Tracking OceanLotus’ new Downloader, KerrDown
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.
Key facts
- KerrDown, used by OceanLotus since early 2018, is delivered via macro documents or RAR archives with DLL side-loading.
- Malicious documents embed base64-encoded 32-bit and 64-bit DLLs selected by a macro architecture check.
- KerrDown saves as main_background.png, downloads a DES-encrypted payload, and executes it in memory.
- Jaccard-index similarity analysis helped identify the new family and connect related OceanLotus samples.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 User Execution: Malicious FileT1574.002 Hijack Execution Flow: DLL Side-LoadingT1140 Deobfuscate/Decode Files or Information
- Vendors
- Palo Alto NetworksMicrosoft
- Products
- Cobalt Strike
- Threat actors
- OceanLotusAPT32
- Malware
- KerrDown
- Countries
- Vietnam
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | beta.officopedia.com | rvice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]br |
| domain | blogsite.org | 1f5a9b2d59b08500882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]win |
| domain | check.homeip.net | n[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net o |
| domain | check.webhop.org | dns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contai |
| domain | cortana.homelinux.com | 0882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortana |
| domain | cortanasyn.com | from the following remote location and executes it: https://cortanasyn[.]com/Avcv The fourth shellcode loads the embedded Cobalt Strik |
| domain | cortanazone.com | .]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.] |
| domain | e.browsersyn.com | .]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com che |
| domain | mail.fptservice.net | te[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.] |
| domain | office.windown-update.com | .]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyn |
| domain | outlook.updateoffices.net | s[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com c |
| domain | ristineho.com | erveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contains the hard-coded |
| domain | servebbs.com | machine. OS A rchitecture URL User Agent 32 bit https://syn.servebbs[.]com/kuss32.gif Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:6 |
| domain | service.serveftp.org | nazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho |
| domain | service.windown-update.com | cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail |
| domain | syn.browserstime.com | opedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt |
| domain | syn.servebbs.com | .]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net out |
| domain | videos.dyndns.org | own-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check |
| domain | word.webhop.info | b8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browser |
| domain | work.windownoffice.com | ogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.] |
| sha256 | 040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3 | nique through a legitimate program. The RAR archive (SHA256:040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3) has the Vietnamese file name ‘Don khieu nai.rar’ which tra |
| sha256 | 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331 | 926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e273ab 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c345 |
| sha256 | 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b | baef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658 |
| sha256 | 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be | 9d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b53 |
| sha256 | 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b | af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc |
| sha256 | 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc | f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2 |
| sha256 | 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce | f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a |
| sha256 | 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 | f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077e |
| sha256 | 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d | a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f1 |
| sha256 | 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c | 2f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d |
| sha256 | 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 | ac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff |
| sha256 | 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 | 3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a6 |
| sha256 | 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e | d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84 |
| sha256 | 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd | 8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913 |
| sha256 | 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 | 44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282c |
| sha256 | 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 | ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 6245b74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6 |
| sha256 | 6245b74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6c7dfa | edfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 6245b74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6c7dfa 67cd191eb2322bf8b0f04a63a9e7cb7bc52fb4a4444fcb8fed2963884ae |
| sha256 | 67cd191eb2322bf8b0f04a63a9e7cb7bc52fb4a4444fcb8fed2963884aede3aa | 74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6c7dfa 67cd191eb2322bf8b0f04a63a9e7cb7bc52fb4a4444fcb8fed2963884aede3aa 68f77119eae5e9d2404376f2d87e71e4ab554c026e362c57313e5881005 |
| sha256 | 68f77119eae5e9d2404376f2d87e71e4ab554c026e362c57313e5881005ae79e | 91eb2322bf8b0f04a63a9e7cb7bc52fb4a4444fcb8fed2963884aede3aa 68f77119eae5e9d2404376f2d87e71e4ab554c026e362c57313e5881005ae79e 69e679daaaff3832c39671bf2b813b5530a70fb763d381f9a6e22e3bc49 |
| sha256 | 69e679daaaff3832c39671bf2b813b5530a70fb763d381f9a6e22e3bc493c8a9 | 119eae5e9d2404376f2d87e71e4ab554c026e362c57313e5881005ae79e 69e679daaaff3832c39671bf2b813b5530a70fb763d381f9a6e22e3bc493c8a9 6faa7deb1e1e0c3a7c62c2bb0ecdfa56b6e3ba4fe16971ec4572267ac70 |
| sha256 | 6faa7deb1e1e0c3a7c62c2bb0ecdfa56b6e3ba4fe16971ec4572267ac70b9177 | 9daaaff3832c39671bf2b813b5530a70fb763d381f9a6e22e3bc493c8a9 6faa7deb1e1e0c3a7c62c2bb0ecdfa56b6e3ba4fe16971ec4572267ac70b9177 6fb397e90f72783adec279434fe805c732ddb7d1d6aa72f19e91a1bf585 |
| sha256 | 6fb397e90f72783adec279434fe805c732ddb7d1d6aa72f19e91a1bf585e1ea5 | deb1e1e0c3a7c62c2bb0ecdfa56b6e3ba4fe16971ec4572267ac70b9177 6fb397e90f72783adec279434fe805c732ddb7d1d6aa72f19e91a1bf585e1ea5 70db041fb5aadb63c1b8ae57ba2699baa0086e9b011219dcebcccbf6320 |
| sha256 | 70db041fb5aadb63c1b8ae57ba2699baa0086e9b011219dcebcccbf632017992 | 7e90f72783adec279434fe805c732ddb7d1d6aa72f19e91a1bf585e1ea5 70db041fb5aadb63c1b8ae57ba2699baa0086e9b011219dcebcccbf632017992 7673f5468ba3cf01500f6bb6a19ce7208c8b6fc24f1a3a388eca491bc25 |
| sha256 | 73dcbcc47d6bd95dcf031ebbd34ac42301a20ee1143ac130b405e79b4ba40fc8 | anLotus and KerrDown . Indicators of Compromise: Lure Docs: 73dcbcc47d6bd95dcf031ebbd34ac42301a20ee1143ac130b405e79b4ba40fc8 89e19df797481ae2d2c895bcf030fe19e581976d2aef90c89bd6b340857 |
| sha256 | 7673f5468ba3cf01500f6bb6a19ce7208c8b6fc24f1a3a388eca491bc25cd9cd | 41fb5aadb63c1b8ae57ba2699baa0086e9b011219dcebcccbf632017992 7673f5468ba3cf01500f6bb6a19ce7208c8b6fc24f1a3a388eca491bc25cd9cd 77805a46f73e118ae2428f8c22ba28f79f7c60aeb6305d41c0bf3ebb9ce |
| sha256 | 77805a46f73e118ae2428f8c22ba28f79f7c60aeb6305d41c0bf3ebb9ce70f94 | 5468ba3cf01500f6bb6a19ce7208c8b6fc24f1a3a388eca491bc25cd9cd 77805a46f73e118ae2428f8c22ba28f79f7c60aeb6305d41c0bf3ebb9ce70f94 788265447391189ffc1956ebfec990dc051b56f506402d43cd1d4de9670 |
| sha256 | 788265447391189ffc1956ebfec990dc051b56f506402d43cd1d4de96709c082 | a46f73e118ae2428f8c22ba28f79f7c60aeb6305d41c0bf3ebb9ce70f94 788265447391189ffc1956ebfec990dc051b56f506402d43cd1d4de96709c082 7be613237b57fbc3cb83d001efadeed9936a2f519c514ab80de8285bdc5 |
| sha256 | 7be613237b57fbc3cb83d001efadeed9936a2f519c514ab80de8285bdc5a666c | 5447391189ffc1956ebfec990dc051b56f506402d43cd1d4de96709c082 7be613237b57fbc3cb83d001efadeed9936a2f519c514ab80de8285bdc5a666c 7dbb7fab4782f5e3b0c416c05114f2a51f12643805d5f3d0cd80d32272f |
| sha256 | 7dbb7fab4782f5e3b0c416c05114f2a51f12643805d5f3d0cd80d32272f2731a | 3237b57fbc3cb83d001efadeed9936a2f519c514ab80de8285bdc5a666c 7dbb7fab4782f5e3b0c416c05114f2a51f12643805d5f3d0cd80d32272f2731a 7ec77e643d8d7cc18cc67c123feceed91d10db1cc9fa0c49164cba35bb1 |
| sha256 | 7ec77e643d8d7cc18cc67c123feceed91d10db1cc9fa0c49164cba35bb1da987 | fab4782f5e3b0c416c05114f2a51f12643805d5f3d0cd80d32272f2731a 7ec77e643d8d7cc18cc67c123feceed91d10db1cc9fa0c49164cba35bb1da987 860f165c2240f2a83eb30c412755e5a025e25961ce4633683f5bc22f6a2 |
| sha256 | 860f165c2240f2a83eb30c412755e5a025e25961ce4633683f5bc22f6a24ddb6 | e643d8d7cc18cc67c123feceed91d10db1cc9fa0c49164cba35bb1da987 860f165c2240f2a83eb30c412755e5a025e25961ce4633683f5bc22f6a24ddb6 868ed69533fac80354a101410d3dd0a66f444385c6611cc85c5b0be49db |
| sha256 | 868ed69533fac80354a101410d3dd0a66f444385c6611cc85c5b0be49db2d6fd | 65c2240f2a83eb30c412755e5a025e25961ce4633683f5bc22f6a24ddb6 868ed69533fac80354a101410d3dd0a66f444385c6611cc85c5b0be49db2d6fd 89759e56d5c23085e47d2be2ce4ad4484dfdd4204044a78671ed434cec1 |
| sha256 | 89759e56d5c23085e47d2be2ce4ad4484dfdd4204044a78671ed434cec19b693 | 69533fac80354a101410d3dd0a66f444385c6611cc85c5b0be49db2d6fd 89759e56d5c23085e47d2be2ce4ad4484dfdd4204044a78671ed434cec19b693 8b7fb1cd5c09f7ec57ccc0c4261c0b4df0604962556a1d401b9cbfd750d |
| sha256 | 89e19df797481ae2d2c895bcf030fe19e581976d2aef90c89bd6b3408579bfc3 | involving a new payload, KerrDown. The lure hash is (SHA256:89e19df797481ae2d2c895bcf030fe19e581976d2aef90c89bd6b3408579bfc3) Figure 1 below shows a snapshot of the lure file. Once the |
| sha256 | 8b7fb1cd5c09f7ec57ccc0c4261c0b4df0604962556a1d401b9cbfd750df60ba | e56d5c23085e47d2be2ce4ad4484dfdd4204044a78671ed434cec19b693 8b7fb1cd5c09f7ec57ccc0c4261c0b4df0604962556a1d401b9cbfd750df60ba 8d6e31c95d649c08cdc2f82085298173d03c03afe02f0dacb66dd356014 |
| sha256 | 8bf22202e4fd4c005afde2266413cba9d1b749b1a2d75deac0c35728b5eb3af8 | 6341b4172d2cb752de4b938bf678ceb627ecb72594730b78bd05a2fad9d 8bf22202e4fd4c005afde2266413cba9d1b749b1a2d75deac0c35728b5eb3af8 df8210d20c5eb80d44ba8fa4c41c26c8421dcb20168e4f796e4955e01eb |
| sha256 | 8d6e31c95d649c08cdc2f82085298173d03c03afe02f0dacb66dd3560149184f | 1cd5c09f7ec57ccc0c4261c0b4df0604962556a1d401b9cbfd750df60ba 8d6e31c95d649c08cdc2f82085298173d03c03afe02f0dacb66dd3560149184f 942d763604d0aefdff10ce095f806195f351124a8433c96f5590d89d809 |
| sha256 | 942d763604d0aefdff10ce095f806195f351124a8433c96f5590d89d809a562f | 1c95d649c08cdc2f82085298173d03c03afe02f0dacb66dd3560149184f 942d763604d0aefdff10ce095f806195f351124a8433c96f5590d89d809a562f 98a5f30699564e6d9f74e737a611246262907b9e91b90348f7de53eb4cf |
| sha256 | 94fab926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e273ab | 0d20c5eb80d44ba8fa4c41c26c8421dcb20168e4f796e4955e01ebc9e13 94fab926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e273ab 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9d |
| sha256 | 98a5f30699564e6d9f74e737a611246262907b9e91b90348f7de53eb4cf32665 | 63604d0aefdff10ce095f806195f351124a8433c96f5590d89d809a562f 98a5f30699564e6d9f74e737a611246262907b9e91b90348f7de53eb4cf32665 9e6011d6380207e2bf5105cde3d48e412db565b92cdc1b3c6aa15bd7bd4 |
| sha256 | 9e6011d6380207e2bf5105cde3d48e412db565b92cdc1b3c6aa15bd7bd4b099f | 30699564e6d9f74e737a611246262907b9e91b90348f7de53eb4cf32665 9e6011d6380207e2bf5105cde3d48e412db565b92cdc1b3c6aa15bd7bd4b099f a106e0a6b7cc30b161e5ea0b1ec0f28ab89c2e1eb7ba2d5d409ddbabc3b |
| sha256 | a106e0a6b7cc30b161e5ea0b1ec0f28ab89c2e1eb7ba2d5d409ddbabc3b037e6 | 1d6380207e2bf5105cde3d48e412db565b92cdc1b3c6aa15bd7bd4b099f a106e0a6b7cc30b161e5ea0b1ec0f28ab89c2e1eb7ba2d5d409ddbabc3b037e6 a2b905c26e2b92e63de85d83e280249258cb21f300d8c4a3a6bdb488676 |
| sha256 | a2b905c26e2b92e63de85d83e280249258cb21f300d8c4a3a6bdb488676e9bcf | 0a6b7cc30b161e5ea0b1ec0f28ab89c2e1eb7ba2d5d409ddbabc3b037e6 a2b905c26e2b92e63de85d83e280249258cb21f300d8c4a3a6bdb488676e9bcf a4a86e96f95f395fcf0ceb6a74a2564f4ba7adbe1b40cc702b054427327 |
| sha256 | a4a066341b4172d2cb752de4b938bf678ceb627ecb72594730b78bd05a2fad9d | df797481ae2d2c895bcf030fe19e581976d2aef90c89bd6b3408579bfc3 a4a066341b4172d2cb752de4b938bf678ceb627ecb72594730b78bd05a2fad9d 8bf22202e4fd4c005afde2266413cba9d1b749b1a2d75deac0c35728b5e |
| sha256 | a4a86e96f95f395fcf0ceb6a74a2564f4ba7adbe1b40cc702b054427327a0399 | 5c26e2b92e63de85d83e280249258cb21f300d8c4a3a6bdb488676e9bcf a4a86e96f95f395fcf0ceb6a74a2564f4ba7adbe1b40cc702b054427327a0399 a8192656dd1db0be4cec9d03b4d10e0529d9c52c899eda8d8e72698acfb |
| sha256 | a8192656dd1db0be4cec9d03b4d10e0529d9c52c899eda8d8e72698acfb61419 | e96f95f395fcf0ceb6a74a2564f4ba7adbe1b40cc702b054427327a0399 a8192656dd1db0be4cec9d03b4d10e0529d9c52c899eda8d8e72698acfb61419 a8f776bd3a9593e963b567ce790033fec2804ea0afb40a92d40e21d8f33 |
| sha256 | a8f776bd3a9593e963b567ce790033fec2804ea0afb40a92d40e21d8f33d066f | 656dd1db0be4cec9d03b4d10e0529d9c52c899eda8d8e72698acfb61419 a8f776bd3a9593e963b567ce790033fec2804ea0afb40a92d40e21d8f33d066f b4966f8febdba6b2d674afffc65b1df11e7565acbd4517f1e5b9b36a8c6 |
| sha256 | b4966f8febdba6b2d674afffc65b1df11e7565acbd4517f1e5b9b36a8c6a16ed | 6bd3a9593e963b567ce790033fec2804ea0afb40a92d40e21d8f33d066f b4966f8febdba6b2d674afffc65b1df11e7565acbd4517f1e5b9b36a8c6a16ed bb25f1a73d095d57b2c8c9ac6780e4d412ddf3d9eef84a54903cc8e4eae |
| sha256 | bb25f1a73d095d57b2c8c9ac6780e4d412ddf3d9eef84a54903cc8e4eaefc335 | f8febdba6b2d674afffc65b1df11e7565acbd4517f1e5b9b36a8c6a16ed bb25f1a73d095d57b2c8c9ac6780e4d412ddf3d9eef84a54903cc8e4eaefc335 bc82bce004afb6424e9d9f9fc04a84f58edf859c4029eda08f7309dbeec |
| sha256 | bc82bce004afb6424e9d9f9fc04a84f58edf859c4029eda08f7309dbeec67696 | 1a73d095d57b2c8c9ac6780e4d412ddf3d9eef84a54903cc8e4eaefc335 bc82bce004afb6424e9d9f9fc04a84f58edf859c4029eda08f7309dbeec67696 c30198e0b0e470d4ac8821bd14bb754466e7974f1c20be8b300961e9e89 |
| sha256 | c30198e0b0e470d4ac8821bd14bb754466e7974f1c20be8b300961e9e89ed1ea | ce004afb6424e9d9f9fc04a84f58edf859c4029eda08f7309dbeec67696 c30198e0b0e470d4ac8821bd14bb754466e7974f1c20be8b300961e9e89ed1ea caabc45e59820a4349db13f337063eddede8a0847ae313d89a800f241d8 |
| sha256 | caabc45e59820a4349db13f337063eddede8a0847ae313d89a800f241d8556c8 | 8e0b0e470d4ac8821bd14bb754466e7974f1c20be8b300961e9e89ed1ea caabc45e59820a4349db13f337063eddede8a0847ae313d89a800f241d8556c8 d3ef6643ad529d43a7ec313b52c8396dc52c4daad688360eb207ee91a1c |
| sha256 | d3ef6643ad529d43a7ec313b52c8396dc52c4daad688360eb207ee91a1caf7b2 | 45e59820a4349db13f337063eddede8a0847ae313d89a800f241d8556c8 d3ef6643ad529d43a7ec313b52c8396dc52c4daad688360eb207ee91a1caf7b2 e3c818052237bb4bb061290ab5e2a55c3852c8a3fef16436b1197e8b17d |
| sha256 | df8210d20c5eb80d44ba8fa4c41c26c8421dcb20168e4f796e4955e01ebc9e13 | 202e4fd4c005afde2266413cba9d1b749b1a2d75deac0c35728b5eb3af8 df8210d20c5eb80d44ba8fa4c41c26c8421dcb20168e4f796e4955e01ebc9e13 94fab926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e |
| sha256 | e3c818052237bb4bb061290ab5e2a55c3852c8a3fef16436b1197e8b17de2e18 | 643ad529d43a7ec313b52c8396dc52c4daad688360eb207ee91a1caf7b2 e3c818052237bb4bb061290ab5e2a55c3852c8a3fef16436b1197e8b17de2e18 e56ffcf5df2afd6b151c24ddfe7cd450f9208f59b5731991b926af0dce2 |
| sha256 | e56ffcf5df2afd6b151c24ddfe7cd450f9208f59b5731991b926af0dce24285a | 8052237bb4bb061290ab5e2a55c3852c8a3fef16436b1197e8b17de2e18 e56ffcf5df2afd6b151c24ddfe7cd450f9208f59b5731991b926af0dce24285a e8704bf6525c90e0f5664f400c3bf8ff5da565080a52126e0e6a6286915 |
| sha256 | e8704bf6525c90e0f5664f400c3bf8ff5da565080a52126e0e6a62869157dfe3 | cf5df2afd6b151c24ddfe7cd450f9208f59b5731991b926af0dce24285a e8704bf6525c90e0f5664f400c3bf8ff5da565080a52126e0e6a62869157dfe3 e8a454cd8b57a243f0abeec6945c9b10616cfdcc4abfb4c618bfc469d02 |
| sha256 | e8a454cd8b57a243f0abeec6945c9b10616cfdcc4abfb4c618bfc469d026d537 | bf6525c90e0f5664f400c3bf8ff5da565080a52126e0e6a62869157dfe3 e8a454cd8b57a243f0abeec6945c9b10616cfdcc4abfb4c618bfc469d026d537 eac776c3c83c9db1a770ffaf6df9e94611c8293cbd41cb9257148603b8f |
| sha256 | eac776c3c83c9db1a770ffaf6df9e94611c8293cbd41cb9257148603b8f2be0b | 4cd8b57a243f0abeec6945c9b10616cfdcc4abfb4c618bfc469d026d537 eac776c3c83c9db1a770ffaf6df9e94611c8293cbd41cb9257148603b8f2be0b ead0f3e6f0ca16b283f09526d09e8e8cba687dab642f0e102e5487cb565 |
| sha256 | ead0f3e6f0ca16b283f09526d09e8e8cba687dab642f0e102e5487cb565bf475 | 6c3c83c9db1a770ffaf6df9e94611c8293cbd41cb9257148603b8f2be0b ead0f3e6f0ca16b283f09526d09e8e8cba687dab642f0e102e5487cb565bf475 f011a136996fa53fdbde944da0908da446b9532307a35c44ed08241b5e6 |
| sha256 | f011a136996fa53fdbde944da0908da446b9532307a35c44ed08241b5e602cc9 | 3e6f0ca16b283f09526d09e8e8cba687dab642f0e102e5487cb565bf475 f011a136996fa53fdbde944da0908da446b9532307a35c44ed08241b5e602cc9 f2a2f4fa2ed5b2a94720a4661937da97ab21aa198a5f8c83bb6895aa2c3 |
| sha256 | f2a2f4fa2ed5b2a94720a4661937da97ab21aa198a5f8c83bb6895aa2c398d22 | 136996fa53fdbde944da0908da446b9532307a35c44ed08241b5e602cc9 f2a2f4fa2ed5b2a94720a4661937da97ab21aa198a5f8c83bb6895aa2c398d22 f62f21ee7e642f272b881827b45ceb643c999a742e1d3eac13d1ba014d1 |
| sha256 | f62f21ee7e642f272b881827b45ceb643c999a742e1d3eac13d1ba014d1e7f67 | 4fa2ed5b2a94720a4661937da97ab21aa198a5f8c83bb6895aa2c398d22 f62f21ee7e642f272b881827b45ceb643c999a742e1d3eac13d1ba014d1e7f67 f9f0973dc74716b75291f5a9b2d59b08500882563011d1def2b8d0b1b9b |
| sha256 | f9f0973dc74716b75291f5a9b2d59b08500882563011d1def2b8d0b1b9bbb8ae | 1ee7e642f272b881827b45ceb643c999a742e1d3eac13d1ba014d1e7f67 f9f0973dc74716b75291f5a9b2d59b08500882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word |
From the original article
9 min read at unit42.paloaltonetworks.com
OceanLotus (AKA APT32) is a threat actor group known to be one of the most sophisticated threat actors originating out of south east Asia. Multiple attack campaigns have been reported by number of security organizations in the last couple of years, documenting the tools and tactics used by the threat actor.
By Vicky Ray, Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.