d8826efc7c0865c873330a25d805c95c9e64ad05SHA-1 hash
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Kremlin RATs from Nigeria“One of these files was named “Аналіз проекту.docx” (SHA1-d8826efc7c0865c873330a25d805c95c9e64ad05) and was distributed as an attachment to the email “Електронна розсилка_ Змінене замовлення.eml” (SHA1-7f1fdf605e00323c055341919173a7448e3641fb), which was uploaded to VirusTotal via…”
Indicators reported together
named in the same reports- crimea-kremlin.duckdns[.]orgin 1 report
- kremlin-afghan.duckdns[.]orgin 1 report
- kremlin-crimea.duckdns[.]orgin 1 report
- kremlin-turbo.duckdns[.]orgin 1 report
- 79.134.225[.]43in 1 report
- 95a6a416f682a9d2…01ce241b3366in 1 report
- hxxp://officeservicecorp[.]biz/rnp.txtin 1 report
- officeservicecorp[.]bizin 1 report
- office-service-tech[.]infoin 1 report
- ahjuric[.]siin 1 report
- a3816c37d0fbe26a…1ce5816039e7in 1 report
- wshsoft[.]companyin 1 report
- b42a3b8c6d53a28a…e9ca6e09cbcfin 1 report
- nitro-malwrhunterteams[.]comin 1 report
- office-data-labs[.]comin 1 report
- putin-malwrhunterteams[.]comin 1 report
- kremlin-malwrhunterteam[.]infoin 1 report
- skidware-malwrhunterteams[.]comin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2017-11882, CVE-2017-0199
Thanks — we review every report.