Index

f7e27693072d7c6c856ac2920f5519e6821ba5ec7f775b1bb6be5ff6b422d895.lnk May 12

f7e27693072d7c6c856ac2920f5519e6821ba5ec7f775b1bb6be5ff6b422d895 O(C)Th

e23f615e4df35819b92658a40c148232ecfcd52c5ac669282cb79606ebd94ca3.lnk May 12

e23f615e4df35819b92658a40c148232ecfcd52c5ac669282cb79606ebd94ca3 O(C)Th

4f1f3897d8e05f1dd6d3bdc1ce340e964d89d27921aa88008a8213e66e024642.lnk May 12

4f1f3897d8e05f1dd6d3bdc1ce340e964d89d27921aa88008a8213e66e024642 O(C)Th

49cfc2c5cdf69a110e3c73217959f1547e49f5b72447a6fd55d8a3b855f15f82.xlsx May 12

49cfc2c5cdf69a110e3c73217959f1547e49f5b72447a6fd55d8a3b855f15f82 O(C)Th

100% Macro executes remote HTA payload

8f355e822222e3b3aafc09f01ddc4753c0a58fb9a1108feee841e1876406486c.xlsx May 12

8f355e822222e3b3aafc09f01ddc4753c0a58fb9a1108feee841e1876406486c O(C)Th

100% Excel macro executes remote HTA

70ebe5271bbf5e96a50bd92541fd7ec892ebfd8442ebafae77e7fa7c70ef5121.lnk May 12

70ebe5271bbf5e96a50bd92541fd7ec892ebfd8442ebafae77e7fa7c70ef5121 O(C)Th

0a5de4c8ce5126b00e17f63cfcf359debd298911f096af46bb3ab382ab5b53bb.lnk May 12

0a5de4c8ce5126b00e17f63cfcf359debd298911f096af46bb3ab382ab5b53bb O(C)Th

7d5b8638766d477192401b0ca88e23f43792b4602437e0461b06b87acf8a4e81.lnk May 12

7d5b8638766d477192401b0ca88e23f43792b4602437e0461b06b87acf8a4e81 O(C)Th

601121c30531ce26c85a232f1e76df6a0eec591296ff711d45912db421d67a10.xls May 12

601121c30531ce26c85a232f1e76df6a0eec591296ff711d45912db421d67a10 O(C)Th

100% Macro executes remote HTA payload

18b72dfaa1e7c24f7320f6279a97ae6a7833f4345c2ffb56cab5a94438780473.lnk May 12

18b72dfaa1e7c24f7320f6279a97ae6a7833f4345c2ffb56cab5a94438780473 O(C)Th

0681ef04e84e57b6b92162bc802a62c97a8f2973876b9cba5c8e17822c1a5a84.lnk May 12

0681ef04e84e57b6b92162bc802a62c97a8f2973876b9cba5c8e17822c1a5a84 O(C)Th

a01774399ef3f471a08f444747251c771e3592640bd2a53ebd0f3fd6980eed23.lnk May 12

a01774399ef3f471a08f444747251c771e3592640bd2a53ebd0f3fd6980eed23 O(C)Th

b1fa7f475f173abdda355f8b07e965ea45348da1edadd4d81a0a5cf099c7df05.lnk May 12

b1fa7f475f173abdda355f8b07e965ea45348da1edadd4d81a0a5cf099c7df05 O(C)Th

b7cd19c474d61fe9db1a25b73c11f90de10660c4140e5790deb1f545f127b91f.xlsx May 12

b7cd19c474d61fe9db1a25b73c11f90de10660c4140e5790deb1f545f127b91f O(C)Th

100% Macro executes remote HTA payload

39973d2b57ad4a212ed116c55053a6e47b49a47a68e9da195c9164fe2ccedc46.lnk May 12

39973d2b57ad4a212ed116c55053a6e47b49a47a68e9da195c9164fe2ccedc46 O(C)Th

5b2751fa6c0c93f8f625375a87c8f235d7b61eb9941633f59cf2ec18352f915a.lnk May 12

5b2751fa6c0c93f8f625375a87c8f235d7b61eb9941633f59cf2ec18352f915a O(C)Th

8fd4a28d6615407181697b7c61c73e534048b11017a6abc855c4bbc32a6f6782.lnk May 12

8fd4a28d6615407181697b7c61c73e534048b11017a6abc855c4bbc32a6f6782 O(C)Th

2a68054ad5cb67012a5c34686f52fde8e838a44ac5235da5f322a8d9c44bd138.xlsx May 12

2a68054ad5cb67012a5c34686f52fde8e838a44ac5235da5f322a8d9c44bd138 O(C)Th

100% Macro executes remote HTA payload

9434082d535918fd5deb275563682dc120ddc9d1b64b037c1335f746ea886170.xlsx May 12

9434082d535918fd5deb275563682dc120ddc9d1b64b037c1335f746ea886170 O(C)Th

100% Excel macro executes remote HTA

37957f36f557e6f9088a759beec868e959b85379ba29bd98839e6bf016155890.lnk May 12

37957f36f557e6f9088a759beec868e959b85379ba29bd98839e6bf016155890 O(C)Th

7a38eb6b2bc0f8a47735524e3a8f18de2397d951ee185ac8c22e8fb6f9fd15ba.lnk May 12

7a38eb6b2bc0f8a47735524e3a8f18de2397d951ee185ac8c22e8fb6f9fd15ba O(C)Th

6353445eba5c661f3270f36c3d350dac25dbd93ae03d9f9d77ed6b28484b74d1.lnk May 12

6353445eba5c661f3270f36c3d350dac25dbd93ae03d9f9d77ed6b28484b74d1 O(C)Th

5c666d8958308282a4f3e01141fbf0516b58a5140b3710030d1a49ff22d8a534.lnk May 12

5c666d8958308282a4f3e01141fbf0516b58a5140b3710030d1a49ff22d8a534 O(C)Th

4c24db024f8513ac5eaffa4e98740c57b4f96a81dd8f1c491ee2e698042e06a0.lnk May 12

4c24db024f8513ac5eaffa4e98740c57b4f96a81dd8f1c491ee2e698042e06a0 O(C)Th

d5f06b2528c34e2808eab60247903f55c1537a195900dfe55766a498819cd744.lnk May 12

d5f06b2528c34e2808eab60247903f55c1537a195900dfe55766a498819cd744 O(C)Th

4d9ecb2e385784195c4d2d0060bd8b848ae493033464fcf8fd0fde436f1afef8.lnk May 12

4d9ecb2e385784195c4d2d0060bd8b848ae493033464fcf8fd0fde436f1afef8 O(C)Th

e7bbe77031cf98c3357397283d56470afa73ac3be2ca1a780d26ea5d63ec221b.lnk May 12

e7bbe77031cf98c3357397283d56470afa73ac3be2ca1a780d26ea5d63ec221b O(C)Th

39c9aa7404600ecf0fabb4f1bb00dd5d093af9e0188dc9c65786d0fdb8437572.lnk May 12

39c9aa7404600ecf0fabb4f1bb00dd5d093af9e0188dc9c65786d0fdb8437572 O(C)Th

8baef47a3e9512ec5aa8d31a2424e08e1d8cf493dff8fccfed06b46f44ebeec5.lnk May 12

8baef47a3e9512ec5aa8d31a2424e08e1d8cf493dff8fccfed06b46f44ebeec5 O(C)Th

5d4e72937594ae603404f140809456f8654e101087ae1dc53594d8e2f216aa26.lnk May 12

5d4e72937594ae603404f140809456f8654e101087ae1dc53594d8e2f216aa26 O(C)Th

e62e3679eb063988b7898243d8d050a685916809c985194b5afcedb55fbd9d1a.lnk May 12

e62e3679eb063988b7898243d8d050a685916809c985194b5afcedb55fbd9d1a O(C)Th

bc66b12c8b9dce2d58fe3e899b97f51ac009f26c21ea1b88fcf117214b1f13f2.lnk May 12

bc66b12c8b9dce2d58fe3e899b97f51ac009f26c21ea1b88fcf117214b1f13f2 O(C)Th

f588c5e220cc63812256f268faf77c2580362a2046b775ed85898e1e3eb4b9eb.lnk May 12

f588c5e220cc63812256f268faf77c2580362a2046b775ed85898e1e3eb4b9eb O(C)Th

616a9a7e8173760e7251e0697e8a99d37eafb8f5535b0a11bedab3c99012650d.lnk May 12

616a9a7e8173760e7251e0697e8a99d37eafb8f5535b0a11bedab3c99012650d O(C)Th

aa0247bc913c0c91d82e8b972163c23a219800a904c360871bd7de11cf2e0a6b.lnk May 12

aa0247bc913c0c91d82e8b972163c23a219800a904c360871bd7de11cf2e0a6b O(C)Th

796e81a3d6a5b39d216066c283609793d893078911d3fb13e7dc367c5ac1973c.lnk May 12

796e81a3d6a5b39d216066c283609793d893078911d3fb13e7dc367c5ac1973c O(C)Th

16184b7deefa162348cc37c1836dc9d2d63aab5887ae740f7cd2c67672b4d2cd.lnk May 12

16184b7deefa162348cc37c1836dc9d2d63aab5887ae740f7cd2c67672b4d2cd O(C)Th

a310a9ddd758cc9867324c58dc2d530e4913bde049315c2f28b18dac4e3cbb62.lnk May 12

a310a9ddd758cc9867324c58dc2d530e4913bde049315c2f28b18dac4e3cbb62 O(C)Th

7819f1ee817e7cea45772e503dc563c14ec38142a9e1ab1708a7dcb53f5db728.lnk May 12

7819f1ee817e7cea45772e503dc563c14ec38142a9e1ab1708a7dcb53f5db728 O(C)Th

8a38fcf70b8700f6a97f9223534392795f711c5d1f6355d4c853f2159404dacc.lnk May 12

8a38fcf70b8700f6a97f9223534392795f711c5d1f6355d4c853f2159404dacc O(C)Th

753e924fe56bff0d46534e9b0598610ff4c37397bdb9ee845ee7d46a795bdbe2.lnk May 12

753e924fe56bff0d46534e9b0598610ff4c37397bdb9ee845ee7d46a795bdbe2 O(C)Th

1eb0539edb2944fa8c24e31c9ef709f4ba37172ef03172bb50eb6a03a376de0c.lnk May 12

1eb0539edb2944fa8c24e31c9ef709f4ba37172ef03172bb50eb6a03a376de0c O(C)Th

2094b6f638d13158119b43475f1010c08dfda3741b4dfd312f9e153e96d1281f.xlsx May 12

2094b6f638d13158119b43475f1010c08dfda3741b4dfd312f9e153e96d1281f O(C)Th

99% Excel4Macro/Autoopen

33e7a71ea583442ca26774505d1ea84c2948fcb0f0f6686c0a33a7e0e06004dd.lnk May 12

33e7a71ea583442ca26774505d1ea84c2948fcb0f0f6686c0a33a7e0e06004dd O(C)Th

b32319b351de1a41203b1966dfb7232730b96aacf88c096264bbe75e86861da1.lnk May 12

b32319b351de1a41203b1966dfb7232730b96aacf88c096264bbe75e86861da1 O(C)Th

776134c134534d0dc096adc95eff7bf3e9f0a029436dd3e7e50438defe647762.lnk May 12

776134c134534d0dc096adc95eff7bf3e9f0a029436dd3e7e50438defe647762 O(C)Th

150be267850e2cb2af92be68e8966204bfba255b28e0dadd2d193816892129c6.lnk May 12

150be267850e2cb2af92be68e8966204bfba255b28e0dadd2d193816892129c6 O(C)Th

e912146fdbd295b3839df08f05fa55d494eb08e358632af3ec4b8839bef95e2e.xlsx May 12

e912146fdbd295b3839df08f05fa55d494eb08e358632af3ec4b8839bef95e2e O(C)Th

99% Excel4Macro/Autoopen

c14c4efc5f0c949dc8258448d42df2f7fe9e3454b3fe41cd7f16dd2c20c0b84e.xlsx May 12

c14c4efc5f0c949dc8258448d42df2f7fe9e3454b3fe41cd7f16dd2c20c0b84e O(C)Th

99% Excel4Macro/Autoopen

7c6be664ab81c2511d952c49d9c008464d5ac5dfa8b1650caf63d1d6c4c5348f.lnk May 12

7c6be664ab81c2511d952c49d9c008464d5ac5dfa8b1650caf63d1d6c4c5348f O(C)Th

48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0.lnk May 12

48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0 O(C)Th

5e999b1c7a8892fee8592d49a10896b212310c1cc3c0b4ece1cc220b9ac1c4e1.lnk May 12

5e999b1c7a8892fee8592d49a10896b212310c1cc3c0b4ece1cc220b9ac1c4e1 O(C)Th

9db0cc953a8be87d9f214c1ea5e672bf6e9a2bd36e6ac56b6d6b75f7d868e128.lnk May 12

9db0cc953a8be87d9f214c1ea5e672bf6e9a2bd36e6ac56b6d6b75f7d868e128 O(C)Th

d7c05bd68e8bde3d13aa7dbd6911461104d06715da15d3ee7f75136fa8330cc2.lnk May 12

d7c05bd68e8bde3d13aa7dbd6911461104d06715da15d3ee7f75136fa8330cc2 O(C)Th

ab8ca85b3465e12c84b62bfacd66e851fb0d86574338226cf11a619405f93c4b.lnk May 12

ab8ca85b3465e12c84b62bfacd66e851fb0d86574338226cf11a619405f93c4b O(C)Th

7459fec70ee54eaec172b2bc6e770df1fda874769678cd71db8e66e9567142d9.lnk May 12

7459fec70ee54eaec172b2bc6e770df1fda874769678cd71db8e66e9567142d9 O(C)Th

66128288042993e79c4a4a27f9bf360cffa60c6d869f1a4e957cc5729e2e48ff.lnk May 12

66128288042993e79c4a4a27f9bf360cffa60c6d869f1a4e957cc5729e2e48ff O(C)Th

671d5954a17da18cd6e425feeb6f7ddaaf18b8d5a670ece9d5355476e366b467.lnk May 12

671d5954a17da18cd6e425feeb6f7ddaaf18b8d5a670ece9d5355476e366b467 O(C)Th

84aff5bb7885a64e458bc64619069e254f06fa7f227dab7580ec9bdde59cca20.lnk May 12

84aff5bb7885a64e458bc64619069e254f06fa7f227dab7580ec9bdde59cca20 O(C)Th

5bc20e018b1f05fdad723ffe853821c37dbc3e1d8b760a0bb110bb91b99e914d.lnk May 12

5bc20e018b1f05fdad723ffe853821c37dbc3e1d8b760a0bb110bb91b99e914d O(C)Th

810abc023b61d68ba434bc85cecce55dbfe249e01900bb0f7621169eb514821a.lnk May 12

810abc023b61d68ba434bc85cecce55dbfe249e01900bb0f7621169eb514821a O(C)Th

d8411e1a70e9b96000c41c5d6528c206f6176a0723a05cd0f95c0a4ef5cb4353.lnk May 12

d8411e1a70e9b96000c41c5d6528c206f6176a0723a05cd0f95c0a4ef5cb4353 O(C)Th

f3feb7996332707cd6b8f624e8dfb4bc461345167f7c11913165ac5cb1cfd4f6.lnk May 12

f3feb7996332707cd6b8f624e8dfb4bc461345167f7c11913165ac5cb1cfd4f6 O(C)Th

d7f0eab755f92fced33f69aeda254256db0e4ce11995168e8a9d47a548e70058.lnk May 12

d7f0eab755f92fced33f69aeda254256db0e4ce11995168e8a9d47a548e70058 O(C)Th

9c0dd70965a69ae5e4212752c33dcf723b7db4c963a4567a6b72d474e6adb764.lnk May 12

9c0dd70965a69ae5e4212752c33dcf723b7db4c963a4567a6b72d474e6adb764 O(C)Th

d9dc065429bfb8aa04f21b6fc64076001655cc25e7bc1debe552d3a517c75a60.lnk May 12

d9dc065429bfb8aa04f21b6fc64076001655cc25e7bc1debe552d3a517c75a60 O(C)Th

98c4871c4f778b4e1611f0b9f3162701da8c0839ecd1c9851880548d89bc93db.lnk May 12

98c4871c4f778b4e1611f0b9f3162701da8c0839ecd1c9851880548d89bc93db O(C)Th

97bb0bac2f6e7696c52a71b75db138986a5d297a03fefdcdbde464b1d45139f7.lnk May 12

97bb0bac2f6e7696c52a71b75db138986a5d297a03fefdcdbde464b1d45139f7 O(C)Th

60aed4c742dd443a4dc9e614a8f5364e64ec2d6632324333a11baa81a1dbcd87.lnk May 12

60aed4c742dd443a4dc9e614a8f5364e64ec2d6632324333a11baa81a1dbcd87 O(C)Th

c4919fddd43c203fef53a99e165c08dd26cc595693d293af25c11d21baec49de.lnk May 12

c4919fddd43c203fef53a99e165c08dd26cc595693d293af25c11d21baec49de O(C)Th

db09f790439c46f84ac2de48dd12e0e89b6d0a87224a2d472a172553761f0691.lnk May 12

db09f790439c46f84ac2de48dd12e0e89b6d0a87224a2d472a172553761f0691 O(C)Th

3f7b79e3d05e971ca89bf337532969579f9f88d58a057765c10566ad19655d48.lnk May 12

3f7b79e3d05e971ca89bf337532969579f9f88d58a057765c10566ad19655d48 O(C)Th

860878b86ec6c991a7accebb5c48ae8151af176f0ae25efdc2613ebdbb1c04d0.lnk May 12

860878b86ec6c991a7accebb5c48ae8151af176f0ae25efdc2613ebdbb1c04d0 O(C)Th

5ec7248ad671135f1269228d0852d95da19271ea6a6e945ac44fdd8842922577.lnk May 12

5ec7248ad671135f1269228d0852d95da19271ea6a6e945ac44fdd8842922577 O(C)Th

a53e7ce0bbf24cef74818a3339d60ad2c6fc5afbebb556c3e971e001ca9f5952.lnk May 12

a53e7ce0bbf24cef74818a3339d60ad2c6fc5afbebb556c3e971e001ca9f5952 O(C)Th

d6e6a28bc9dc59ed774cc9586395b2ce7aabd447b06bf5fa60a3681a47f0bf39.lnk May 12

d6e6a28bc9dc59ed774cc9586395b2ce7aabd447b06bf5fa60a3681a47f0bf39 O(C)Th

54acc2a76c5a4ed21ca0166ff1b2d165b21020190e4081d35e2493e03eb0d5a5.lnk May 12

54acc2a76c5a4ed21ca0166ff1b2d165b21020190e4081d35e2493e03eb0d5a5 O(C)Th

cb3d30d9724e1505b3017051950fccb63b85d3380748abffbcd1f7054b3bdf51.lnk May 12

cb3d30d9724e1505b3017051950fccb63b85d3380748abffbcd1f7054b3bdf51 O(C)Th

ff6fb2c5a38153fc77b94121941d066acbc19c4342cc8208fc5293151a22ff29.lnk May 12

ff6fb2c5a38153fc77b94121941d066acbc19c4342cc8208fc5293151a22ff29 O(C)Th

eeb52f78463b9b37be129b476e0c9030fc0084f3a3f438304d52ea040a440b8a.lnk May 12

eeb52f78463b9b37be129b476e0c9030fc0084f3a3f438304d52ea040a440b8a O(C)Th

9ca18c877fe3d8588bc93f7265307291d0fa47b1b9e9ca077b7b40f6972fee61.lnk May 12

9ca18c877fe3d8588bc93f7265307291d0fa47b1b9e9ca077b7b40f6972fee61 O(C)Th

VirusShare_c31b953a8214cafded0f7ea91c68cc72 May 12

7d800246bfd0365c6862d9b8d69d94c0bfbb8815047a002a931882a29d5f49ac O(C)Th

VirusShare_f7026ec567ce322b9532ca135b2cbf57 May 12

563ea45183ed63427c239baa57dd6bd936a112099e1880e0051cb8eb4461df6b O(C)Th

85% LNK targets executable archive

VirusShare_25b3733890a6ae49178750e843fa4467 May 12

4740b685ee2c0193e6dfd5d8d16878c2b5a4c262b10754ed06d5c493de88f0cd O(C)Th

85% LNK targets executable archive

VirusShare_878fc5a29604a3ec31df567f2e99d6d9 May 12

feebb12cc2a268c0a4978bfda79a95150cf9a80eeeb0e85d7bf1c8378bf5c746 O(C)Th

VirusShare_95fad3664c41e0c2575a1c5db46f4407 May 12

363ff4d5984eab4dcfc6eea874c03f60d29590b8df0171f685d81e13bccc8bc8 O(C)Th

55b9da2a2756eccf09093ef5fa7637f616c86fef999094bc7d8432a1f1250533.lnk May 12

55b9da2a2756eccf09093ef5fa7637f616c86fef999094bc7d8432a1f1250533 O(C)Th

VirusShare_702b37b14ede1183ee7ef96b91c13c68 May 12

5150a425693cd106f30c9ebc5c9b5118b4c0b901c585e737fe7cb7118a497e59 O(C)Th

85% LNK launches temp payload

VirusShare_8fec83c9da8a6767f2f33af4ce696607 May 12

2ec83988a15d9a9df404fd682b9dff390cee03c3fa2b3e32f9e8ecbfcd2b3a13 O(C)Th

VirusShare_bade7bc16366ad4c893ba406a4a7e2bd May 12

d371863fd24cc1d0f727132bdd4877b9fb44e3c07fbeb5861091a40a0c01d92c O(C)Th

VirusShare_d1638d827c700ae26561dce7895699ae May 12

4957830f838a5ec54fd1a9728e7f0be6a3b02e7f5be3d50166babbfc8f150c44 O(C)Th

85% LNK launches temp payload

pws.rar May 1 The-Awesome-And-Dangerous-collection

d7a82e1453dbdf29cd2b23508f85d90b6dd79ec2cfb2004210de6e537e44b96e O(C)Th

100% Web shell with command execution

PHANTASMA.rar May 1 The-Awesome-And-Dangerous-collection

90ba00b4f301b895e907f43d9be909d4cfab85ce45700580817f1773b1d8a4fb O(C)Th

100% Contains remote shell backdoor code

6574309e9e7c496936683f6375b8ae940039249fb2b550d55ca914ea0daabf8f.xls Apr 30 Dike

6574309e9e7c496936683f6375b8ae940039249fb2b550d55ca914ea0daabf8f O(C)Th

542588ecbd4f6b1aaac1cba16cfdc89dfd5a52d815e6772404bed0de423bca28.xls Apr 30 Dike

542588ecbd4f6b1aaac1cba16cfdc89dfd5a52d815e6772404bed0de423bca28 O(C)Th