Malwarehigh
“Red October”. Detailed Malware Description 1. First Stage of Attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-3129 | CVE-2009-3129: Memory Corruption RCE in Microsoft Excel via FEATHEADER Record | — | 84% | KEV | — KEV |
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2011-3544 | Remote Code Execution in Oracle Java SE JRE Applet Rhino Script Engine | — | 97% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hotinfonews.com | ary 14th, the very same day that they registered the domain hotinfonews.com: Domain Name: HOTINFONEWS.COM Registrant: Privat Person Den |
| md5 | 114ed0e5298149fc69f6e41566e3717a | 6c1e83bcbc9f873168e2370af Commercial Report for October.doc 114ed0e5298149fc69f6e41566e3717a Russian terrorist attack.doc 350c170870e42dce1715a188ca20d7 |
| md5 | 1f86299628bed519718478739b0e4b0c | ne.xls c42627a677e0a6244b84aa977fbea15d List of shahids.xls 1f86299628bed519718478739b0e4b0c BMAC Attache List – At 11 Oct_v1[1].XLS f0357f969fbaf798095 |
| md5 | 2672fbba23bf4f5e139b10cacc837e9f | D22A059FF8DA903FBC69C352 Итоги президенства В.Януковича.doc 2672FBBA23BF4F5E139B10CACC837E9F the wife of Ambassador-2.doc 65D277AF039004146061FF01BB757A |
| md5 | 350c170870e42dce1715a188ca20d73b | 4ed0e5298149fc69f6e41566e3717a Russian terrorist attack.doc 350c170870e42dce1715a188ca20d73b FLOC-meeting.doc 4daa2e7d3ac1a5c6b81a92f4a9ac21f1 3037.doc |
| md5 | 35f1572eb7759cb7a66ca459c093e8a1 | o infiltrated victim network(s) via Java exploitation (MD5: 35f1572eb7759cb7a66ca459c093e8a1 – ‘NewsFinder.jar’ ), known as the ‘Rhino’ exploit (CVE-201 |
| md5 | 396d9e339c1fd2e787d885a688d5c646 | 74280ef84277ea54 EEAS New contact list (05-05-2011) (2).xls 396d9e339c1fd2e787d885a688d5c646 FIEO contacts update.xls 7e5d9b496306b558ba04e5a4c5638f9f T |
| md5 | 3ded9a0dd566215f04e05340ccf20e0c | 8fb3a6749903c8dc17287cebbf8 8th_2012 Minutes of meeting.doc 3ded9a0dd566215f04e05340ccf20e0c The CVE-2012-0158 exploit used in these attacks is mostly u |
| md5 | 44e70bce66cdac5dc06d5c0d6780ba45 | Política de Defensa y el Poder Naval en México OTAN (1).doc 44E70BCE66CDAC5DC06D5C0D6780BA45 Iran, Syria and the balance of power in the Middle East.doc |
| md5 | 4bfa449f1a351210d3c5b03ac2bd18b1 | b79cd2560 Agenda Telefoane institutii si ministere 2011.xls 4bfa449f1a351210d3c5b03ac2bd18b1 Agenda Telefoane institutii si ministere 2011 (2).xls 4ce5f |
| md5 | 4ce5fd18b1d3f551a098bb26d8347ffb | d18b1 Agenda Telefoane institutii si ministere 2011 (2).xls 4ce5fd18b1d3f551a098bb26d8347ffb FIEO contacts update.xls ec98640c401e296a76ab7f213164ef8c s |
| md5 | 4daa2e7d3ac1a5c6b81a92f4a9ac21f1 | ttack.doc 350c170870e42dce1715a188ca20d73b FLOC-meeting.doc 4daa2e7d3ac1a5c6b81a92f4a9ac21f1 3037.doc 82e518fb3a6749903c8dc17287cebbf8 8th_2012 Minutes |
| md5 | 50bd553568422cf547539dd1f49dd80d | ].XLS f0357f969fbaf798095b43c9e7a0cfa7 MERCOSUR_Imports.xls 50bd553568422cf547539dd1f49dd80d Cópia de guia de telefonos (2).xls cee7bd726bc57e601c85203c |
| md5 | 51edea56c1e83bcbc9f873168e2370af | : Mazda.doc 93d0222c8c7b57d38931cfd712523c67 Komorowski.doc 51edea56c1e83bcbc9f873168e2370af Commercial Report for October.doc 114ed0e5298149fc69f6e4156 |
| md5 | 5d1121eac9021b5b01570fb58e7d4622 | rence Renewable energy cooperation and Grid integration.doc 5D1121EAC9021B5B01570FB58E7D4622 The Word based exploit is detected by Kaspersky products as |
| md5 | 5ecec03853616e13475ac20a0ef987b6 | hahids.xls dc4a977eaa2b62ad7785b46b40c61281 Spravochnik.xls 5ecec03853616e13475ac20a0ef987b6 Agenda Telefoane&Email institutii si ministere 2011.xls de5 |
| md5 | 5f9b7a70ca665a54f8879a6a16f6adde | ab635303e61de2 EEAS-Staff New contact list (05-25-2011).xls 5f9b7a70ca665a54f8879a6a16f6adde tactlist_05-05-2011_.8634.xls EEAS New contact list (05-05- |
| md5 | 639760784b3e26c1fe619e5df7d0f674 | xls ceac9d75b8920323477e8a4acdae2803 12 05 2011 updated.xls 639760784b3e26c1fe619e5df7d0f674 telefonebi.xls d71a9d26d4bb3b0ed189c79cd24d179a telefonebi. |
| md5 | 65d277af039004146061ff01bb757a8f | 72FBBA23BF4F5E139B10CACC837E9F the wife of Ambassador-2.doc 65D277AF039004146061FF01BB757A8F Вожможные стратегические решения.doc 731C68D2335E60107DF2F5 |
| md5 | 6b23732895daaad4bd6eae1d0b0fef08 | cb51ef3e541e060f0c56ac10adef37c3 Popa Tatiana -plîngere.doc 6B23732895DAAAD4BD6EAE1D0B0FEF08 La Política de Defensa y el Poder Naval en México OTAN (1). |
| md5 | 731c68d2335e60107df2f5af18b9f4c9 | 9004146061FF01BB757A8F Вожможные стратегические решения.doc 731C68D2335E60107DF2F5AF18B9F4C9 31086823_cm04639-re02 en12.doc 9B55887B3E0C7F1E41D1ABDC3266 |
| md5 | 7e5d9b496306b558ba04e5a4c5638f9f | s 396d9e339c1fd2e787d885a688d5c646 FIEO contacts update.xls 7e5d9b496306b558ba04e5a4c5638f9f Telephone.xls c42627a677e0a6244b84aa977fbea15d List of shah |
| md5 | 82e518fb3a6749903c8dc17287cebbf8 | FLOC-meeting.doc 4daa2e7d3ac1a5c6b81a92f4a9ac21f1 3037.doc 82e518fb3a6749903c8dc17287cebbf8 8th_2012 Minutes of meeting.doc 3ded9a0dd566215f04e05340ccf |
| md5 | 85baebed3d22fa63ce91ffafcd7cc991 | 14EC914DD74F4CFB8DD0F Diplomatic Car for Sale – MB 2000.doc 85BAEBED3D22FA63CE91FFAFCD7CC991 Rulers have hostaged parliament to further their personal i |
| md5 | 91ebc2b587a14ec914dd74f4cfb8dd0f | 9F470A4B0F9827D0D3AE463F44B227DB Diplomatic Staff list.doc 91EBC2B587A14EC914DD74F4CFB8DD0F Diplomatic Car for Sale – MB 2000.doc 85BAEBED3D22FA63CE91F |
| md5 | 93d0222c8c7b57d38931cfd712523c67 | / MD5 list related to the attack: File name: MD5: Mazda.doc 93d0222c8c7b57d38931cfd712523c67 Komorowski.doc 51edea56c1e83bcbc9f873168e2370af Commercial |
| md5 | 9950a027191c4930909ca23608d464cc | F731439BBE28FC2E6BBE Davos2011_follow-up plan_heregjilt.doc 9950A027191C4930909CA23608D464CC Participant list 6th Forum 09-12 update.doc C78253AEFCB35F9 |
| md5 | 9b55887b3e0c7f1e41d1abdc32667a93 | 68D2335E60107DF2F5AF18B9F4C9 31086823_cm04639-re02 en12.doc 9B55887B3E0C7F1E41D1ABDC32667A93 16 октября 2012 года (дополнение).doc A7330CE1B0F89AC157E33 |
| md5 | 9f470a4b0f9827d0d3ae463f44b227db | Iran, Syria and the balance of power in the Middle East.doc 9F470A4B0F9827D0D3AE463F44B227DB Diplomatic Staff list.doc 91EBC2B587A14EC914DD74F4CFB8DD0F |
| md5 | a7330ce1b0f89ac157e335da825b22c7 | C7F1E41D1ABDC32667A93 16 октября 2012 года (дополнение).doc A7330CE1B0F89AC157E335DA825B22C7 delegat.doc FC3C874BDAEDF731439BBE28FC2E6BBE Davos2011_foll |
| md5 | b9238737d22a059ff8da903fbc69c352 | taged parliament to further their personal interest (1).doc B9238737D22A059FF8DA903FBC69C352 Итоги президенства В.Януковича.doc 2672FBBA23BF4F5E139B10CA |
| md5 | bb2f6240402f765a9d0d650b79cd2560 | 05-05-2011_.8634.xls EEAS New contact list (05-05-2011).xls bb2f6240402f765a9d0d650b79cd2560 Agenda Telefoane institutii si ministere 2011.xls 4bfa449f1 |
| md5 | bd05475a538c996cd6cafe72f3a98fae | n be found below: File name: MD5: Katyn_-_opinia_Rosjan.xls bd05475a538c996cd6cafe72f3a98fae WORK PLAN (APRIL-JUNE 2011).xls f16785fc3650490604ab635303e |
| md5 | c3b0d1403ba35c3aba8f4529f43fb300 | n a public sandbox at malwr.com ( http://malwr.com/analysis/c3b0d1403ba35c3aba8f4529f43fb300/ ), and only on February 14th, the very same day that they |
| md5 | c42627a677e0a6244b84aa977fbea15d | s update.xls 7e5d9b496306b558ba04e5a4c5638f9f Telephone.xls c42627a677e0a6244b84aa977fbea15d List of shahids.xls 1f86299628bed519718478739b0e4b0c BMAC A |
| md5 | c78253aefcb35f94acc63585d7bfb176 | 09CA23608D464CC Participant list 6th Forum 09-12 update.doc C78253AEFCB35F94ACC63585D7BFB176 Draft 3_Conference Renewable energy cooperation and Grid in |
| md5 | cb51ef3e541e060f0c56ac10adef37c3 | D5 list related to the attack: File name: MD5: arexeio1.doc cb51ef3e541e060f0c56ac10adef37c3 Popa Tatiana -plîngere.doc 6B23732895DAAAD4BD6EAE1D0B0FEF08 |
| md5 | ceac9d75b8920323477e8a4acdae2803 | ee7bd726bc57e601c85203c5767293c Programme de fetes 2011.xls ceac9d75b8920323477e8a4acdae2803 12 05 2011 updated.xls 639760784b3e26c1fe619e5df7d0f674 tel |
| md5 | cee7bd726bc57e601c85203c5767293c | 68422cf547539dd1f49dd80d Cópia de guia de telefonos (2).xls cee7bd726bc57e601c85203c5767293c Programme de fetes 2011.xls ceac9d75b8920323477e8a4acdae280 |
| md5 | d71a9d26d4bb3b0ed189c79cd24d179a | updated.xls 639760784b3e26c1fe619e5df7d0f674 telefonebi.xls d71a9d26d4bb3b0ed189c79cd24d179a telefonebi.xls dc8f0d4ecda437c3f870cd17d010a3f6 The Excel b |
| md5 | d98378db4016404ac558f9733e906b2b | xls ec98640c401e296a76ab7f213164ef8c spisok sotrudnikov.xls d98378db4016404ac558f9733e906b2b List of shahids.xls dc4a977eaa2b62ad7785b46b40c61281 Spravo |
| md5 | dc4a977eaa2b62ad7785b46b40c61281 | ov.xls d98378db4016404ac558f9733e906b2b List of shahids.xls dc4a977eaa2b62ad7785b46b40c61281 Spravochnik.xls 5ecec03853616e13475ac20a0ef987b6 Agenda Tel |
| md5 | dc8f0d4ecda437c3f870cd17d010a3f6 | efonebi.xls d71a9d26d4bb3b0ed189c79cd24d179a telefonebi.xls dc8f0d4ecda437c3f870cd17d010a3f6 The Excel based exploit is detected by Kaspersky products a |
| md5 | de56229f497bf51274280ef84277ea54 | 7b6 Agenda Telefoane&Email institutii si ministere 2011.xls de56229f497bf51274280ef84277ea54 EEAS New contact list (05-05-2011) (2).xls 396d9e339c1fd2e7 |
| md5 | ec98640c401e296a76ab7f213164ef8c | s 4ce5fd18b1d3f551a098bb26d8347ffb FIEO contacts update.xls ec98640c401e296a76ab7f213164ef8c spisok sotrudnikov.xls d98378db4016404ac558f9733e906b2b Lis |
| md5 | f0357f969fbaf798095b43c9e7a0cfa7 | 519718478739b0e4b0c BMAC Attache List – At 11 Oct_v1[1].XLS f0357f969fbaf798095b43c9e7a0cfa7 MERCOSUR_Imports.xls 50bd553568422cf547539dd1f49dd80d Cópia |
| md5 | f16785fc3650490604ab635303e61de2 | 75a538c996cd6cafe72f3a98fae WORK PLAN (APRIL-JUNE 2011).xls f16785fc3650490604ab635303e61de2 EEAS-Staff New contact list (05-25-2011).xls 5f9b7a70ca665a |
| md5 | fc3c874bdaedf731439bbe28fc2e6bbe | ополнение).doc A7330CE1B0F89AC157E335DA825B22C7 delegat.doc FC3C874BDAEDF731439BBE28FC2E6BBE Davos2011_follow-up plan_heregjilt.doc 9950A027191C4930909C |
| sha256 | 5fe53a960bc2031a185c575ea05ac466f26739a34c651c14260e4cfbc123e87f | of various products, check: https://www.virustotal.com/file/5fe53a960bc2031a185c575ea05ac466f26739a34c651c14260e4cfbc123e87f/analysis/ Several detections include: Kaspersky Exploit.MSW |
| sha256 | afaebb8055559ea6bf88cedcd6fc7b93f02cde31a560876bcc4860fd0686739d | of various products, check: https://www.virustotal.com/file/afaebb8055559ea6bf88cedcd6fc7b93f02cde31a560876bcc4860fd0686739d/analysis/ Several detections include: Kaspersky Trojan-Drop |
| url | http://www.hotinfonews.com/news/dailynews2.php?id=&t=win” | that is concatenated with the other variables, resulting in”hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win”. It is this content that is written to disk and executed on |
From the original article
13 min read at securelist.com
Based on the analysis of known cases, we identified two main ways through which Backdoor. Win32. Sputnik infects the victims.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.