BlueCoat's report on the "Inception Framework"

Exploited RTF sample md5’s:
0a0f5a4556c2a536ae7b81c14917ec98
19ad782b0c58037b60351780b0f43e43
20c2a4db77aabec46750878499c15354
23d6fabda409d7fc570c2238c5487a90
3ff9c9e3228b630b8a68a05d6c3e396d
4624da84cae0f8b689169e24be8f7410
4a4874fa5217a8523bf4d1954efb26ef
4dcdc1110d87e91cda19801755d0bcf2
516a514bf744efb5e74839ddaf02a540
5e3ecfd7928822f67fbb3cd9c83be841
685d9341228f18b0fd7373b7088e56a7
822d842704596a2cf918863ea2116633
8488303c2a0065d9ac8b5fecf1cb4fc9
8997d23b3d1bd96b596baee810333897
8cd5974a49a9d6c49294312bf09f64ed
9738faf227bcd12bcab577a0fb58744d
bc196dc8a14484e700169e1a78cf879e
b453ec7fd92bee23846ff36bf903ddc0
2fcbea8a344137421a86b046a6840265

Dropped first-stage DLL’s
0bd0fd3cbbcfddc4048228ce08ca26c2
0bda50e05d575446de55d50c631afb53
0f12614fa7a9bf7bcc951eec7b78658d
2f9ca7680ec0945455988d91d9b325f8
352da994d867eb68a178bb7f2fb672bc
3a4a9d26c9c3c8d0fd697b036216319e
43587e5fcf6770259026ec2ca6f41aa6
4628082e11c75b078ff0465523598040
554d4c4da2e3603282b097b0e68ad11a
670ac2e315088d22b2cb92acffc3e997
71bdd14cbc96badb79dfb0f23c52a9ee
72f020b564bc9771e7efe203881f5ef9
80a7883c33a60b4c0178c9c8fb7d1440
84fa976d9ed693668b3f97d991da0e97
89d851cbd2dc1988bb053235414f8928
a5aeda357ba30d87c1187b644baad8a0
c3f2fb7840228924e5af17787e163e07
d007616dd3b2d52c30c0ebb0937e21b4
d171db37ef28f42740644f4028bcf727
d3886495935438f4a130d217d84ae8cb
ea0d80db2075f789fc88c3fdf6e3d93e
f2840be535fbaf8b15470d61967d527b
90c93c9b80bbf31dce8434a565a0ec7b

Downloaded second-stage plugins:
5c3de5b2762f4c5f91affaa6bcadd21b
86b2372297619b1a9d8ad5acdf1a6467
43112e09240caebb3c72855c9f6fc9e5

Downloaded Chinese malware, sccm.exe:
dd8790455109497d49c2fa2442cf16f7

Router proxy malware:
a6b2ce1cc02c902ba6374210faf786a3
83b383884405190683d748f4a95f48d4
62fc46151cfe1e57a8fa00065bde57b0
036fbc5bffd664bc369b467f9874fac4
488e54526aa45a47f7974b4c84c1469a
24a9bbb0d4418d97d9050a3dd085a188
b0c2466feb24519c133ee04748ff293f
62dc87d1d6b99ae2818a34932877c0a4
7c6727b173086df15aa1ca15f1572b3f
80528b1c4485eb1f4a306cff768151c5
e1d51aa28159c25121476ffe5f2fc692

Android malware:
046a3e7c376ba4b6eb21846db9fc02df
b0d1e42d342e56bc0d20627a7ef1f612

IOS malware (WhatsAppUpdate.deb):
4e037e1e945e9ad4772430272512831c

Blackberry malware:
0fb60461d67cd4008e55feceeda0ee71
60dac48e555d139e29edaec41c85e2b4