APT_RU_MalDoc_Feb22_1

Rule Info

Description
Detects indicators found in malicious documents mainly used by Russian threat groups
Reference
Internal Research
Score
75
Date
2022-02-16
Minimum Yara
1.7
Name
APT_RU_MalDoc_Feb22_1
Required Modules
[]
Modified
2022-07-26
Author
Florian Roth
Rule Hash
aebf6635f65862aa1fb99e4ab417cb39
Tags
['APT', 'RUSSIA', 'MAL', 'FILE']

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
34
Clean (0 engines)
63

Rule Matches

Hash
Timestamp
Positives
Total
VT
a0fa98d47a542a2461f33db47881ef40de6185be63c4ace7db1e5588f19184f0
2023-02-08 03:59:28
1
59
f6e13463b31ccd62a6455e8d973fc43301a20c1a8c365be84a7e33a7d6a0e22a
2023-02-04 02:50:27
0
57
b2640ce77aef528d6b8f9280626f363cc3763984aa11437cf5a9cdb15cf719ae
2023-02-04 02:35:11
0
62
af3d6800090ba0421f7f29a6bfe0a290f20e31edb71318a4fdca9289d5fe8648
2023-02-04 02:28:55
0
59
00450e9a32012137b5ed59ff6c6b1553664454319c1dae96a44cdc4078f5a015
2023-02-02 06:46:21
0
61
c8ee4fd9b94fa9e7fba83e4a1cb198ce2e2b58ceb0517efc02b74d7bcfba9427
2023-02-02 01:22:36
0
61
e76b5eb596987eda9438abad7bc7c36f7e7b6cd1a2946f0d8f87922f3d955dcd
2023-01-31 14:07:39
9
60
c9dba1ab66f1cba3e1f393756e395abd3c7d9b0822a78ced727cfba7a3fafdc8
2023-01-30 04:19:22
0
58
7ebc5f1decd7298991cf1a70dc2e7a1999a65696a145728c3e0a99cadbd84b32
2023-01-25 04:43:56
0
55
447a332e8877a8bf56af59f649517fe3912cf02ba42bd83f91e9a1a1f225f3fd
2023-01-25 04:42:46
0
62
5c954e98ce36154a1b1f1bbf8a40bf4b5b3a74488daeaf23252946c9a3f353fe
2023-01-25 04:41:35
0
62
03f10c832fd232235e25c69c019efdeb805303a0213c423bc017401c4e92cb38
2023-01-25 04:16:22
0
60
ed8bf705f7d5611fba53efcb2625f2380c3c2c258ce8d3809461f59350972d17
2023-01-25 04:15:15
0
62
94145ff623f37e913efc07f057a6f69e9c33f6db84896e894697218eeb6ee6f9
2023-01-25 00:20:35
0
60
7377420bbd3451f48ba6d065efac2dc5731d5add63304b4433d32c5c6085e408
2023-01-23 04:35:43
0
62
d7b24965f145d2158f0ef4db58e42666ded653cbb923d7b7dda2ef97bcfdc366
2023-01-21 07:45:56
0
62
b23142f94c0e3edfa180669396cdbb5c9c14b4e3e749730091c261919edee3f2
2023-01-21 06:42:05
0
61
d5c4065fa06d0d25dbb606dfa828e544c1b5e144954bf306610391d3856ab14f
2023-01-14 15:41:34
0
62
06d8b7d8791ab7aae7a9c63f4496705a8c746e50acaf4f6d2c2971df81fe15fb
2023-01-14 14:42:02
0
62
ab317cb2304cbaf42f86d17e9711575edba83e6c389320a6bb41676afeb36008
2023-01-14 13:28:25
0
62
fc45b83019eb6e1d52c1bc9fffdafc5ba687194ed6694ce24a7d7fae487b6e0f
2023-01-14 07:59:36
0
62
b3ba696e88f14db307f7c2ab41685ed65b22b8b3820c4ab6072b89ed2888ec14
2023-01-13 18:06:56
0
61
d8c8bd512e92a3d51b015c5c2b23cbd957f716d31fb0f310c6db3a650e3a0c7f
2023-01-09 07:11:12
0
62
c2dbb19b0d49f2416d9324fd3b7aefbffa55ffe2732a031f1b934759fb972d41
2023-01-08 06:08:06
0
63
ae7d645bcf2f8858defef690ad5e0029096f66fd80937be2f039aa9ce93bf6a8
2023-01-08 05:53:42
0
60
dff4580d9ec03f046f781315feaa14ffaa8f174bef6d997767dcca13a776f8a0
2023-01-08 05:45:43
0
62
ce92ae664cfdef5a9db5b7b600e10e1b8af8be4a88248fc9def175d3787983ef
2023-01-08 05:39:52
0
63
68c0d672b34d17c083a68497eb97f269bd11f783a1d5c0300294cbe941d8771a
2023-01-08 05:19:43
0
63
ea4820fd1edde9175552f3c82f75d27d4c319dc4c258361a08b2b9663574dd19
2023-01-04 12:33:08
1
62
adf0b11fb64ca00b927d59dae659785fca1cfac2191798a6525f17602d06efff
2023-01-04 12:33:08
1
63
cf2fa1667e5aa8c3122a8f5568be30342160010e563fded915a4a1f4e597a3bb
2023-01-04 12:27:59
1
63
9d00fc5a0b44d7567dbddd055f1835759a4c310a039ddf61581d0e29865eff40
2023-01-04 07:18:10
4
58
583b41deb23301217d72337171c5d059fdac3f4bcc6125196eb78202582f1809
2023-01-04 04:29:36
1
63
f7a44f55784c8e7c39229a07b213e2c3a46cedf747272ba17611530428cdb4f6
2023-01-03 10:20:49
0
62
e56d8f01a8e539aa27bf748e925b2af52cefe365c728fb0eb7254a7c1ec72d87
2023-01-03 03:57:07
0
63
369f504f252a92af9464e834c3309406c5b4e7d4a73f6167bc45c6f764f4f324
2023-01-03 03:27:27
0
63
54c64ae9840d230db749c6d134106953f2e50c2a2d60c1b76bbe46acb8d33411
2023-01-03 03:07:09
0
63
2267c7d7be29983fa1c5037dec16d63b900d059b66e9e80f2f2720d7bfd9828b
2023-01-03 02:42:38
1
63
7065ecc0f0c5ad819cf28916be933ea585b1acdf384effe085597efa356996e2
2023-01-03 02:38:39
0
62
65321d5ad36b5d20ff30e24493be315ee39cd2c9233c9834e534fd17652457a5
2023-01-03 01:27:36
0
62
539a20b82907ddf27a9f737911ba86d29608a36896f2b5072e2b319171557c9e
2023-01-03 00:51:06
0
63
046b05bcd5820b73af94b73459e4ae5799ad5f378418807822e88a8c29986fa6
2023-01-03 00:41:56
0
59
b4ae71a3650eb59028bf0621ac7b267facfa27b71a363ed760bc467d6e3ca1a2
2023-01-02 10:16:02
0
63
50802742844b412fc722fc96dd174a3995c550532fc47bd5b756537d195bcaee
2022-12-30 11:16:43
0
62
f70ff4714ce0a8cd9d55e7efc78fe60930a1dff003a4968ab339a6215064984d
2022-12-19 00:32:34
2
62
4c31e3ce23c6ba8f79454dcfb51973ce22754670719f4e5dc456f07e8aee62f8
2022-12-19 00:32:34
2
62
ef0cc5932db0158e7b7446d792429db828a502c0c05f429527ecd7e358567559
2022-12-19 00:27:59
2
62
bd79a6c87bc91351507daf7bc632d474d819253e7e0ccd3fcd8190219da12600
2022-12-18 19:09:09
2
63
da96736a9e0df42a7fd4bab0d432854b1cb83dfa03c9b71a48250f7dfa85ac85
2022-12-18 19:09:08
2
63
e143e8f5efa134c3f0eb72584033511d435a6001fe32a70efd758125ea5da9c3
2022-12-18 19:03:54
2
63
9cfa21458df312867d9c11fc4079334f72b9ca27ffd9cf8d682487f1a695b425
2022-12-18 15:36:02
2
63
25a55c84ee2d306253348142db415c150deddf72d1e705f3871871329d88c991
2022-12-18 15:36:01
2
61
d39dfe8c9850f838663bb45c353b8ce2276dfcbc64e56ebb830de5188c4b01bb
2022-12-18 15:29:12
2
63
7e8031e3ee6c7164c1118cf0af33d73fc2e16b2d3d9fe6526220a6c0b9709616
2022-12-18 12:29:19
2
63
3d91f687ee32f8ed1c71de906bcff9e4b86b5bdd134a900ee7f6a2dc0003c077
2022-12-18 12:29:19
2
63
256b312f6eeb00fb0072c6193618da6fab7402be79d5a87ce1a40bbc4f4c9392
2022-12-18 11:26:49
1
63
faf1c5e17371c0fcddd28966aa715beb45a4f7381d647129163514301d796d66
2022-12-14 14:08:07
1
63
a2f8b0a157346bf4b31791d1790b522b050d6cf89cf6d7b6fd122775dedabd5e
2022-12-12 03:53:35
2
63
9588ef7713ca144032906b8ffb463a7f41f04879e38807265efa27823042de2e
2022-12-12 03:22:48
1
63
181c20ea300ffbca758417d41bffdfe3abe42277456c57bc11beb594ee968177
2022-12-12 03:04:25
0
63
1f90ce6470b86afca450264204975fbcb6246b3f4c4a6ff46347e75947de1847
2022-11-17 04:48:36
1
61
4b97bed6ff4c4c00e81da1157c6fc102e61a58c76114bf70d345815b00490b79
2022-10-30 08:18:49
0
62
a9ac3fbd5ebdaf86905b3ecfebb42c06812bcff94eaf6a3e906f72dc024466d0
2022-10-25 03:16:39
0
62
185d6f70438ecbf5c2d42e8da4ffbc743fd943ee911866056708b86802f7305f
2022-10-22 13:01:15
0
58
8ab3195eaac31411c33dee1487ebb3b3faf426733737b93a6cbfe0d81f4e2e5b
2022-09-29 04:42:33
1
62
5cdb91d51090e1a2075706e7364131a473962ebbac3195597cb786e0e67f55c0
2022-09-29 04:36:39
1
62
1a4d42bce00a9dc35d5c74a6719ddfcd1e0245610645d4ffc882cf313645d3d4
2022-09-23 06:42:57
3
61
65eb04193c28f68d5792b52ed37f0ae4a3eeb361f3802dd252f5b79691713f36
2022-09-16 05:44:14
1
61
5ea2b5b16608bf6750d50ac8e8df1481cb0df00701c8b8db65ab4af0402646b2
2022-09-09 11:09:37
28
62
3f4323e9f32be980965ed47af6737e893bade1e4b415bf53b8ebf5239440c15a
2022-09-04 19:14:54
0
61
1e403c34502f5d41a2ca5631ae8acf9c03cfacf003dd9820f91e1bfac074bb30
2022-09-04 19:14:44
0
60
c600db28659d9ac704c37a0d3aaf532069dd3133f708a8dcfe37ab2716081818
2022-09-04 19:12:36
0
61
2007abaa3141f19d9970e6576e1fa772930343cb8c9ed850332b284c1a9057c4
2022-09-04 19:12:33
0
61
13de0a68bda18a7d8707e25d0bc82428599e5d95ec243002f853f5df6f996095
2022-09-04 19:12:32
0
61
a54e0dca4f4705a17dadb23d020c77a1f19c96cc3cef637d492c84e7b3cbb48d
2022-09-04 19:12:21
0
61
dc1c76ab8e9756b7c3503b295a2e8982e12811dfe57ac2790d57f6f8fc143612
2022-09-04 19:12:20
0
61
42a106f5cfe66efac92947da2a8ca32664cf0c98f4031f580abe141c003519ac
2022-08-20 04:09:11
1
61
64a47045677834090a0b816dfae5a65f3c0689928eb070d11458cda9188c3e28
2022-06-17 09:35:18
27
59
f463b56f4024d7e266a3123e5c544da238378fbb5e82277970bf3051d70e9fcf
2022-06-17 09:32:45
26
59
10fdeb5d6e700ff32a76cde598eaf2926cad6ff13c32de46d51bce224527e951
2022-06-16 07:39:04
0
55
09de66b31b3a3b2813eb872d41b17e8271ce7977988e99c4e2430f703f4dab73
2022-06-10 20:10:22
0
58
3f958cf63dd3b119726f4da15d12127724088ee2a608a5d314bfdf808fb1624a
2022-05-29 07:06:23
0
59
c1706328c732e25a2be40045299cede762b4dcc4152bc1ac9555d24e1e7e84ce
2022-05-26 20:10:48
0
58
d6db867a31c29b45be5f6d54a18584cb36f3bc8b78eb9ff1625b9980e1f9e65a
2022-05-18 21:49:40
0
59
a2ac3c30a04ce6dc83581d9e9b434c0c18085bf593954ca0302942a85f96374f
2022-05-12 21:59:36
1
60
ae8c8f3883dabebd144bbe17d94907bdf94443cfce3c636fcd829861896e58c9
2022-05-12 07:56:55
0
59
91acd4df3c12b91e05b125d98f95a88bbcccb703323c192452ab53e9d6ce91c5
2022-05-12 07:56:55
0
59
f5a3a75ecb39cdb88b46e89f7d5d59a2b2557bf291a767ebeebcdaf1857e0dae
2022-05-12 07:56:55
1
60
728fa25bc0f3796bc4b7ec82386acebea7eeb86ad50637584846d7cb9bc8ce60
2022-05-11 08:44:08
1
60
cce25a5306d06fd34a6bf8a389f37d82f46db4ce521c20822d57318fb2c652ce
2022-04-23 04:30:16
0
58
8670ab5cbffe2e62df9e67b2608fccea9aa3397344278a5dfdfd328794d4c201
2022-04-23 00:58:32
0
60
e8f33eb7d849484e5013ebfe2cf0f546369d1594056509df491f57ff5896bf9d
2022-04-18 00:50:14
0
59
7f9c4f57a2801cf7f155ba0fde3acdd545c13267d6eaee2af9d3d8ca488355ec
2022-04-14 06:38:07
0
60
8b2047a50f6dcb86eee81bd32706a5d2701423a2a31b8fbe47c71119ae2c105e
2022-04-09 04:34:03
0
58
76c9c9ee41f1a02e48955337d17954e3c38abb363a51301ade631abfba4a5b65
2022-04-02 06:17:05
0
57
bf948c2c89bd866ee36e11237ee41e89d7452f13717af30cdbed910d0be26265
2022-03-21 03:57:12
1
68
d594fb5faf73dbae0e1589436c0058b107f15c744b67fe69e359edfba7f5055c
2022-03-10 02:36:58
0
57
b1fc83f8ddffb4b49f9237691a1ffed8e6e887671b8b1df9a0a03f3937d63c2c
2022-03-10 02:36:39
3
58
ff2c8cadaa0fd8da6138cce6fce37e001f53a5d9ceccd67945b15ae273f4d751
2022-03-10 02:35:23
40
59
e26724415dc9eea9189a53bf91e17b352903d1a9fa9d57f594000d64f8553a5f
2022-03-02 08:15:34
0
58
f3a39c1bb4475190f8b755422876c3eac698d0864bedc647115c134ec12d5a84
2022-02-17 03:58:39
0
59

Rule Matches per Month (last 24 months)