mrmoor/cyber-threat-intelligence huggingface dataset:
Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system.
Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen™ security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint.   Indicators of Compromise (IoCs)  C&C servers  Ssl[.]arkouthrie[.]com s3[.]hiahornber[.]com widget[.]shoreoa[.]com    SHA256 Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4 Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f            Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Network
MuddyWater is a well-known threat actor group that has been active since 2017.
They target groups across Middle East and Central Asia, primarily using spear phishing emails with malicious attachments.
The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government.
However, we recently observed a few interesting delivery documents similar to the known MuddyWater TTPs.
Our analysis revealed that they drop a new backdoor, which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor.
But, unlike previous incidents using POWERSTATS, the command and control (C&C) communication and data exfiltration in this case is done by using the API of a cloud file hosting provider.
The screenshots below show the malicious attachments, which are disguised to look real, similar to any typical phishing document.
If the targeted victims enable macros, then the malicious process continues.
Fake Office document tries to get user to enable malicious macros.
The blurred document contains logos of different Turkish government entities  Figure 2.
A similar fake Office document has blurred logos for a Turkish government institution related to taxes The macros contain strings encoded in base52, which is rarely used by threat actors other than MuddyWater.
The group is known to use it to encode their PowerShell backdoor.
After enabling macros, a .dll file (with a PowerShell code embedded) and a .reg file are dropped into %temp% directory.
The macro then runs the following command: "C:\Windows\System32\cmd.exe" /k %windir%\System32\reg.exe IMPORT %temp%\B.reg
Running this registry file adds the following command to the Run registry key: rundll32 %Temp%\png.dll,RunPow  Figure 3.
Run registry key We assume that RunPow stands for “run PowerShell,” and triggers the PowerShell code embedded inside the .dll file.
The PowerShell code has several layers of obfuscation.
Encrypted PowerShell code
The other layers are simple obfuscated PowerShell scripts.
But the last layer is the main backdoor body.
This backdoor has some features similar to a previously discovered version of the Muddywater backdoor.
Figure 5. String of system information collected from the victim’s system
The previous MuddyWater version collected similar information but used a different separator:  Figure 6.
When we analyzed further, we saw that the communication methods use files named <md5(hard disk serial number)> with various extensions depending on the purpose of the file.
The figure below is the decoded .res file from Figure 9.
Decoded .res file
The backdoor supports the following commands:  $upload - upload a file to file hosting service $dispos - remove persistence $halt - exit $download - download file from a hosting service No prefix - execute command via Invoke Expression (IEX), a PowerShell command that runs commands or expressions on the local computer  Based on our analysis, we can confirm that the targets were Turkish government organizations related to the finance and energy sectors.
This is yet another similarity with previous MuddyWater campaigns, which were known to have targeted multiple Turkish government entities.
The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents.
It is important that employers and employees across all organizations and enterprises be able to identify phishing attacks and distinguish legitimate emails from malicious ones.
In general, users should always practice caution when it comes to email.
Apart from knowledge and awareness of phishing and social engineering, it is also important to be prepared with effective and layered security solutions.
Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.
Indicators of Compromise  SHA256 Type Detection Name 41ee0ab77b474b0c84a1c25591029533f058e4454d9f83ba30159cc6309c65d1
Delivery documents W2KM_POWRUN.A 43080479eb1b00ba80c34272c5595e6ebdc6b0ffabcdc2c40ea2af49fcc43db4 Dropped DLL file Backdoor.Win32.POWRUN.AA 4f509354d8b3152a40c64ce61f7594d592c1256ad6c0829760b8dbdcb10579a2 Weaponized document BACKDOOR.WIN32.POWRUN.AA 685e91bc4e98c38bda7c8e57d5d40a11e7cf48bb43859bb799813f0146a14fcf Dropped DLL file BKDR_POWRUN.B 888a6f205ac9fc40d4898d8068b56b32f9692cb75f0dd813f96a7bd8426f8652 Dropped DLL file Trojan.W97M.POWRUN.AA 0acd10b14d38a4ac469819dfa9070106e7289ecf7360e248b7f10f868c2f373d Dropped DLL file BKDR_POWRUN.A          Tags  Cloud | Malware | APT & Targeted Attacks | Endpoints | Research
While we have been following cyberespionage group TICK (a.k.a. “BRONZE BUTLER” or “REDBALDKNIGHT”) since 2008, we noticed an unusual increase in malware development and deployments towards November 2018.
Given their targets, we have named this campaign “Operation ENDTRADE,” and identified some of the findings in our research “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.
Operation ENDTRADE’s timeline
These email addresses were used for spear phishing, prompting potential victim organizations to open the attachments with malware payloads.
Spear phishing sample in fluent Japanese
Based on the language that was hardcoded in the samples we found, TICK appeared to be targeting Japanese organizations with subsidiaries in China to serve as footholds for intrusion: TICK hard-coded two code pages 932 and 936, referring to Japanese and Simplified Chinese characters respectively.
Figure 3. Language code pages
New downloaders and trojans DATPER While this backdoor routine has been associated with TICK’s weapons arsenal, the sample we derived from this campaign had two adjusted mutex objects — d0ftyzxcdrfdqwe and *&Hjgfc49gna-2-tjb — that retrieve information from the victim’s machine.
DATPER’s new mutex with separate parameters down_new
This malware combines features of existing trojans in the malware family’s development, based on the adjustments TICK made as we analyzed their test versions.
Gets MAC address and volume information to send back to the C&C. Executes only during working hours (8:00AM-6:00PM, using kernel32.GetLocalTime API)
Uses legitimate websites for the C&C server.
Figure 6. Code showing down_new’s command function  Table 1.
down_new
down_new collects home phone data and URL path Avenger
First stage: Information collection  2.
Third stage: Sending the encrypted file to the C&C
While steganography is always used as part of TICK’s malware techniques, we found that the group used a more sophisticated steganography technique in this campaign.
Figure 11. Backdoor found in the steganography image  Figure 12.
Upgraded steganography technique
Figure 13. Avenger2 with internal URL Casper Casper is a modified version of the Cobalt Strike backdoor, showing the team server SHA1 hash if the controller connects to the C&C.
Casper C&C with Cobalt Strike’s server fingerprint
The backdoor is usually hidden in the steganography photo and uses several techniques and tools to bypass AV detection.
Another involves injecting the backdoor’s shellcode into svchost.exe.
Figure 15. Shellcode injected to svchost.exe
Included in all the malware routines, we also found TICK using publicly available remote access trojans (RATs) and ope n source tools, and either modified or imported the techniques into their malware.
The list of modified tools the group used include Mimikatz, RAR compression tool, port mapping tool, and screen capture.
Figure 16. Modified screen capture tool  Figure 17.
Modified Mimikatz Conclusion TICK is an organized and persistent cyber espionage group specialized in targeting high-value individuals and organizations, with the skills and resources needed to coordinate sophisticated attacks.
It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like TICK’s attacks even without any engine or pattern update.
For the full technical analyses of all the malware, techniques, tools, MITRE ATT&CK techniques and indicators of compromise (IoCs) we found in this campaign, download the research brief, “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.           Tags  Malware | APT & Targeted Attacks | Endpoints | Research |
It provides a more comprehensive look at APT33 and other critical threats.
Read the full paper here.
This blog was originally published on November 13, 2019.
Updated on November 27, 2019 at 11:00 PM PST to add new information about a C&C domain.
The group puts up multiple layers of obfuscation to run these C&C servers in extremely targeted malware campaigns against organizations in the Middle East, the U.S., and Asia.
APT33 has also been executing more aggressive attacks over the past few years.
For example, for at least two years the group used the private website of a high-ranking European politician (a member of her country’s defense committee) to send spear phishing emails to companies that are part of the supply chain of oil products.
Another European oil company suffered from an APT33 related malware infection on one of their servers in India for at least 3 weeks in November and December 2018.
Date From Address Subject 12/31/16 recruitment@alsalam.aero Job Opportunity 4/17/17 recruitment@alsalam.aero Vacancy Announcement 7/17/17 careers@ngaaksa.com Job Openning 9/11/17 jobs@ngaaksa.ga Job Opportunity 11/20/17 jobs@dyn-intl.ga Job Openning 11/28/17 jobs@dyn-intl.ga Job Openning 3/5/18 jobs@mail.dyn-corp.ga Job Openning 7/2/18 careers@sipchem.ga
Job Opportunity SIPCHEM 7/30/18 jobs@sipchem.ga
Latest Vacancy 8/28/18 careers@aramcojobs.ga Latest Vacancy 9/25/18 careers@aramcojobs.ga
AramCo Jobs 10/22/18 jobs@samref.ga
Spear phishing campaigns of APT33.
Source: Trend Micro’s Smart Protection Network
Aside from the relatively noisy attacks of APT33 against oil product supply chains, we found that APT33 has been using several C&C domains for small botnets comprised of about a dozen bots each.
It appears that APT33 took special care to make tracking more difficult.
The APT33 actors then issue commands to the bots and collect data from the bots using these VPN connections.
These aggregators get data from very few C&C servers (only 1 or 2), with only up to a dozen victims per unique C&C domain.
Domain Created oorgans.com 5/28/16 suncocity.com 5/31/16 zandelshop.com 6/1/16
simsoshop.com
6/2/16
zeverco.com 6/5/16 qualitweb.com 6/6/16 service-explorer.com 3/3/17 service-norton.com 3/6/17 service-eset.com 3/6/17 service-essential.com 3/7/17 update-symantec.com 3/12/17
Table 2. APT33 C&C domains for extreme narrow targeting  Figure 1. Schema showing the multiple obfuscation layers that APT33 uses
Setting up a private VPN can be easily done by renting a couple of servers from datacenters around the world and using open source software like OpenVPN.
First seen  Last seen 5.135.120.57 12/4/18 1/24/19 5.135.199.25 3/3/19 3/3/19 31.7.62.48 9/26/18 9/29/18 51.77.11.46 7/1/19 7/2/19 54.36.73.108 7/22/19 10/05/19 54.37.48.172 10/22/19 11/05/19 54.38.124.150 10/28/18 11/17/18 88.150.221.107 9/26/19 11/07/19 91.134.203.59 9/26/18 12/4/18 109.169.89.103 12/2/18 12/14/18 109.200.24.114 11/19/18 12/25/18 137.74.80.220 9/29/18 10/23/18 137.74.157.84 12/18/18 10/21/19 185.122.56.232 9/29/18 11/4/18 185.125.204.57 10/25/18 1/14/19 185.175.138.173 1/19/19 1/22/19 188.165.119.138 10/8/18 11/19/18 193.70.71.112 3/7/19 3/17/19 195.154.41.72 1/13/19 1/20/19 213.32.113.159 6/30/19 9/16/19 216.244.93.137 12/10/18 12/21/18   Table 3.
IP addresses associated with a few private VPN exit nodes connected to APT33
Figure 2. APT33’s usage of a private VPN network APT33 used its private VPN network to access websites of penetration testing companies, webmail, websites on vulnerabilities, and websites related to cryptocurrencies, as well as to read hacker blogs and forums.
Improve employee awareness on the latest attack techniques that cybercriminals use.
As mentioned above, APT33 is known to use spear phishing emails to gain entry into a target’s network, and given their malicious activity the threat is definitively serious.
File name SHA256 Detection Name MsdUpdate.exe e954ff741baebb173ba45fbcfdea7499d00d8cfa2933b69f6cc0970b294f9ffd Trojan.Win32.NYMERIA.MLR MsdUpdate.exe b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e Trojan.Win32.SCAR.AB MsdUpdate.exe a67461a0c14fc1528ad83b9bd874f53b7616cfed99656442fb4d9cdd7d09e449 Trojan.Win32.SCAR.AC MsdUpdate.exe c303454efb21c0bf0df6fb6c2a14e401efeb57c1c574f63cdae74ef74a3b01f2 Trojan.Win32.NYMERIA.MLW MsdUpdate.exe 75e6bafc4fa496b418df0208f12e688b16e7afdb94a7b30e3eca532717beb9ba Trojan.Win32.SCAR.AD MsdUpdate.exe 8fb6cbf6f6b6a897bf0ee1217dbf738bce7a3000507b89ea30049fd670018b46 Trojan.Win32.SCAR.AD DysonPart.exe ba9d76cca6b5c7308961cfe3739dc1328f3dad9a824417fad73b842b043daa1a Trojan.Win32.SCAR.AD Unknown 07e1baf1d0207a139bcf39c60354666496e4331381d36eef9359120b1d8497f1 Trojan.Win32.SCAR.AD
Attacks | Endpoints | Research
They carried this out by first stealing the company’s certificate then using it to sign the malware.
9002 RAT also installed additional malicious tools: an exploit tool for Internet Information Services (IIS) 6 WebDav (exploiting CVE-2017-7269) and an SQL database password dumper.
Operation Red Signature’s attack chain
Here’s how Operation Red Signature works:  The code-signing certificate from the remote support solutions provider is stolen.
It’s possible that the certificate was stolen as early as April 2018, as we found a ShiftDoor malware (4ae4aed210f2b4f75bdb855f6a5c11e625d56de2) on April 8 that was signed with the stolen certificate.
Malicious update files are prepared, signed with the stolen certificate, and uploaded to the attacker’s server (207[.]148[.]94[.]157).
The update server of the company is hacked.
The remote support program recognizes the update files as normal and executes the 9002 RAT malware inside it.
9002 RAT downloads and executes additional malicious files from the attackers’ server.
Technical analysis
9002 RAT is the decrypted rcview.log payload, which connects to the command-and-control (C&C) server at 66[.]42[.]37[.]101.  Figure 2. Contents of the malicious update configuration   Figure 3. How the compromised update process launches the 9002 RAT malware  Figure 4.
Known 9002 RAT string pattern inside the decrypted payload of the rcview.log file Correlating 9002 RAT
Delving into 9002 RAT, we found that it was compiled on July 17, 2018, and that the configuration files inside update.zip were created on July 18.
Our analysis of an update log file we found reveals the remote support program’s update process started around 13:35 on July 18, with the 9002 RAT being downloaded and launched.
Figure 5. Compilation timestamp on 9002 RAT sample (top), timestamp of the malicious configuration (center), and snapshot of the program’s update log (bottom)
Figure 6. Code snippet showing 9002 RAT checking the system time and setting itself to sleep in August 2018 Additional malware tools
The 9002 RAT also serves as a springboard for delivering additional malware.
View active directory objects dsquery.exe DsQuery
Search for active directory objects sharphound.exe SharpHound
Collect active directory information aio.exe
Dump password from SQL database printdat.dll RAT (PlugX variant)
Remote access tool w.exe IIS 6 WebDav Exploit Tool Exploit tool for CVE-2017-7269 (IIS 6) Web.exe WebBrowserPassView Recover password stored by browser smb.exe Scanner
Scans the system’s Windows version and computer name m.exe Custom Mimikatz (including 32bit / 64bit file)
It is a variant of PlugX malware, and connects to the same C&C server (66[.]42[.]37[.]101).  Figure 8.
Internal PlugX date dword value inside the printdat.dll file Mitigating supply chain attacks
Supply chain attacks don’t just affect users and businesses — they exploit the trust between vendors and its clients or customers.
Indicators of Compromise (IoCs): Related hashes (SHA-256):  0703a917aaa0630ae1860fb5fb1f64f3cfb4ea8c57eac71c2b0a407b738c4e19 (ShiftDoor) — detected by Trend Micro as BKDR_SETHC.D c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e (aio.exe)
HKTL_DELOG a3a1b1cf29a8f38d05b4292524c3496cb28f78d995dfb0a9aef7b2f949ac278b
(m.exe)
HKTL_MIMIKATZ 9415ca80c51b2409a88e26a9eb3464db636c2e27f9c61e247d15254e6fbb31eb
(printdat.dll)
— TSPY_KORPLUG.AN 52374f68d1e43f1ca6cd04e5816999ba45c4e42eb0641874be25808c9fe15005 (rcview.log)
— TROJ_SIDELOADR.ENC bcfacc1ad5686aee3a9d8940e46d32af62f8e1cd1631653795778736b67b6d6e
(rcview40u.dll)
— TROJ_SIDELOADR.A 279cf1773903b7a5de63897d55268aa967a87f915a07924c574e42c9ed12de30 (sharphound.exe)
— HKTL_BLOODHOUND e5029808f78ec4a079e889e5823ee298edab34013e50a47c279b6dc4d57b1ffc (ssms.exe) — HKTL_PASSDUMP e530e16d5756cdc2862b4c9411ac3bb3b113bc87344139b4bfa2c35cd816e518 (w.exe)
— TROJ_CVE20177269.MOX 28c5a6aefcc57e2862ea16f5f2ecb1e7df84b68e98e5814533262595b237917d (Web.exe)
— HKTL_BROWSERPASSVIEW.GA  URLs related to the malicious update file:
hxxp://207[.]148[.]94[.]157/update/rcv50/update.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file000.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file001.zip  URLs related to additionally downloaded malicious files:
hxxp://207[.]148[.]94[.]157/aio.exe hxxp://207[.]148[.]94[.]157/smb.exe hxxp://207[.]148[.]94[.]157/m.ex_ hxxp://207[.]148[.]94[.]157/w hxxp://207[.]148[.]94[.]157/Web.ex_
Related C&C server (9002 RAT and PlugX variant):  66[.]42[.]37[.]101          Tags  Network | APT & Targeted Attacks | Research
As of this writing, our telemetry has detected infection attempts in China.
Components of the file and routine appear similar to those of a published entry, while our sample executed .x15cache, the bash script that downloads the malware.  Figure 1. Targeted machine using brute force via SSH The shell script downloads, extracts, and executes the miner payload.
File tree of the extracted TAR file Folder a
contains the cron and anacron binaries, which are the cryptocurrency miners used by the malware.
One of the files, rsync, is an initially obfuscated Perl-based Shellbot capable of multiple backdoor commands such as file downloading, shell cmd execution, and DDoS.  Figure 4. Obfuscated Perl script  Figure 5.
Code snippet of unobfuscated rsync
Another file, ps, is a Linux executable that serves as an SSH backdoor.
SSH backdoor
The file tree initially showed folder c from dota2[.]tar[.]gz file to be empty.
However, looking around the related URLs ps tries to connect to, we found mage[.]ignorelist[.]com containing a compressed file, dota[.]tar[.]gz.
Figure 7. Folder c
The files tsm32 and tsm64 appear to be scanners responsible for propagating the miner and backdoor via SSH brute force, and capable of sending remote commands to download and execute the malware.
Figure 8. tsm32  Figure 9.
Figure 10. .satan file Conclusion
We also noticed the presence of an APK file hosted in one of the servers, suggesting that if the cybercriminals decide to go further than just infecting servers, they may decide to attack Android-based devices.
Trend Micro Solutions Customers of the Trend Micro™ TippingPoint™ solution are protected from this threat via these MainlineDV filters:  2573: MINER - TCP (Request)    Indicators of Compromise (IoCs)  File name SHA256 Detection rsync 0d71a39bbd666b5898c7121be63310e9fbc15ba16ad388011f38676a14e27809 Backdoor.Perl.SHELLBOT.AB ps bb1c41a8b9df7535e66cf5be695e2d14e97096c4ddb2281ede49b5264de2df59 Backdoor.Linux.SSHDOOR.AB cron 4efec3c7b33fd857bf8ef38e767ac203167d842fdecbeee29e30e044f7c6e33d Coinminer.Linux.MALXMR.UWEJN anacron 66b79ebfe61b5baa5ed4effb2f459a865076acf889747dc82058ee24233411e2 tsm32 0191cf8ce2fbee0a69211826852338ff0ede2b5c65ae10a2b05dd34f675e3bae Trojan.Linux.SSHBRUTE.A tsm64 085d864f7f06f8f2eb840b32bdac7a9544153281ea563ef92623f3d0d6810e87   URLs • 146[.]185[.]171[.]227:443   • C&C for Backdoor.Perl.SHELLBOT.AB - 5[.]255[.]86[.]129:3333   • C&C for Backdoor.Linux.SSHDOOR.AB - 54[.]37[.]70[.]249/.satan  • 54[.]37[.]70[.]249/rp  • hxxp://54[.]37[.]70[.]249/.x15cache  • hxxp://54[.]37[.]70[.]249/dota2.tar.gz  • hxxp://54[.]37[.]70[.]249/fiatlux-1.0.0.apk   • APK file hosted on this server - hxxp://mage[.]ignorelist[.]com/dota.tar.gz  • mage[.]ignorelist[.]com  • zergbase[.]mooo[.]com         Tags  Malware | APT & Targeted Attacks | Endpoints | Research
Update on 12/29/2020 2:40 PM PST:
Information on Supernova added Update on 1/22/2021 4:56 PM PST:
Trend Micro's Zero-Day Initiative (ZDI) provided technical analysis of recently patched vulnerabilities in the SolarWinds Orion Platform.
These vulnerabilities, when combined, could allow an unauthenticated attacker to execute arbitrary code as Administrator on an affected system.
Various sources have recently disclosed a sophisticated attack that hit organizations via the supply chain.
This was carried out via a compromised version of a network monitoring application called SolarWinds Orion.
This backdoor provided the attacker with complete access to the targeted organization’s network.
What is Sunburst?
Sunburst is a sophisticated backdoor that provides an attacker nearly complete control over an affected system.
It has several peculiarities in its behavior, however.
This specific set of circumstances makes analysis by researchers more difficult, but it also limits the scope of its victims to some degree.
The commands that can be executed include:  Registry operations (read, write, and delete registry keys/entries) File operations (read, write, and delete files) Run/stop processes Reboot the system    What is Supernova?
Supernova, one of the malicious components associated with the attack, is a .NET web shell backdoor that presents itself as a legitimate SolarWinds web service handler.
It is a second-stage payload in the attack.
It can also execute web shell commands via a specific HTTP request format.
Who is affected?
It is believed that Sunburst was delivered via a trojanized version of the Orion network monitoring application.
This was done as part of the build process; the source code repository was not affected.
According to the SolarWinds SEC filing, this trojanized version was downloaded by under 18,000 customers from March to June of 2020.
The directive treats agencies to treat said machines as compromised, with credentials used by said machines to be changed as well.
Trend Micro Detection 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134  2f1a5a7411d015d01aaee4535835400191645023 Backdoor.
MSIL.SUNBURST.A c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 75af292f34789a1c782ea36c7127bf6106f595e8
Trojan.MSIL.SUPERNOVA.A ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6  d130bd75645c2433f88ac03e73395fba172ef676 Backdoor.
MSIL.SUNBURST.A 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 76640508b1e7759e548771a5359eaed353bf1eec
MSIL.SUNBURST.A
d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600 1b476f58ca366b54f34d714ffce3fd73cc30db1a
Backdoor.MSIL.SUNBURST.A