misp-circl-feed/feeds/circl/misp/5a37c286-b27c-49e7-8c79-ed2e950d210f.json

{"Event": {"info": "OSINT - Rehashed RAT Used in APT Campaign Against Vietnamese Organizations", "Tag": [{"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:rat=\"NewCore\""}, {"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}, {"colour": "#3b0020", "exportable": true, "name": "workflow:todo=\"expansion\""}, {"colour": "#4bec00", "exportable": true, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\""}], "publish_timestamp": "0", "timestamp": "1513605457", "analysis": "2", "Attribute": [{"comment": "", "category": "External analysis", "uuid": "5a37c310-fe98-4e0c-8a85-ed7e950d210f", "timestamp": "1513603886", "to_ids": false, "value": "Recently, FortiGuard Labs came across several malicious documents that exploit the vulnerability CVE-2012-0158. To evade suspicion from the victim, these RTF files drop decoy documents containing politically themed texts about a variety of Vietnamese government-related information. It was believed in a recent report that the hacking campaign where these documents were used was led by the Chinese hacking group 1937CN. The link to the group was found through malicious domains used as command and control servers by the attacker. In this blog, we will delve into the malware used in this campaign and will try to provide more clues as to the instigator of this campaign.", "Tag": [{"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}], "disable_correlation": false, "object_relation": null, "type": "comment"}, {"comment": "", "category": "External analysis", "uuid": "5a37c320-10e0-40fe-b101-41be950d210f", "timestamp": "1513603879", "to_ids": false, "value": "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations", "Tag": [{"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}], "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-e51c-4e94-aa70-4624950d210f", "timestamp": "1513603994", "to_ids": true, "value": "2a4e8ae006be3a5ed2327b6422c4c6f8f274cfa9385c4a540bc617bff6a0f060", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-94b4-4e3c-9920-487e950d210f", "timestamp": "1513603994", "to_ids": true, "value": "3faacef20002f9deb1305c43ea75b8422fd29a1559c0cf01cf1cee6a1b94fc0e", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-0990-4dee-807d-412e950d210f", "timestamp": "1513603994", "to_ids": true, "value": "5bdbf536e12c9150d15ae4af2d825ff2ec432d5147b0c3404c5d24655d9ebe52", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-11b0-4a56-ad0d-4a9b950d210f", "timestamp": "1513603994", "to_ids": true, "value": "14b4d8f787d11c7d72f66231e80997ef6ffa1d868d9d8f964bea36871e1c2ff2", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-2b88-49d7-9d70-4995950d210f", "timestamp": "1513603994", "to_ids": true, "value": "637c156508949c881763c019d2dca7c912da9ec63f01e3d3ba604f31b36e52ab", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-2b98-44e8-b2a8-40de950d210f", "timestamp": "1513603994", "to_ids": true, "value": "5573f6ec22026b0c00945eec177f04212492bb05c33b4b80f73c65ce7fe5119a", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-e7a4-4601-8090-44dd950d210f", "timestamp": "1513603994", "to_ids": true, "value": "00466938836129a634b573d2b57311200ab04aba7252cfbf6b77f435612ca6c6", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-a58c-4d47-a1c7-4ab0950d210f", "timestamp": "1513603994", "to_ids": true, "value": "c375946ba8abee48948f79a89ea5b4f823d8287c2feb3515755b22ba5bd8849d", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-4848-4c04-bedb-42e4950d210f", "timestamp": "1513603994", "to_ids": true, "value": "f6a4bab7d5664d7802f1007daa04ae71e0e2b829cd06faa9b93a465546837eb4", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Lure", "category": "Payload delivery", "uuid": "5a37c39a-b858-4a24-b196-4ec8950d210f", "timestamp": "1513603994", "to_ids": true, "value": "fabf4debacb7950d403a84f4af25c084d0b576783006d334052ebf7ea432196e", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Loader", "category": "Payload delivery", "uuid": "5a37c3ae-68e8-4c93-8990-ed2e950d210f", "timestamp": "1513604014", "to_ids": true, "value": "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Loader", "category": "Payload delivery", "uuid": "5a37c3ae-8fd8-4d9e-b951-ed2e950d210f", "timestamp": "1513604014", "to_ids": true, "value": "ea5b3320c5bbe2331fa3c0bd0adb3ec91f0aed97709e1b869b79f6a604ba002f", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Trojan Downloader", "category": "Payload delivery", "uuid": "5a37c3c2-1348-469b-9f4c-4697950d210f", "timestamp": "1513604034", "to_ids": true, "value": "edbcc384b8ae0a2f52f239e2e599c3d2053f98cc1f4bc91548ec420bec063be6", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Trojan Downloader", "category": "Payload delivery", "uuid": "5a37c3c2-e3dc-46a1-869d-4bf5950d210f", "timestamp": "1513604034", "to_ids": true, "value": "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Trojan Downloader", "category": "Payload delivery", "uuid": "5a37c3c2-9f14-4ffd-8bcc-4955950d210f", "timestamp": "1513604034", "to_ids": true, "value": "df8475669a14a335c46c802f642dd5569c52f915093a680175c30cc9f28aacdb", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "NewCore RAT", "category": "Payload delivery", "uuid": "5a37c3d8-006c-4fd8-b4f9-4ce0950d210f", "timestamp": "1513604056", "to_ids": true, "value": "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "Command and Control Servers", "category": "Network activity", "uuid": "5a37c3ed-1a24-4906-89b8-48eb950d210f", "timestamp": "1513604077", "to_ids": true, "value": "web.thoitietvietnam.org", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "Command and Control Servers", "category": "Network activity", "uuid": "5a37c3ed-05a0-407e-9c80-4ed0950d210f", "timestamp": "1513604077", "to_ids": true, "value": "dalat.dulichovietnam.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "Command and Control Servers", "category": "Network activity", "uuid": "5a37c3ed-eedc-4f84-8374-4da3950d210f", "timestamp": "1513604077", "to_ids": true, "value": "halong.dulichculao.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "signed legitimate GoogleUpdate.exe version 1.3.33.5", "category": "Payload delivery", "uuid": "5a37c838-6cf4-4379-ab05-46c3950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Taskeng.exe", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "encrypted blob containing malware file", "category": "Payload delivery", "uuid": "5a37c838-7e94-443d-ac6c-442c950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Psisrndrx.ebd", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "decrypter and loader of malware file", "category": "Payload delivery", "uuid": "5a37c838-2f18-4d4c-bb82-447a950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Goopdate.dll", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "signed legitimate McAfee AV application", "category": "Payload delivery", "uuid": "5a37c838-99e0-407b-b49f-45b6950d210f", "timestamp": "1513605176", "to_ids": true, "value": "SC&Cfg.exe", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "contains the malware file", "category": "Payload delivery", "uuid": "5a37c838-b1a0-4941-a998-44b7950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Vsodscpl.dll", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "signed legitimate GoogleUpdate.exe version 1.3.30.3", "category": "Payload delivery", "uuid": "5a37c838-ac4c-48db-8a98-49d8950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Systemm.exe", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "encrypted blob containing malware file", "category": "Payload delivery", "uuid": "5a37c838-0394-4a48-878b-4a60950d210f", "timestamp": "1513605176", "to_ids": true, "value": "Systemsfb.ebd", "disable_correlation": false, "object_relation": null, "type": "filename"}], "extends_uuid": "", "published": false, "date": "2017-09-05", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5a37c286-b27c-49e7-8c79-ed2e950d210f"}}