote Download

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

1ace94ebe4841ab01e53accaebc16fc50af7c5017d03f304
71d49df9a4737f2f

DLL - Decrypted Final
payloadUnknown

August 2020

FileHash-SHA256

1a9d8b16ef6132884161bd820fe24cbfc8dc9514c3b31d7e
acf4de707899dd6a

DLL

Unknown

August 2020

FileHash-SHA256

37d6563ca03512fcc904264ce83ce1b741f3e599274dcdf4
5b3d055250793c31

DLL - Decrypted Final
payloadUnknown

August 2020

Hostname

mail-ncporgnp[.]hopto[.]org

Phishing Page

NP GovAugust 2020

Hostname

mail-mofgovnp[.]hopto[.]org

Phishing Page

NP Gov

September 2020

Domaincdn-aws-s2[.]net

PK Gov

September 2020

Domainaws-pk[.]net

PK Gov

September 2020

FileHash-SHA256

21646c896ccc422f64c7ed8888891d2946c4542260c6c02a
f9f99a7f5f6dd342

Audit_Observation2019.zip

PK Gov

September 2020

FileHash-SHA256

0ee926f443c66a0d47365dbb6d21dcea6f6624e730c99f47
cfb492ee2832419e

Protocol.doc - "Poland andPakistan together for
Security"

PK Gov

September 2020

FileHash-SHA256

7af1f15ecd841d82b150c36bd0aa3754878057a809c5bf4f
cc83eeb7bc13477e

DLL - Decrypted Final
payloadPK

September 2020

FileHash-SHA256

948c72bc2380eafd7e9cca9932537772c4e354c30fd26448
cc87f1ee2a134cad

ScriptPK

September 2020

FileHash-SHA256

164c64634bf6fbf3f40711be46778be4ac45a7d83dd3f78b
0a09464db7b329c7

ScriptPK

September 2020

FileHash-SHA256

a952e5c8f2b169381dbe556373e250a4af208d4558d3be0c
4ecebc9df4192459

DLL - Decrypted Final
payloadPK

September 2020

FileHash-SHA256

17b32c13caaae90e373305d5711a98ccd39ecbed0ad64eff
f20832c8772fb955

DLL

PK

September 2020

Hostname

mail-apfgovnp[.]ddns[.]net

Phishing Page

NP Gov

October 2020

Hostname

mail-apfgavnp[.]hopto[.]org

Phishing Page

NP Gov

October 2020

Hostname

mail-nepalpolicegovnp[.]duckdns[.]org

Phishing Page

NP Gov

October 2020

Hostname

mail-ntcnetnp[.]serveftp[.]com

Phishing Page

NP TechNovember 2020

Hostname

mail-kmgcom[.]ddns[.]net

Phishing Page

NP MediaNovember 2020

Hostname

mail-mfagovcn[.]hopto[.]org

Phishing Page

CN Gov

November 2020

Domainms-trace[.]net

CN Gov

November 2020

FileHash-SHA256

34446f7f60f730fcca145155d10d1aff0a1153b085836df3
8313772cd03c8d70

RTF

CVE-2017-11882

CN Gov

November 2020

FileHash-SHA256

7238f4e5edbe0e5a2242d8780fb58c47e7d32bf2c4f860c8
8c511c30675d0857

RTF

CVE-2017-11882

CN Gov

November 2020

FileHash-SHA256

ab7c1967bf1fefdffde93626b78eb30994655ab02f59e0ad
b0935e3e599a953f

RTF

CVE-2017-11882

CN Gov

November 2020

FileHash-SHA256

2548a819e4c597ba5958d2d18baa544452948e5b00271570
192ccd79abe88e8d

Script - (HTA) - "1.a"

CN Gov

November 2020

FileHash-SHA256

ed5e1d6e914de64a203f2f32ab95176fc7efff3a52091597
1d5fe748e79d611c

Script - (HTA) - "1.a"

CN Gov

November 2020

FileHash-SHA256

96bf8f579acb8d9d0ff116d05fdadef85953f11e5b2e7030
41fdae0abf5b75dc

Script - (HTA) - "1.a"

CN Gov

November 2020

Page 38

Tom Hegel, AT&T Alien Labs
Published: January 13th 2021
Intelligence current as of: December 11th 2020

FileHash-SHA256

799260b992c77e2e14f2d586665c570142d8425864455cab
5f2575015cd0b87a

Domaincdn-sop[.]net

FileHash-SHA256

e3be9192477e43ad94b16f4c0a9775adf9019172c0c89712
907a8f9a1680100c

Domaingov-pok[.]net

FileHash-SHA256

280fb291d49f277067667838cdf30a940eaed9ed77124481
58ea29e1ce6af86f

RTF - "MoU's.doc"

FileHash-SHA256

2ab12f79e435abe40ad30076eb4722be724d766c8050dcd9
a90fa9f17e6eff1f

FileHash-SHA256

8d7ad2c603211a67bb7abf2a9fe65aefc993987dc804bf19
bafbefaaca066eaa

Domaincdn-edu[.]net

FileHash-SHA256

1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221
130060b196ece010

FileHash-SHA256

CN Gov

November 2020

PK Gov

November 2020

PK Gov

November 2020

PK Gov

November 2020

PK Gov

November 2020

NDC Participants.docx

PK Gov

November 2020

DLL

PK Gov

November 2020

CN Gov

November 2020

Docx - "NYBZKBREP_reg.form_1113.docx"

CN Gov

November 2020

a377e5f4bf461b86f938959256b7ab8b1b40bb9fd3cd4595
1c736a22366a8dd1

Android application

Unknown

Unknown

FileHash-SHA256

0c182b51ff1dffaa384651e478155632c6e65820322774e4
16be20e6d49bb8f9

Android application

Unknown

Unknown

FileHash-SHA256

061b0379a12b88488db8540226e400e3f65fef9a4c1aa774
4da9f17e1d93d78d

Android application

Unknown

Unknown

FileHash-SHA256

fb6ac9d93fd47db3d32f6da6320344a125e96754a94babb9
d9d12b6604a42536

Metasploit Stager

Unknown

Unknown

FileHash-SHA256

468b74883536938ef3962655dfcc3ca4097ca9b5b687dfc1
fef58d50e96dc248

Metasploit Stager

Unknown

Unknown

Page 39

DLL

RTF

CVE-2017-11882

CVE-2017-11882