APT_MalDoc_RU_Gamaredon_Mar22_1

Rule Info

Description
Detects indicators found in malicious documents used by Gamaredon group
Reference
Internal Research
Score
75
Date
2022-03-01
Minimum Yara
1.7
Name
APT_MalDoc_RU_Gamaredon_Mar22_1
Required Modules
[]
Modified
2022-08-18
Author
Florian Roth
Rule Hash
580a114a4fd8b751a9906c3fe228cccd
Tags
['FILE', 'RUSSIA', 'MAL', 'G0047', 'APT']

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
1
Clean (0 engines)
111

Rule Matches

Hash
Timestamp
Positives
Total
VT
e84fabfbc68428f92098238dd3745488cd05dabc8fa288cc6e383b069c9c53c4
2023-02-08 15:15:36
0
60
d6b13023265997ce2046a4965fdeaa670a3b5acd9e46a6591eca08afd72926b3
2023-02-01 02:03:54
0
59
c8a12d3d58e3ed24d85eab84310ee49a55035244fa654a46d4af7630f184a4e4
2023-02-01 01:37:19
0
60
f616667c07a68ba064d3213695830fd63f74f73573e746f80c61115f5af48f68
2023-01-31 22:37:03
0
61
382a5141610f857f62f3daaf20968b3457dca873f08ced3a71e2a424e9cc2893
2023-01-29 16:41:44
0
60
8e3b83ecf9c796f6c0401a6edecd1c42ca1e79780dfadc0f0f3d72d2d7431aed
2023-01-28 11:53:59
0
60
37c6bb7f07f6ace67849de50956e33d00ee34480d1b62108208c4324f4209f02
2023-01-27 11:08:02
0
59
704067c6057cbd016b1f746a9ebd296f68d5e80127014f8a2acd362636e14143
2023-01-25 17:51:08
0
61
8c500ef2fa204f3286ec8585cc64833ed0d6c48320baccab2a9ccfdad04ea7f1
2023-01-24 19:33:43
0
61
901c04a1b5d611f0c92b8eda544c411076731b4afbe648760d9008474cc8fd5d
2023-01-24 19:33:43
0
60
2b042f31d4f91a0258b8b414ad4c5a6f90b4292f257406baa77ccd7d74a9eda8
2023-01-24 19:33:43
0
61
51c529c4fc581e0e32df4ad544f89859731826048ef626b229176ad15a8670dc
2023-01-24 19:33:43
0
61
56992222aa9c2108cf8b07715d010acd71960e495772bd31b85eca022c8c2c54
2023-01-24 19:33:41
0
61
dacc11e5de8246ab57e4f75730455d03995c34ff5faa4d9afe0c4a803d99d7a7
2023-01-24 19:33:41
0
61
0001633751f67ead2ee19d86ff53a90198652b480a5b72a90ed3c048b1c2c446
2023-01-24 19:33:41
0
61
73b2a0aac36777985acc21b7feb02f089622239c9ae38f5de64d863bcf8d21d5
2023-01-24 19:33:41
0
61
6c2f8f2c67ed0dfe18b3c082408e0ff0b09c145e8008b32c16b5add451077592
2023-01-23 17:34:27
0
60
7d68b0dbcc7fe68dad385b1759e0b99daa7e6aa2c3c119b7bb3aa51961aa5cf7
2023-01-23 16:13:52
0
59
ab0082794bb014151c9f528df54b3050000cc42c11a2fe0ae93d74eb5f6cd8df
2023-01-20 09:15:52
0
61
e7e53119c71170f2e8f157bd37359ac79cbaaa484094786eb4b4047671b2d508
2023-01-17 22:33:37
0
61
e6afe4cd497d8a9c8142e94a633cbadea7f3cb2a6eedb2f49800ea1ff1852459
2023-01-17 10:14:10
0
61
85028fb9a7ca42924a7138d7e6a17d1d897f2a8e0b8614a0981fddcbb45ad445
2023-01-17 10:14:10
0
61
388bc7ba319dcf0f5ac452a9c02451a76ab99f9e883c5d27568f984944fd0cbc
2023-01-17 10:14:10
0
61
e5d4b22ac26509924baa313b154a0fb7945971f5114b948520665f1da7657773
2023-01-16 09:07:17
0
61
2b4f71458b5984f7c0465998a7fae3af1db3982a230b3248b17c5a0cf60bd1bd
2023-01-14 16:30:17
0
61
46f1dec63bf7ea589f16b10c5edc2f073695d7f2214939e2ddac0cce24ba728b
2023-01-14 12:56:32
0
61
2d0d29b1942b7103932d897dbf723b14f7f6487c8daf636241dad0eca7dd64f7
2023-01-13 09:17:07
0
61
d285edeec642b3593aed20c01e9cd25836de3efa9bd58c55e804ba03ecace1f7
2023-01-09 11:14:00
0
61
a8256ba9d037bfad610b379db80d2785fbea9ec07ed1f9f96d9f04b3c5078c08
2023-01-09 07:12:43
0
63
407007f3e89cc4bb81e2808745ef0f3ff3029f5b02d56cdff687157aa27a7107
2023-01-09 07:02:54
0
63
61560aacf31f24191dd1e0b6cd7868c94921c50086062023aa5e8ce470d549be
2023-01-09 06:57:22
0
62
4b0120ffdbaf98a4cdf08a5d9ea716c6fa8f206ce21410f35ec98e623404a6ef
2023-01-08 22:09:26
0
62
bdd8f5af39c55dfe523542dd8217ba66ba6515c2fab796943faf4fc12963e006
2023-01-08 06:08:47
0
63
1f503087924effedb80a546456ffc23b420dc9ae644ba9ee54ddcf4c00ac72d7
2023-01-08 05:46:53
0
62
c2698c721945334e2e4370d836ef65cca5cac9de7831ee29e59be4fa691c8de5
2023-01-08 05:43:23
0
62
f9b35febc48a373f2e9ea7be9c85f0c91da6d7f465817d03aa1ead6905706f14
2023-01-08 05:36:26
0
62
003d1e109156abc9de2849d29a0ab8f8271f932f5328e11d26ed9520eae86854
2023-01-06 07:13:14
0
62
2e77d9cf655f136888fd7c9b39e2c267f4d44204a0e4560c05521fadad039e10
2023-01-03 03:58:20
0
63
5bd0141b721e894376d4e68a79c0cbf079f65b8f729234f95d20a126f0681817
2023-01-03 03:55:50
0
62
5ccbabd04795e8f51980da6f0d505d967d32a5c447c4d4733545db16ad2d4aae
2023-01-03 03:46:28
0
62
8abf7614c9bc6093224005d7bd53fddd169c5e548d6795d547148bdd94793c5d
2023-01-03 03:43:50
0
63
fae5b2f30025a26516392d4354cb20379e428cff537b0f5835b670128905fd4a
2023-01-03 03:20:25
0
63
25b37748782c33f0482c350d65b56b0c67496338bee01a21fc8d6194bcca20d2
2023-01-03 03:19:09
0
63
c575ed29b41a1c4f92f225cfe5c589df7b60d4ccfe95a28d2b846947fe5a7fc7
2023-01-03 03:12:56
0
63
7041f42f4a9a0b7be159dcb558a03748916eef47b25f7dd6275a1eaa6c77f7f8
2023-01-03 02:51:21
0
62
f29d514e0e0e68a5b95f1f3e1a2106afe3ec1fa675896f2940fdca1f27d612b4
2023-01-03 02:44:34
0
62
f5efa84d7a4af12a3998546a527d7363ea70441c133e5457175ebdb0071b4e6e
2023-01-03 02:22:49
0
62
3bb95bb77cc1096c7ee3ad35c27eb245893780472e9804239ef270fe4fd69c30
2023-01-03 02:21:33
0
63
05117fe908378f504f221d74e2eb7b34bee814450b2b65c947bc8c50c7ff2745
2023-01-03 02:10:43
0
63
f75c14b496fddd6bc6a11db86420dbce66bc822e223c44e66f71faf1e7eb4ead
2023-01-03 01:26:33
0
62
d26d2778cdf603b05da9d45af5a9aaf006329fb92d36179739cdcd8bf6051cee
2023-01-03 00:52:14
0
62
2640aad3e755aa0bffad07a8986b22fc617b835d0a05a8cb4becc9ce199e5d5c
2023-01-03 00:49:57
0
63
3fa2622bd7784f89d59cd85d5917aae798f72a62f43a26c63c7eafadf52e4b44
2023-01-03 00:45:26
0
63
6730ae245abde299070e04864c3afa8922ab97b482563516cdb3e2b681374c1a
2023-01-02 22:18:44
0
62
6365715f3276b024a51140a547b36735add4f4ee907625f622b3cc7f5f71acee
2023-01-02 10:20:45
0
63
c90395a8664d4e5e42d03ae7e314e48b3e7877b7b3ec4b5d854855f5972d892f
2023-01-02 10:18:20
0
63
496df967ce952bd9de80953c9ef8e9e3777869ee7a4edf83daf3ea9a70851b28
2023-01-02 10:16:17
0
62
5a343bc8f6e7d107509375034fd30b02ca4d5b24e278d339d75061c844bb6cd5
2023-01-02 09:13:17
0
62
ca922c77599494134a2362572577f4381f2bbf44fbeaaaa3e7297f9338c11afa
2023-01-01 23:09:22
0
62
71e709930830348d094af99fc83ca0da18d0cebce75442982ab26f4c09e69dc2
2022-12-31 13:21:18
0
62
51fb24612a01f2b88feea6d127f585c608411924cfa2f8e48abc3376c05de001
2022-12-27 13:10:55
0
61
b857e1bca15de0b81c9d048bfba74916054caff3972d715cb72f66784fe8fb1b
2022-12-25 14:32:27
0
62
870dd806233c8deb7101da434796f19bf6e2f4f3f6e59940e061b4aaa8f23cf8
2022-12-23 12:42:42
0
62
8570c7fc56a1f7e4bf5da3203fcee7976465c29a72398fbe4cd8cca0f8511678
2022-12-19 14:27:25
0
62
019b37b6be9cf4998c21dc08024731bfd9ca2bf2e87dcbd652de0320e3f38639
2022-12-16 22:22:45
0
62
68f88ef58ee8c863b42755fa7fbb2e9eea905a1debe0089d95aca02e5d855114
2022-12-12 15:39:13
0
59
dbf55a7848a4fb599121a99c4116f22cec0fa5c8d1d688d21cb97cecccfdfcc0
2022-12-12 10:17:09
0
62
268bde70490573cd7ce7193e528f0ea68cc40781739107cac43c8562a199156b
2022-12-08 00:14:50
0
62
afbb51883d02277ea470e23fd8717e851ad95d72d93a9905272bf80f2695ad76
2022-12-07 18:09:23
0
62
0b819dc522579ea5b7d94e419a343594c41e46dc236fc96533c91fefaf918222
2022-11-27 23:01:15
0
62
e076966f13cee63fb465f62631f5df584648bbb5c4e8bfbbba4bc1646e12901b
2022-11-25 14:23:05
0
62
ae278d27692ba29025563cb6fb528f40b095ce3bcc300138f75e01852667230e
2022-11-24 20:19:02
0
61
2dca47846e2ca8462f168bbccf8bf073a308a01b10a6e897933d848492e5307a
2022-11-21 19:41:31
0
62
885cdf13518358ba4433160d01c51c96cf9c892547ffbf362a4300f05c5827f8
2022-11-19 12:12:59
0
61
a6a50c0ec501b64012fdeecc1b1a39cb3cdeb838e8b432f9987beb347188a047
2022-11-18 18:30:10
0
62
0ecf86c515257ecdc4d39136291b0078a028c6d5a41e2dbcbc54f2997b359567
2022-11-18 06:17:01
0
62
6425e440b75ad181dcd5fb05cf78ca66e0b8c1da95d23f66b4333871ea074740
2022-11-15 06:53:45
0
62
ceeb090c69adb32dca5fa58389f633088d2ac20fd15c8c69ab1ff23b534531c1
2022-11-12 17:38:16
0
62
b65cb563d8070e0ac8a8bc7a4afa6cdc96aa3ee713a2123f956619ec29927c3a
2022-11-10 16:02:18
0
62
45118bd377a91bd1b45b69c58761984fd9885e75901c9e3f7522bf3532e84073
2022-11-08 20:19:20
0
62
5988642dc6b88d145baaa9ecbd2499e51b6058f1f37ad5baebdff4d0090477a4
2022-11-08 17:46:27
0
62
2e5b522101e4c2fe5e08be7584ca1a7cdf78160584904d45e8d69c979d940e83
2022-11-08 17:46:27
0
62
4e146bdded065833ce5bcaafc2065a6ad0c26fc96af8b67869c75b5c587f7354
2022-11-02 23:54:02
0
62
6541aba7d0a6d634a2a6d09a125536620eb032328c948cd725eb84307be7f97e
2022-11-02 18:50:04
0
62
24ee88af6bc93574efd931ebd9a7e68622441b3fb2bff18b89f9dfcf4ef80fa4
2022-10-29 18:22:01
0
62
839d12d04c76eb60b765ef485ee99ebf914e879973ef8e6af836a4cd5d15fcc5
2022-10-28 17:30:25
0
62
c97be677a09ee04cf0ff67930652671545368d1558e827b75f65122c6b0075ce
2022-10-25 09:00:03
0
62
9c3fad3ba718d93d66e11ad796c6393b53dbdc0906469cbb2b68bd9a74880390
2022-10-24 16:31:56
0
62
f1140d59b0ba261dad5897c57643e030a0290f024f414798754a9d549b187b0a
2022-10-24 15:14:45
0
62
d92467d8c3226a64b320b13fdd85f3af687fa9849fe9e69c7372d1d3a454911a
2022-10-23 12:25:35
0
62
769bc2a564eec5d2c7eb0e0797a0bf6629a8d2a09b6c68cdb1f81029c5679eba
2022-10-19 07:10:26
2
63
1cb89b8d6b2c4409c50a2daa31ea2b64e73291eff5939aee0b624cd48043a674
2022-10-16 09:33:51
0
62
43ea75d9746026714c7d1ca7b94691503d32b30b263ab953f076734798d89775
2022-10-16 00:07:04
0
62
c27c47dcdcefb7a115317b4a60c629d7524731313aa233381810a36a635483c5
2022-10-15 19:06:32
0
62
c18314578dcc6e666ba3ca09f89def17764892c3511cf6ebcd7260d24d1cd7d4
2022-10-15 13:41:20
0
62
813aa13d9d963b61e2e5d10f1bb9e553359aa44abae3b8a6566a3057ee93dfab
2022-10-07 10:11:02
0
62
3d65c30b760cb51451988c82a749721396ea8a50448af12fe253220e34206e3c
2022-10-05 16:11:30
0
62
4dfba481286ce48a0715a845517fb194d4a80ff535745e65f16c76ff3244bad3
2022-09-29 19:27:19
0
61
5d99dbce95d8007ae0e1c97b02c628f2a3e72bc3b6888cf990e11183d23c2b61
2022-09-29 01:42:35
0
61
09822b235c0cb51b342dc521dbe07eb7f135b2d9b78d81a38286f483a50c57c3
2022-09-27 14:24:46
0
61
acfcf38c577635ed600307889efe3172861e88001e1f8763c1aa73cb86f62442
2022-09-27 10:44:46
0
58
1d3b57f82c8e80685a1495372cc21e6d5e72cc039bc0736394ede23a531cb8ae
2022-09-23 20:13:33
21
62
f2bcd7d6858986862ab3f7cdbe6e936700d1b231b077420312937865b81f0f38
2022-09-20 10:09:42
0
61
89f9c81e0cc9ef49f6490aaf7d41f1d99667e974cb60a414024fce2672990fad
2022-09-18 20:19:09
0
61
195eb7ea85934966244a8a9318eab2d781f36311f331b48ba38ff5418fc53e9f
2022-09-09 22:26:17
0
60
1dff02f2f62f0f0fb382ae94fa32d57603f69a9fef40ecab68211d9d1a9d69d7
2022-09-07 10:11:18
0
59
6ef17bf9ea442c7708b316951f63e46249bf43310049848b9e4de1032cd583c1
2022-09-06 04:28:43
0
60
7c0c330e8dfdf4d2c9701286241cf3ca43e2f05d65ef7213c47b244a9a717f34
2022-09-02 22:07:34
0
60
4c826e3c213f6f0d44a3f50526ce70f3e848b81cf188f6e57dba3924e375998b
2022-09-02 14:59:35
0
58
9ec0360e6a08d4e18378311a78ec256cf8aade76819a54639cdb9e0fc304859c
2022-08-30 11:10:47
0
59
71fd53d6bd5c4d2af27f36b4dd6ed4044367ab3c5c336dd56e91f6863978fe73
2022-08-29 10:45:56
0
59
abe72a9ca1336ccc5a16848330a73db25d66481700d6845ab1afe93dc24dfe63
2022-08-29 10:45:50
0
59
f5abafe6f51fa372888cefbaf97f2f7115b77751d049b8e280273a5d88a347c5
2022-08-29 10:45:47
0
59

Rule Matches per Month (last 24 months)