Vulnerabilitymedium

How Malformed RTF Defeats Security Engines

Cisco TalosMar 23, 2017 · 15:45 UTC (Mar 23, 2017)6 min read3 · 1 read

Read at blog.talosintelligence.com

Analyze CVE-2016-7193 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2016-7193

Tags: cve-2016-7193 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2016-7193	Memory Corruption RCE in Microsoft Word and Office Components via Crafted RTF Files	7.8	58%	KEV	Oct 14, 2016 KEV Mar 3, 2022

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

6 min read at blog.talosintelligence.com

This post is authored by Paul Rascagneres with contributions from Alex McDonnell Talos has discovered a new spam campaign used to infect targets with the well known Loki Bot stealer. The infection vector is an RTF document abusing an old exploit (CVE-2016-7193), however the most interesting part is the effort put into the generation of the RTF.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
md5	576f726400446f63756d656e74003132	the OLE, for example: {\objdata dde00000 00000000 00000000 576f726400446f63756d656e74003132 00000000 00000000 00c20000 d0cf11e0a1b11ae10000000000000000
sha256	0882c8a38ca485fe9763b0c0c7c5a22c330cebe86101a9e1ffa5a70c4f58faac	62ebbd3a848219aa47c149c174c292cea5e62dcc0bd26f12e1bf5ba7d7c 0882c8a38ca485fe9763b0c0c7c5a22c330cebe86101a9e1ffa5a70c4f58faac 156cbbb25240e246a2340e1bca1692b7110277bac30f76dcacd48dd5f20
sha256	11836837753c754997adf8ccf4fa8ba824e57725f56fbcd3b0d903e1fa30ac5b	3ed4dc67526f89b2c59fc16b389530a73b326f63fff17ae7c824b7770fd 11836837753c754997adf8ccf4fa8ba824e57725f56fbcd3b0d903e1fa30ac5b 737d1468b20dc39300bc2be38285b6482940d2be9ae59b7dc984cf4dc6d
sha256	14a6e04a60b1bb5f4d0fb3fffa240b7b34bf9c0b8504da19caeb31182510c139	ad97bb9f5093e5cfb100352ad2f0ec3dfce63232207daf0aa736d6438c9 14a6e04a60b1bb5f4d0fb3fffa240b7b34bf9c0b8504da19caeb31182510c139 1ae6aa92ce8ee9a2ab78631663fa5a9bdcc14490c4c5fe799b41d26455b
sha256	156cbbb25240e246a2340e1bca1692b7110277bac30f76dcacd48dd5f2042caa	8a38ca485fe9763b0c0c7c5a22c330cebe86101a9e1ffa5a70c4f58faac 156cbbb25240e246a2340e1bca1692b7110277bac30f76dcacd48dd5f2042caa a28c3c075ecfb982e6e3cb237c0eab1308f023e7bcf207d0fd1f2b4f297
sha256	17ae8d128938131ebc944f5d77be7009fd05c8831f88ef3558cc9c00f0633f97	4bb7b68b4655ab7ac85c8a7c93abe2238ec3d24914d86e8a543b6c6abbd 17ae8d128938131ebc944f5d77be7009fd05c8831f88ef3558cc9c00f0633f97 dbc97df1e5036ac572d8a247a6b073ab1f1dabd20676443598135c67435
sha256	194549b3fd0be8a701b8433db1b2cff396a4492c342632fa22d6af89570eff46	0601345bf8fc05f27d35f3c3f2ed80b6e7890d5f33a57f75c09a089356a 194549b3fd0be8a701b8433db1b2cff396a4492c342632fa22d6af89570eff46 673f9469ff150c8c821ea3b5b1cda8175d09719fbd7d1359d334dbf17f7
sha256	1ae6aa92ce8ee9a2ab78631663fa5a9bdcc14490c4c5fe799b41d26455b5b696	04a60b1bb5f4d0fb3fffa240b7b34bf9c0b8504da19caeb31182510c139 1ae6aa92ce8ee9a2ab78631663fa5a9bdcc14490c4c5fe799b41d26455b5b696 4f2c10b64d4f4b56d56b5a271331c92484b6ddf8c4eb9f56669ed60545a
sha256	1d73428619f69cbdfc5158f1682cc304ba6af2a0b425244bcd8c2c432d4a50d7	527e4cb65e05069b871e06226ce9c9669649ed9cfbad2dcb41cdd9fe94c 1d73428619f69cbdfc5158f1682cc304ba6af2a0b425244bcd8c2c432d4a50d7 cbb58841ef2179e52fcfb918d085503ccf4482014fa1f0714e11fd667de
sha256	27290fd934092cf1ca2a242e6847665a16771376af8f5c81ef1c851463e77709	8b5fd175822d4479552078331dbfb16881fea9514377a802f3cce87ac02 27290fd934092cf1ca2a242e6847665a16771376af8f5c81ef1c851463e77709 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa19
sha256	2e65f8fc7901505dd4225ec66cca0ef308f2b6fbe48d37f5055775854bf7a5f8	747a3329c3a317d4bd7ecf029e89bd76192075f84834563103a54bac968 2e65f8fc7901505dd4225ec66cca0ef308f2b6fbe48d37f5055775854bf7a5f8 a3c3abcd461d00e1f928e375770e39e3a33f719d7287a2fee661d82ce8d
sha256	415b9e72811cd7c50366d9c9038df02fe3bbfc6446ef42b099d85ea576fbd35d	468b20dc39300bc2be38285b6482940d2be9ae59b7dc984cf4dc6d82053 415b9e72811cd7c50366d9c9038df02fe3bbfc6446ef42b099d85ea576fbd35d 84a2ded87681e65be35994ea26f4b2287e52438bbeebaac784c291196a6
sha256	41c4483cfcc0b5a10504aa137ec3824d139663b7ec318d5e1fb6c9f5db8af8f9	cb4fcee52cdc94c06325c339ac11a3fb1e399e1ed5a2a55107f5f64867f 41c4483cfcc0b5a10504aa137ec3824d139663b7ec318d5e1fb6c9f5db8af8f9 f07f87ab68482d329eeac5525ea5f189bcd720d2b2d149db61ab81ae04b
sha256	44583aca68ce734bccc79d28f666bdc81a1436c257f035875df15a82f35e6910	841ef2179e52fcfb918d085503ccf4482014fa1f0714e11fd667de974a0 44583aca68ce734bccc79d28f666bdc81a1436c257f035875df15a82f35e6910 5872ec86add4892f061cc1fd2478da098645876d0b13d3ce3e789f526c5
sha256	450b2d6741a452d3bff491fb3a40ec8e29cbaf24fb1b400863efe1a7f920543e	26b380bd109dbcb3d9c4635c1866234d302658758d6ecf4e927a12af9a1 450b2d6741a452d3bff491fb3a40ec8e29cbaf24fb1b400863efe1a7f920543e 99a3939d654e4c424dcf33fbc18c7568d1030981ad1ae8f2a6da2966efb
sha256	4a7d6c770c5fdbb32534b535efe0324e3bc25a8bcd3551b7fe0ff3610ee81299	11adb48a00393c30a0902716e0088f650750349f5966ba3b60a0fa17487 4a7d6c770c5fdbb32534b535efe0324e3bc25a8bcd3551b7fe0ff3610ee81299 6077c3ed4dc67526f89b2c59fc16b389530a73b326f63fff17ae7c824b7
sha256	4d46087599b246cd297883341859561b3b1794419c704b167a28c7891ff5d7b1	d5b7cfcc4a55583adbf75f578d71d6aa572e93c5a7392ece4dc8204d0f8 4d46087599b246cd297883341859561b3b1794419c704b167a28c7891ff5d7b1 7c5337250b6a1ede2472e4acc74366e8a425eaf2c36e3805d36200ad560
sha256	4f2c10b64d4f4b56d56b5a271331c92484b6ddf8c4eb9f56669ed60545a4c06d	a92ce8ee9a2ab78631663fa5a9bdcc14490c4c5fe799b41d26455b5b696 4f2c10b64d4f4b56d56b5a271331c92484b6ddf8c4eb9f56669ed60545a4c06d b1da2cb4fcee52cdc94c06325c339ac11a3fb1e399e1ed5a2a55107f5f6
sha256	552fe8b5fd175822d4479552078331dbfb16881fea9514377a802f3cce87ac02	0208c914ff28f8e30eda539acb6abd23bbdecf704be4b77615a27f62e8d 552fe8b5fd175822d4479552078331dbfb16881fea9514377a802f3cce87ac02 27290fd934092cf1ca2a242e6847665a16771376af8f5c81ef1c851463e
sha256	5872ec86add4892f061cc1fd2478da098645876d0b13d3ce3e789f526c5b8ec8	aca68ce734bccc79d28f666bdc81a1436c257f035875df15a82f35e6910 5872ec86add4892f061cc1fd2478da098645876d0b13d3ce3e789f526c5b8ec8 9eb85367bd59854ccd7b8e13a22deec92bbe746a5de83820d7265055f96
sha256	59011fa80db84cea54bc6ec7f7bc689d916f04e8df9950b259ad524142225731	bcdbc81bc605cf07545a01273596d4e51b198874253815069cd6708b2fa 59011fa80db84cea54bc6ec7f7bc689d916f04e8df9950b259ad524142225731 7aa0abedd75c46680ac65814d9433a04bb9f6bc6f094d66cc33a918f32d
sha256	5957fe5e38f2b2530569e21f040a92b1fb36816b6d5187d8a0ecf0ba84f36519	30a7d6792e59f5a0ade225472042c9eb9bf59b03f67e85b0642c16e59ce 5957fe5e38f2b2530569e21f040a92b1fb36816b6d5187d8a0ecf0ba84f36519 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa19
sha256	599a60601345bf8fc05f27d35f3c3f2ed80b6e7890d5f33a57f75c09a089356a	2287f4fdefe0621d9fadd83b0531f56811937b023ce49e426e320b372f5 599a60601345bf8fc05f27d35f3c3f2ed80b6e7890d5f33a57f75c09a089356a 194549b3fd0be8a701b8433db1b2cff396a4492c342632fa22d6af89570
sha256	5c1db6ce5989645bbc8cb8489dee2fb99eba7b4093eaad96cd5a6c692a53c245	9ed847b78fd68a871688a7e99e6abc87295c671a3e2d02a61a1e04f5ce9 5c1db6ce5989645bbc8cb8489dee2fb99eba7b4093eaad96cd5a6c692a53c245 c343e92d30c1374c631efa8cf612faf5567e8bd66330e1ff58ac9296c33
sha256	5d6b52287f4fdefe0621d9fadd83b0531f56811937b023ce49e426e320b372f5	a14367d1a7b599d7afae07aa66c63941238ff25f4f17dea54db6d8ac350 5d6b52287f4fdefe0621d9fadd83b0531f56811937b023ce49e426e320b372f5 599a60601345bf8fc05f27d35f3c3f2ed80b6e7890d5f33a57f75c09a08
sha256	6077c3ed4dc67526f89b2c59fc16b389530a73b326f63fff17ae7c824b7770fd	c770c5fdbb32534b535efe0324e3bc25a8bcd3551b7fe0ff3610ee81299 6077c3ed4dc67526f89b2c59fc16b389530a73b326f63fff17ae7c824b7770fd 11836837753c754997adf8ccf4fa8ba824e57725f56fbcd3b0d903e1fa3
sha256	629d1afbedd7cc082549d5c3fc3926b6b4e55abc3c07f8d994a791893a2fd530	adeb337e9fb5aa9f8046462e3d1d418946fd6237bc252a80a2d4fb2fff7 629d1afbedd7cc082549d5c3fc3926b6b4e55abc3c07f8d994a791893a2fd530 9f48ce01ac99033c03e9aa983c09fa273eae0e168e55de8cc364311ae4f
sha256	66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f	analysed sample illustrated in the article has a SHA256 of 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f. RTF reminder The RTF format is a proprietary file format d
sha256	673f9469ff150c8c821ea3b5b1cda8175d09719fbd7d1359d334dbf17f74adbe	9b3fd0be8a701b8433db1b2cff396a4492c342632fa22d6af89570eff46 673f9469ff150c8c821ea3b5b1cda8175d09719fbd7d1359d334dbf17f74adbe f81be30a7d6792e59f5a0ade225472042c9eb9bf59b03f67e85b0642c16
sha256	6d33cd5b7cfcc4a55583adbf75f578d71d6aa572e93c5a7392ece4dc8204d0f8	367bd59854ccd7b8e13a22deec92bbe746a5de83820d7265055f96da40f 6d33cd5b7cfcc4a55583adbf75f578d71d6aa572e93c5a7392ece4dc8204d0f8 4d46087599b246cd297883341859561b3b1794419c704b167a28c7891ff
sha256	726f170f13b9a24d409c0c4fbf0a14aff0f3cd1662762230bfaf7a8822257880	0177538628f93d57ae1e59859c50409afefe133956ec801c040ab9253f5 726f170f13b9a24d409c0c4fbf0a14aff0f3cd1662762230bfaf7a8822257880 885877989df73bafd087f7c689eedfa5e2fe3620ab62d6ff57a33947027
sha256	737d1468b20dc39300bc2be38285b6482940d2be9ae59b7dc984cf4dc6d82053	837753c754997adf8ccf4fa8ba824e57725f56fbcd3b0d903e1fa30ac5b 737d1468b20dc39300bc2be38285b6482940d2be9ae59b7dc984cf4dc6d82053 415b9e72811cd7c50366d9c9038df02fe3bbfc6446ef42b099d85ea576f
sha256	79316e4c2601a5721d5d6ada0f152790ad44aa9ac5badf17e12c7825fb1f46aa	df1e5036ac572d8a247a6b073ab1f1dabd20676443598135c6743534028 79316e4c2601a5721d5d6ada0f152790ad44aa9ac5badf17e12c7825fb1f46aa a406f0208c914ff28f8e30eda539acb6abd23bbdecf704be4b77615a27f
sha256	7aa0abedd75c46680ac65814d9433a04bb9f6bc6f094d66cc33a918f32dcb2fa	fa80db84cea54bc6ec7f7bc689d916f04e8df9950b259ad524142225731 7aa0abedd75c46680ac65814d9433a04bb9f6bc6f094d66cc33a918f32dcb2fa ad3af8a7ab469fa930d0873475214c3160f52b17c06f296d6ce9cc6fc92
sha256	7b684ad97bb9f5093e5cfb100352ad2f0ec3dfce63232207daf0aa736d6438c9	samples with similar malformations of the RTF file format: 7b684ad97bb9f5093e5cfb100352ad2f0ec3dfce63232207daf0aa736d6438c9 14a6e04a60b1bb5f4d0fb3fffa240b7b34bf9c0b8504da19caeb3118251
sha256	7c5337250b6a1ede2472e4acc74366e8a425eaf2c36e3805d36200ad560d0feb	87599b246cd297883341859561b3b1794419c704b167a28c7891ff5d7b1 7c5337250b6a1ede2472e4acc74366e8a425eaf2c36e3805d36200ad560d0feb bc4f30177538628f93d57ae1e59859c50409afefe133956ec801c040ab9
sha256	84a2ded87681e65be35994ea26f4b2287e52438bbeebaac784c291196a6f94c6	e72811cd7c50366d9c9038df02fe3bbfc6446ef42b099d85ea576fbd35d 84a2ded87681e65be35994ea26f4b2287e52438bbeebaac784c291196a6f94c6 9c62f4947a572356f43f71fb55f2b702b78c2e1688c67eff89c36da5013
sha256	885877989df73bafd087f7c689eedfa5e2fe3620ab62d6ff57a3394702761751	70f13b9a24d409c0c4fbf0a14aff0f3cd1662762230bfaf7a8822257880 885877989df73bafd087f7c689eedfa5e2fe3620ab62d6ff57a3394702761751 9f40662ebbd3a848219aa47c149c174c292cea5e62dcc0bd26f12e1bf5b
sha256	89a1264bd7facf02d48aff46724a0215c2fb1974d06451cebefdb2ea7ea9a71a	8a7ab469fa930d0873475214c3160f52b17c06f296d6ce9cc6fc92e8a79 89a1264bd7facf02d48aff46724a0215c2fb1974d06451cebefdb2ea7ea9a71a c53bf11adb48a00393c30a0902716e0088f650750349f5966ba3b60a0fa
sha256	99a3939d654e4c424dcf33fbc18c7568d1030981ad1ae8f2a6da2966efbff669	d6741a452d3bff491fb3a40ec8e29cbaf24fb1b400863efe1a7f920543e 99a3939d654e4c424dcf33fbc18c7568d1030981ad1ae8f2a6da2966efbff669 e7fc4527e4cb65e05069b871e06226ce9c9669649ed9cfbad2dcb41cdd9
sha256	9c62f4947a572356f43f71fb55f2b702b78c2e1688c67eff89c36da50137ed21	ed87681e65be35994ea26f4b2287e52438bbeebaac784c291196a6f94c6 9c62f4947a572356f43f71fb55f2b702b78c2e1688c67eff89c36da50137ed21 c201e4bb7b68b4655ab7ac85c8a7c93abe2238ec3d24914d86e8a543b6c
sha256	9eb85367bd59854ccd7b8e13a22deec92bbe746a5de83820d7265055f96da40f	c86add4892f061cc1fd2478da098645876d0b13d3ce3e789f526c5b8ec8 9eb85367bd59854ccd7b8e13a22deec92bbe746a5de83820d7265055f96da40f 6d33cd5b7cfcc4a55583adbf75f578d71d6aa572e93c5a7392ece4dc820
sha256	9f40662ebbd3a848219aa47c149c174c292cea5e62dcc0bd26f12e1bf5ba7d7c	7989df73bafd087f7c689eedfa5e2fe3620ab62d6ff57a3394702761751 9f40662ebbd3a848219aa47c149c174c292cea5e62dcc0bd26f12e1bf5ba7d7c 0882c8a38ca485fe9763b0c0c7c5a22c330cebe86101a9e1ffa5a70c4f5
sha256	9f48ce01ac99033c03e9aa983c09fa273eae0e168e55de8cc364311ae4fc88b9	afbedd7cc082549d5c3fc3926b6b4e55abc3c07f8d994a791893a2fd530 9f48ce01ac99033c03e9aa983c09fa273eae0e168e55de8cc364311ae4fc88b9 dd783bcdbc81bc605cf07545a01273596d4e51b198874253815069cd670
sha256	a0e529ed847b78fd68a871688a7e99e6abc87295c671a3e2d02a61a1e04f5ce9	e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f a0e529ed847b78fd68a871688a7e99e6abc87295c671a3e2d02a61a1e04f5ce9 5c1db6ce5989645bbc8cb8489dee2fb99eba7b4093eaad96cd5a6c692a5
sha256	a28c3c075ecfb982e6e3cb237c0eab1308f023e7bcf207d0fd1f2b4f29791074	bb25240e246a2340e1bca1692b7110277bac30f76dcacd48dd5f2042caa a28c3c075ecfb982e6e3cb237c0eab1308f023e7bcf207d0fd1f2b4f29791074 e5de4a14367d1a7b599d7afae07aa66c63941238ff25f4f17dea54db6d8
sha256	a3c3abcd461d00e1f928e375770e39e3a33f719d7287a2fee661d82ce8de1c56	8fc7901505dd4225ec66cca0ef308f2b6fbe48d37f5055775854bf7a5f8 a3c3abcd461d00e1f928e375770e39e3a33f719d7287a2fee661d82ce8de1c56 SHA256 of malicious samples with similar malformations of t
sha256	a406f0208c914ff28f8e30eda539acb6abd23bbdecf704be4b77615a27f62e8d	e4c2601a5721d5d6ada0f152790ad44aa9ac5badf17e12c7825fb1f46aa a406f0208c914ff28f8e30eda539acb6abd23bbdecf704be4b77615a27f62e8d 552fe8b5fd175822d4479552078331dbfb16881fea9514377a802f3cce8
sha256	ad3af8a7ab469fa930d0873475214c3160f52b17c06f296d6ce9cc6fc92e8a79	bedd75c46680ac65814d9433a04bb9f6bc6f094d66cc33a918f32dcb2fa ad3af8a7ab469fa930d0873475214c3160f52b17c06f296d6ce9cc6fc92e8a79 89a1264bd7facf02d48aff46724a0215c2fb1974d06451cebefdb2ea7ea
sha256	b1da2cb4fcee52cdc94c06325c339ac11a3fb1e399e1ed5a2a55107f5f64867f	0b64d4f4b56d56b5a271331c92484b6ddf8c4eb9f56669ed60545a4c06d b1da2cb4fcee52cdc94c06325c339ac11a3fb1e399e1ed5a2a55107f5f64867f 41c4483cfcc0b5a10504aa137ec3824d139663b7ec318d5e1fb6c9f5db8
sha256	b330fadeb337e9fb5aa9f8046462e3d1d418946fd6237bc252a80a2d4fb2fff7	420fbc39b63de93198cdb1265c1bfe83119c7d4d75d5501465cdd0847f1 b330fadeb337e9fb5aa9f8046462e3d1d418946fd6237bc252a80a2d4fb2fff7 629d1afbedd7cc082549d5c3fc3926b6b4e55abc3c07f8d994a791893a2
sha256	bc4f30177538628f93d57ae1e59859c50409afefe133956ec801c040ab9253f5	7250b6a1ede2472e4acc74366e8a425eaf2c36e3805d36200ad560d0feb bc4f30177538628f93d57ae1e59859c50409afefe133956ec801c040ab9253f5 726f170f13b9a24d409c0c4fbf0a14aff0f3cd1662762230bfaf7a88222
sha256	be81741ae3c7c2c5000785a2573c901068a2906054690ac22119ac794aa9e8e2	7ab68482d329eeac5525ea5f189bcd720d2b2d149db61ab81ae04be957a be81741ae3c7c2c5000785a2573c901068a2906054690ac22119ac794aa9e8e2 cd16e420fbc39b63de93198cdb1265c1bfe83119c7d4d75d5501465cdd0
sha256	c201e4bb7b68b4655ab7ac85c8a7c93abe2238ec3d24914d86e8a543b6c6abbd	4947a572356f43f71fb55f2b702b78c2e1688c67eff89c36da50137ed21 c201e4bb7b68b4655ab7ac85c8a7c93abe2238ec3d24914d86e8a543b6c6abbd 17ae8d128938131ebc944f5d77be7009fd05c8831f88ef3558cc9c00f06
sha256	c343e92d30c1374c631efa8cf612faf5567e8bd66330e1ff58ac9296c3373304	6ce5989645bbc8cb8489dee2fb99eba7b4093eaad96cd5a6c692a53c245 c343e92d30c1374c631efa8cf612faf5567e8bd66330e1ff58ac9296c3373304 ecc9526b380bd109dbcb3d9c4635c1866234d302658758d6ecf4e927a12
sha256	c53bf11adb48a00393c30a0902716e0088f650750349f5966ba3b60a0fa17487	64bd7facf02d48aff46724a0215c2fb1974d06451cebefdb2ea7ea9a71a c53bf11adb48a00393c30a0902716e0088f650750349f5966ba3b60a0fa17487 4a7d6c770c5fdbb32534b535efe0324e3bc25a8bcd3551b7fe0ff3610ee
sha256	cbb58841ef2179e52fcfb918d085503ccf4482014fa1f0714e11fd667de974a0	28619f69cbdfc5158f1682cc304ba6af2a0b425244bcd8c2c432d4a50d7 cbb58841ef2179e52fcfb918d085503ccf4482014fa1f0714e11fd667de974a0 44583aca68ce734bccc79d28f666bdc81a1436c257f035875df15a82f35
sha256	cd16e420fbc39b63de93198cdb1265c1bfe83119c7d4d75d5501465cdd0847f1	41ae3c7c2c5000785a2573c901068a2906054690ac22119ac794aa9e8e2 cd16e420fbc39b63de93198cdb1265c1bfe83119c7d4d75d5501465cdd0847f1 b330fadeb337e9fb5aa9f8046462e3d1d418946fd6237bc252a80a2d4fb
sha256	da1a6747a3329c3a317d4bd7ecf029e89bd76192075f84834563103a54bac968	/server/readonly/fre.php SHA256 of the dropped executables: da1a6747a3329c3a317d4bd7ecf029e89bd76192075f84834563103a54bac968 2e65f8fc7901505dd4225ec66cca0ef308f2b6fbe48d37f5055775854bf
sha256	dbc97df1e5036ac572d8a247a6b073ab1f1dabd20676443598135c6743534028	d128938131ebc944f5d77be7009fd05c8831f88ef3558cc9c00f0633f97 dbc97df1e5036ac572d8a247a6b073ab1f1dabd20676443598135c6743534028 79316e4c2601a5721d5d6ada0f152790ad44aa9ac5badf17e12c7825fb1
sha256	dd783bcdbc81bc605cf07545a01273596d4e51b198874253815069cd6708b2fa	e01ac99033c03e9aa983c09fa273eae0e168e55de8cc364311ae4fc88b9 dd783bcdbc81bc605cf07545a01273596d4e51b198874253815069cd6708b2fa 59011fa80db84cea54bc6ec7f7bc689d916f04e8df9950b259ad5241422
sha256	e5de4a14367d1a7b599d7afae07aa66c63941238ff25f4f17dea54db6d8ac350	c075ecfb982e6e3cb237c0eab1308f023e7bcf207d0fd1f2b4f29791074 e5de4a14367d1a7b599d7afae07aa66c63941238ff25f4f17dea54db6d8ac350 5d6b52287f4fdefe0621d9fadd83b0531f56811937b023ce49e426e320b
sha256	e7fc4527e4cb65e05069b871e06226ce9c9669649ed9cfbad2dcb41cdd9fe94c	39d654e4c424dcf33fbc18c7568d1030981ad1ae8f2a6da2966efbff669 e7fc4527e4cb65e05069b871e06226ce9c9669649ed9cfbad2dcb41cdd9fe94c 1d73428619f69cbdfc5158f1682cc304ba6af2a0b425244bcd8c2c432d4
sha256	ecc9526b380bd109dbcb3d9c4635c1866234d302658758d6ecf4e927a12af9a1	92d30c1374c631efa8cf612faf5567e8bd66330e1ff58ac9296c3373304 ecc9526b380bd109dbcb3d9c4635c1866234d302658758d6ecf4e927a12af9a1 450b2d6741a452d3bff491fb3a40ec8e29cbaf24fb1b400863efe1a7f92
sha256	f07f87ab68482d329eeac5525ea5f189bcd720d2b2d149db61ab81ae04be957a	83cfcc0b5a10504aa137ec3824d139663b7ec318d5e1fb6c9f5db8af8f9 f07f87ab68482d329eeac5525ea5f189bcd720d2b2d149db61ab81ae04be957a be81741ae3c7c2c5000785a2573c901068a2906054690ac22119ac794aa
sha256	f81be30a7d6792e59f5a0ade225472042c9eb9bf59b03f67e85b0642c16e59ce	469ff150c8c821ea3b5b1cda8175d09719fbd7d1359d334dbf17f74adbe f81be30a7d6792e59f5a0ade225472042c9eb9bf59b03f67e85b0642c16e59ce 5957fe5e38f2b2530569e21f040a92b1fb36816b6d5187d8a0ecf0ba84f
url	http://paneltestghelp.xyz:80/eval/server/readonly/fre.php	r users are on or off the corporate network. IOCs Networks: hxxp://paneltestghelp.xyz:80/eval/server/readonly/fre.php SHA256 of the dropped executables: da1a6747a3329c3a317d4bd7