y5qa5B
y5qa5B
y5qa5B
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
ASERT Threat Intelligence Report 2016-03: The Four-Element Sword Engagement<br />
MD5 (dropper): 1c4e3c4df094c32faf0c30f6a613c63e <br />
MD5 (payload): 89e4cff1496aafa0776619729a75d4ab <br />
MD5 (payload): f25634becd08d5298db1f3014e477e00 <br />
SHA-‐256 (RTF): ad251fd7427c0334f34aabe100a216b4af48b1ab4a01705f44b3421edd0be6ae <br />
SHA-‐256 (dropper): f6bc895b36446d172c4a99be2587376b48fa3b1b0f6150eb8ab83f649f7b8bc6 <br />
SHA256 (payload): 8dfcae0eb358f48fc30163e58c75823117f6fd501a48f3dfeb19a06d1c21aa51 <br />
SHA256 (payload): f8a18e8b8e6606617e3a63ee5a3050a1b30361703c9a7d9e2d5cc94090c9907b <br />
Targeted Exploitation #5: “Sixteen Drops of Kadam Empowerment”<br />
T9000 Keylogger<br />
This document was submitted on 2015-‐12-‐31 09:27:24 as “Sixteen Drops of Kadam Empowement.doc” (note <br />
the misspelling) from India. This instance of threat activity borrows the theme and content from a page posted <br />
by the Central Tibetan Administration that talks about a spiritual ceremony undertaken by the Dalai Lama [26]. <br />
It is interesting to note that the threat actors wasted no time on this particular exploitation attempt, since the <br />
post was made on December 31 and the spearphish mail was sent on the same day. <br />
22 Proprietary and Confidential Information of Arbor Networks, Inc.
Change language