#azorult_170918

#IOC #OptiData #VR  #170918 #azorult #RTF #118882

SHA-256	3cf7272c35aad460bd3c162e4e1499c383ac06dec02ef36e506eb50d9e84116f
File name	QUOTATION N0AB.doc
File size	444.09 KB
Last analysis	2018-09-17 11:17:10 UTC

SHA-256	6767b6974e104025cac4ace55ca70580b8d838415900be85b6c193efc79921a4
File name	PO.jpg (EXE)
File size	316 KB

network
--------------
67.199.248.10	bit.ly		GET /2NhNeOU HTTP/1.1 		Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64;
192.198.87.130	vitani.tk	GET /PO.jpg HTTP/1.1 		Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64;
185.193.38.78	cashouts.tk	POST /index.php HTTP/1.1 	Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
185.193.38.78	cashouts.tk	POST /index.php HTTP/1.1 	Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)

openconnect
--------------
EQNEDT32.EXE	3376	TCP	67.199.248.11	80	ESTABLISHED
EQNEDT32.EXE	3376	TCP	192.198.87.130	80	ESTABLISHED

proc
--------------
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
"C:\Users\operator\AppData\Roaming\test.exe"
C:\Windows\System32\cmd.exe" /c copy "C:\Users\operator\AppData\Roaming\test.exe" "C:\Users\operator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe"
"C:\Windows\System32\explorer.exe" /c, "C:\Users\operator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe"

persist
--------------
office.exe	Diagnose SQL Server performance issues	Syenergy Consulting & Representation Ltd	c:\users\operator\appdata\roaming\microsoft\windows\start menu\programs\startup\office.exe	15.04.1992 16:05
office.lnk	Diagnose SQL Server performance issues	Syenergy Consulting & Representation Ltd	c:\users\operator\appdata\roaming\microsoft\windows\start menu\programs\startup\office.exe	15.04.1992 16:05