MVISION Insights: Operation Armor Piercer Targets India with Commercial RATs

Technical Articles ID: KB95156
Last Modified: 1/13/2022

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.

Summary

Description of Campaign
Adversaries have targeted both the military and government of India with malicious documents to compromise machines with two remote access trojans (RATs) known as Netwire (NetwireRAT and NetwireRC) and Warzone (aka Ave Maria). The threat actors delivered lures through the malicious documents as well as archive files. Once executed, the scripts contained in the lure would lead to compromised websites that hosted loader malware and eventually delivered the RAT to the target. Although commodity malware is common among threat actors, this shift in activity outlines the resourcefulness of threat actors and their willingness to adapt to the changing threat landscape by using commercially available malware.

The McAfee Enterprise ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Cisco Talos and shared publicly here.

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	9B7C0465236B7E1BA7358BDCA315400F8FFC6079804F33E2CA4B5C467F499D1F
SHA256	D09CAC8CD7C49B908E623220A9B2893822263AE993C867B5BD4FCE562D02DCD5
SHA256	455AC9CC21FCB20A14CAA76ABD1280131FECAE9D216B1F6961AF2F13081C2932
SHA256	98337B43E214906B10222722607F76D07A5C0419A9DC3B3AF415680C60944809
SHA256	37D0D9997776740AE3134EC6A15141930A9521CD11E2FBB8D0DF6D308398F32E
SHA256	B54F21A5D20457424440FDF5A57C67924854B47CF85D6A5F26DAEAF183E82B69
SHA256	B76BE2491B127A75C297B72E1CF79F46F99622DDF4BA3516A88B47D9B6DF9131
SHA256	5D3220DB34868FC98137B7DFB3A6EE47DB386F145B534FB4A13EF5E0B5DF9268
SHA256	A8C67A11ED522BF597FEB8B50A5B63F12A5AC724AE6ADCC945475654128F6D64
SHA256	DE245CD946E48A4B1C471B17BEFF056B1A2566770A96785208C698F85FB73DB2
SHA256	B4C0F24A860F14B7A7360708A4AEE135BF1A24D730D7794BC55E53A31A0E57A5
SHA256	0D64FD162D94601DDD806DF804103F3713C4AA43C201FFFB9C92783C29D6094C
SHA256	C8FFB9D14A28FBC7E7F6D517B22A8BB83097F5BC464C52E027610AB93CAEC0D6
SHA256	3634B81F8B91D723733CC44429D221E53B2A7BF121E42BD26078602F4FF48F86
SHA256	FD413EC8D9D798C28FC99C0633E6477F6EABC218788AD37C93BE4DE758A02962
SHA256	39FF95ECB1036AAB88A146714BB5B189F6AFC594ECF8FFBE8B123D1579A3A259
SHA256	689F3FF0A3331E198EA986864B2B23A62631C930D83B971382B4732474884953
SHA256	B891FAD315C540439DBA057A0F4895AE8BAE6EED982B0BF3FB46801A237C8678
SHA256	8E7D5805A104DC79355387DBD130E32D183B645F42F7B35C195041D1CF69F67E
SHA256	62A890CCE10F128F180D6E2B848FFFF42E32859FE58A023B2BDB35DBE0A1713B
SHA256	480E57131BD186E31AB5EA534381D7B93C8030F8B5757BDE9D0B6039EFA3E64D
SHA256	C1EBA59CE0FF5D8F57FE0AE0A9AF20CB0FA725FC05A58869BB0B85C2D3B815FB
SHA256	BA710351CFDF6B198D7479A91E786562DDB5E80DB5DC9AD42278093A3395FCA9
SHA256	EEF5E86EBFF5C59204009F4D421B80518CE3EDF9C9B1BB45FB2197D9F652A927
SHA256	8CE30043ABA8C9AD33C11C3DE152FE142BA7B710384F77D332076957D96E19B2
SHA256	5965BBA31EB30DEDF795012E744FE53495D5B0C1BEA52EEA32E9924819E843D1
SHA256	54A65835DC5370B089C38414972C8DA589512CF73B159E8187CDDA62092DC463
SHA256	8B4A7D6B3DE3083A8B71EC64FF647218343F4431BBB93A6CE18CB5F33571A38E
SHA256	626F00A260880C6BFA0A955FD0C89336A691E438C4BC9206182A05DB3774B75A
SHA256	AA3D57993BBC7AEFDC05E0E99CCDB5E884AA530AE90437157C7BA2308D9C4D3C
SHA256	3794CFE8F3DA39924CABD03D74AA95FB5D0C25C73D09CC99AD95C3F4E17252B8
SHA256	89DB68DCDBAE6FCA380029C1E5C5158FB5D95DB8034F1EE7DBAC36CF07057828
SHA256	8EA420DEAA86C778FC6A3B1B22BD0C2EA822089E948AD8F113C9E5B0539E92A7
SHA256	68DDB86DD74285A0B6F12EC8ADCA9A8EA4569EF1143BEC9E8EBE411B2A71720F
SHA256	91ACDC04A03134C17CCFF873F10E90C538ED74C7AB970B9899AC5C295E165A75
SHA256	7C12A820FD7E576F3A179CDCCAEFBFCD090E0F890FCCFAB7615BC294795DC244
SHA256	5F6571251FD36A4EC0B101C3B0BE4099BC1C812D57BEF57F310291D314E638BA
SHA256	F8748C726BDA6D67C7130AAE8777D7DCB5B0CCA8695041B290E9D9CB95A0A633
SHA256	41B1C3FA6B8A11FDE6769650977D7BC34E0DA91A23DD2B70220BEEC820E17D7A
SHA256	CF2261C7911F8481F7267B73B64546CA851B5471DAB3290CE0140F956823348A
SHA256	824BB11EF1520AECCA35AD9ABD8E043E4E00193668590D4AEE2A41F205DB7388
SHA256	2B7AC9063A530E808FFAC5CF9812D850DD5FA4D1F014BA5134AD023FDE503D21
SHA256	999F4892D10EB6CFABE172338C1E7DD3126A2CD435BDB59748178F1D4D2D3B33
SHA256	CD43BAC8F7A0A3DF4F654ED698F5828DB7A05C771956B924BFD6BD5BA09E2360
SHA256	BDB40D5E73E848ADA64F334EDDD184FB67E2FCDC149248DB641BB8D804468F1D
SHA256	A20970AA236AA60D74841E7AF53990C5DA526F406C83FD1BEDB011290517D9B0
SHA256	87FC9901EB7C3B335B82C5050E35458A2154747CD3E61110EED4C107F4FFADA9
SHA256	E6A73EF757C834E155A039619A1FDB1388F2A7EBE80ACCAE8D13DEEB3FD66471
SHA256	5226A12DC7F7B5E28732AD8B5AD6FA9A35EADFBEEC122D798CD53C5EF73FE86A
SHA256	6F8267A673CA5BC9FA67198C9C74D34109BAF862F9194BBB0EBCC7DDD7B66B91
SHA256	5A351ACFE61A0AD9444B8D23C9915D7BEB084ABD7B346B9D064E89914552596D
SHA256	369E794E05E0D7C9BBA6DDE5009848087A2CD5E8BF77583D391E0E51D21A52CD
SHA256	977D5B4B945CFCE92E40E4D5447626F3FFB7697D98F651B9598EDFD58074B9C0
SHA256	AA2B8412CF562C334052D5C34A2E5567090E064B570884D6F4D3E28806822487
SHA256	2443E8CCDF51E82D310466955A70013155C139564672B2F79DB7209207776BD2
SHA256	CF2AEC2969353DC99A7F715AC818212B42B8CFF7A58C9109442F2C65FF62DE42
SHA256	6B0FDE73E638CB7CDB741CFF0CC4EC872338C106FFE0C3A6712F08CDB600B83D
SHA256	051F67BA58BD2B7751541BF2EB3A09642A00A43052C0D3487A182345828EE076
SHA256	2A7F0AF4650EDB95EB7A380DE6D42DB59D8DD220BB4831E30E06450E149EEA49
SHA256	D5B7EDFC886C8228197B0CF20AB35F1BC0B5C652B1D766456D4E055BA6C9EA6E
SHA256	EA201379E3D7343FC7A8FBE0451766F1CEA36B66C13CFBF78C4AC7FFB1EB3D93
SHA256	49485A737673365489CB89EF1F5C29545051B33AA1642A8940E15AD281B76DFC
SHA256	8284550711419F4C65083DC5DE3C6B92164D8D0835EC864E9A2DB9C4C0D067E4
SHA256	3CDEDD433C9DDE56BFA0A6559A97287C7AEC3346178CE2D412A255D8ED347307
SHA256	1455A003412E344D60C8BAD71977AA42BB9825CFFA5417E45B08070B14E5DF3F
SHA256	140E0524F4770FC2543B86F1D62AAA6B3018C54E40250040FEAA2F24BDBE974D
SHA256	304C2F88CCD6B0B00CFCB779B8958D9467C78F32B7177949899D3E818B3B9BED
SHA256	0DF12B0F704DBD5709F86804DB5863BD0E6D6668D45A8FF568EEFBAA2EBFB9FD
SHA256	A8AF6228296BC9AC2CD7B7BF503C9755947C844FEC038255189A351BCB92BB6D
SHA256	2B23C976B4ACA2B9B61C474E0D6202644D97B48FA553CD6C9266C11B79D3CD13
SHA256	3E59B3504954EFD9B4231CB208296ED9F19F4430E19DB81E942B304EE0255324
SHA256	DE10443785CF7D22DB92FADA898A77BC32C7505931B692110D2D5CD63C5B4853
SHA256	EB40D1AAB9A5E59E2D6BE76A1C0772F0D22726DD238110168280C34695A8C48F
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/mailer.php.zip
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/mailer.php/mailer.php
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/mailer.php
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/4O4.php
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/b374k_rs.pl
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/pack.php
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/cc.php
URL	http://lms.apsdigicamp.com/webapps/uploads/resume/leafmailer2.8.php
URL	http://lms.apsdigicamp.com/webapps/uploads/acc/oodi.html
URL	http://lms.apsdigicamp.com/webapps/uploads/progress-report/
URL	http://lms.apsdigicamp.com/webapps/uploads/progress-report/index.html
URL	http://service.clickaway.com/ccrs_tool/uploads/1594066203_4O4.php
URL	http://service.clickaway.com/ccrs_tool/uploads/mailer.php
URL	http://service.clickaway.com/ccrs_tool/uploads/leaf.php
URL	http://service.clickaway.com/ccrs_tool/uploads/leafmailer2.8.php
URL	http://service.clickaway.com/ccrs_tool/uploads/1622640929_myshell.php
URL	http://service.clickaway.com/ccrs_tool/uploads/newfil.html
URL	http://service.clickaway.com/ccrs_tool/uploads/1594066203_ang3l.html
URL	http://service.clickaway.com/ccrs_tool/uploads/1594066203_up.htm
URL	https://pastebin.com/raw/mrwtZi34
URL	http://service.clickaway.com/ccrs_tool/uploads/RunPe.dll
URL	https://www.unicauca.edu.co/regionalizacion/sites/default/files/Meeting-details.zip
URL	https://www.unicauca.edu.co/regionalizacion/sites/default/files/kavach-1-5/kavach-2-instructions.zip
URL	http://www.unicauca.edu.co/regionalizacion/sites/default/files/kavach-1-5/KAVACH-INSTALLATION-V3.zip
URL	https://dsoipalamvihar.co.in/pdf/important_notice.zip
URL	http://lms.apsdigicamp.com/webapps/uploads/acc/cctv-footages/student-termination-and-proof.zip
URL	http://beechtree.co.in/Admin/IconImages/progress-reports/Progress-report-43564.zip
URL	http://64.188.13.46/oiasjdoaijsdoiasjd/
URL	http://www.bookiq.bsnl.co.in/data_entry/circulars/QA2E.exe
URL	http://www.bookiq.bsnl.co.in/data_entry/circulars/Host1.exe
URL	http://www.bookiq.bsnl.co.in/data_entry/circulars/mac.exe
URL	http://www.bookiq.bsnl.co.in/data_entry/circulars/mmaaccc.exe
URL	http://bookiq.bsnl.co.in/data_entry/circulars/Host.exe
URL	https://kavach.govrn.xyz/shedule.exe
URL	http://unicauca.edu.co/regionalizacion/sites/default/files/kavach-1-5/Acrobat.exe
URL	http://45.79.81.88/ccrs_tool/uploads/mac.exe
URL	http://45.79.81.88/ccrs_tool/uploads/maaccc.exe
URL	http://45.79.81.88/ccrs_tool/uploads/maacc.exe
URL	http://45.79.81.88/ccrs_tool/uploads/VPN.exe
URL	http://45.79.81.88/ccrs_tool/uploads/conhost213.exe
URL	http://45.79.81.88/ccrs_tool/uploads/new_war.exe
URL	http://45.79.81.88/ccrs_tool/uploads/private.exe
URL	http://45.79.81.88/ccrs_tool/uploads/notice.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/conhost123.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/Host1.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/mac.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/maaacccc.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/maaccc.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/maacc.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/VPN.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/new_war.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/ma/mmmaaaacccccc.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/client.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/private.exe
URL	http://service.clickaway.com/ccrs_tool/uploads/notice.exe
URL	http://service.clickaway.com/swings/haryanatourism/gita-jayanti/invited.exe
URL	http://service.clickaway.com/swings/haryanatourism/gita-jayanti/details.exe
URL	https://www.ramanujan.edu.in/cctv-footage/footage-346.exe
URL	http://thedigitalpoint.co.in/zomato/vouchers/zomato-voucher.zip
URL	http://66.154.112.212/GOM.exe
URL	https://dsoipalamvihar.co.in/manage/OperatorImages/exe/GOM_Player.exe
URL	http://service.clickaway.com//ccrs_tool/uploads/722CDfdBpfUbRyg.bbc
URL	http://service.clickaway.com/ccrs_tool/uploads/feedback.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/Security-Updates.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/r.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/abc/r.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/abc/CONFD-PERS-Letter.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/KAVACH-INSTALLATION-VER1.5.docm
URL	http://service.clickaway.com/ccrs_tool/uploads/ma/KAVACH-INSTALLATION-VER-1.docm
URL	https://aps.govrn.xyz/schedule2021.docm
IP-DST	64.188.13.46

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10150
V3 DAT (Endpoint Security)	4602

Detection Summary

IOC	Scanner	Detection
9B7C0465236B7E1BA7358BDCA315400F8FFC6079804F33E2CA4B5C467F499D1F	AVEngine V2	W97M/Downloader.dtc
	AVEngine V3	W97M/Downloader.dtc
	JTI (ATP Rules)	JTI/Suspect.393221
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D09CAC8CD7C49B908E623220A9B2893822263AE993C867B5BD4FCE562D02DCD5	AVEngine V2	Generic trojan.mi
	AVEngine V3	Generic trojan.mi
	JTI (ATP Rules)	JTI/Suspect.196612!42ab1e1ff52c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
455AC9CC21FCB20A14CAA76ABD1280131FECAE9D216B1F6961AF2F13081C2932	AVEngine V2	AgentTesla-FCTY!981DF35D50B5
	AVEngine V3	AgentTesla-FCTY!981DF35D50B5
	JTI (ATP Rules)	JTI/Suspect.196612!981df35d50b5
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
98337B43E214906B10222722607F76D07A5C0419A9DC3B3AF415680C60944809	AVEngine V2	GenericRXKH-LK!BC328DEF2236
	AVEngine V3	GenericRXKH-LK!BC328DEF2236
	JTI (ATP Rules)	JTI/Suspect.196612!bc328def2236
	RP Static	Real Protect-XGPE!BC328DEF2236
	RP Dynamic	-

IOC	Scanner	Detection
37D0D9997776740AE3134EC6A15141930A9521CD11E2FBB8D0DF6D308398F32E	AVEngine V2	PHP/Webshell.bn
	AVEngine V3	PHP/Webshell.bn
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B54F21A5D20457424440FDF5A57C67924854B47CF85D6A5F26DAEAF183E82B69	AVEngine V2	PHP/Mailer.a
	AVEngine V3	PHP/Mailer.a
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B76BE2491B127A75C297B72E1CF79F46F99622DDF4BA3516A88B47D9B6DF9131	AVEngine V2	Trojan-FTXY!BF7FDF666BAC
	AVEngine V3	Trojan-FTXY!BF7FDF666BAC
	JTI (ATP Rules)	JTI/Suspect.196612!bf7fdf666bac
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5D3220DB34868FC98137B7DFB3A6EE47DB386F145B534FB4A13EF5E0B5DF9268	AVEngine V2	W97M/Downloader.dsy
	AVEngine V3	W97M/Downloader.dsy
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A8C67A11ED522BF597FEB8B50A5B63F12A5AC724AE6ADCC945475654128F6D64	AVEngine V2	Trojan-FTZH!54B7F1AF2AF1
	AVEngine V3	Trojan-FTZH!54B7F1AF2AF1
	JTI (ATP Rules)	JTI/Suspect.196612!54b7f1af2af1
	RP Static	Real Protect-PEE!54B7F1AF2AF1
	RP Dynamic	-

IOC	Scanner	Detection
DE245CD946E48A4B1C471B17BEFF056B1A2566770A96785208C698F85FB73DB2	AVEngine V2	Trojan-FTZE!DBD37B8C044A
	AVEngine V3	Trojan-FTZE!DBD37B8C044A
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B4C0F24A860F14B7A7360708A4AEE135BF1A24D730D7794BC55E53A31A0E57A5	AVEngine V2	Trojan-FTZF!6C6D641DCF69
	AVEngine V3	Trojan-FTZF!6C6D641DCF69
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0D64FD162D94601DDD806DF804103F3713C4AA43C201FFFB9C92783C29D6094C	AVEngine V2	W97M/Downloader.dsu
	AVEngine V3	W97M/Downloader.dsu
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C8FFB9D14A28FBC7E7F6D517B22A8BB83097F5BC464C52E027610AB93CAEC0D6	AVEngine V2	Trojan-FTZE!03ACC9C55165
	AVEngine V3	Trojan-FTZE!03ACC9C55165
	JTI (ATP Rules)	JTI/Suspect.196612!03acc9c55165
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3634B81F8B91D723733CC44429D221E53B2A7BF121E42BD26078602F4FF48F86	AVEngine V2	Trojan-FTZG!E53F974E89CB
	AVEngine V3	Trojan-FTZG!E53F974E89CB
	JTI (ATP Rules)	JTI/Suspect.196612!e53f974e89cb
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FD413EC8D9D798C28FC99C0633E6477F6EABC218788AD37C93BE4DE758A02962	AVEngine V2	Trojan-FTZE!0061D17FF54D
	AVEngine V3	Trojan-FTZE!0061D17FF54D
	JTI (ATP Rules)	JTI/Suspect.196612!0061d17ff54d
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
39FF95ECB1036AAB88A146714BB5B189F6AFC594ECF8FFBE8B123D1579A3A259	AVEngine V2	Trojan-FTZE!6251DDF49B09
	AVEngine V3	Trojan-FTZE!6251DDF49B09
	JTI (ATP Rules)	JTI/Suspect.196612!6251ddf49b09
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
689F3FF0A3331E198EA986864B2B23A62631C930D83B971382B4732474884953	AVEngine V2	Trojan-FTZE!DBD37B8C044A
	AVEngine V3	Trojan-FTZE!DBD37B8C044A
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B891FAD315C540439DBA057A0F4895AE8BAE6EED982B0BF3FB46801A237C8678	AVEngine V2	Injector.ay
	AVEngine V3	Injector.ay
	JTI (ATP Rules)	JTI/Suspect.196612!17f9a3adde7d
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8E7D5805A104DC79355387DBD130E32D183B645F42F7B35C195041D1CF69F67E	AVEngine V2	Trojan-FTZG!E53F974E89CB
	AVEngine V3	Trojan-FTZG!E53F974E89CB
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
62A890CCE10F128F180D6E2B848FFFF42E32859FE58A023B2BDB35DBE0A1713B	AVEngine V2	W97M/Downloader.dsy
	AVEngine V3	W97M/Downloader.dsy
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
480E57131BD186E31AB5EA534381D7B93C8030F8B5757BDE9D0B6039EFA3E64D	AVEngine V2	Trojan-FTZF!C698717B872A
	AVEngine V3	Trojan-FTZF!C698717B872A
	JTI (ATP Rules)	JTI/Suspect.196612!2a294d2c340a
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C1EBA59CE0FF5D8F57FE0AE0A9AF20CB0FA725FC05A58869BB0B85C2D3B815FB	AVEngine V2	W97M/Downloader.dsu
	AVEngine V3	W97M/Downloader.dsu
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
BA710351CFDF6B198D7479A91E786562DDB5E80DB5DC9AD42278093A3395FCA9	AVEngine V2	Trojan-FTZG!2244A09C07AC
	AVEngine V3	Trojan-FTZG!2244A09C07AC
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EEF5E86EBFF5C59204009F4D421B80518CE3EDF9C9B1BB45FB2197D9F652A927	AVEngine V2	W97M/Downloader.dsr
	AVEngine V3	W97M/Downloader.dsr
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8CE30043ABA8C9AD33C11C3DE152FE142BA7B710384F77D332076957D96E19B2	AVEngine V2	Trojan-FTZF!676EF0277B58
	AVEngine V3	Trojan-FTZF!676EF0277B58
	JTI (ATP Rules)	JTI/Suspect.196612!676ef0277b58
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5965BBA31EB30DEDF795012E744FE53495D5B0C1BEA52EEA32E9924819E843D1	AVEngine V2	AgentTesla-FCTY!FBD1F820E0ED
	AVEngine V3	AgentTesla-FCTY!FBD1F820E0ED
	JTI (ATP Rules)	JTI/Suspect.196612!fbd1f820e0ed
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
54A65835DC5370B089C38414972C8DA589512CF73B159E8187CDDA62092DC463	AVEngine V2	Trojan-FTZG!2244A09C07AC
	AVEngine V3	Trojan-FTZG!2244A09C07AC
	JTI (ATP Rules)	JTI/Suspect.196612!2244a09c07ac
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8B4A7D6B3DE3083A8B71EC64FF647218343F4431BBB93A6CE18CB5F33571A38E	AVEngine V2	PHP/Webshell.bk
	AVEngine V3	PHP/Webshell.bk
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
626F00A260880C6BFA0A955FD0C89336A691E438C4BC9206182A05DB3774B75A	AVEngine V2	Trojan-FTZE!FBB499F45478
	AVEngine V3	Trojan-FTZE!FBB499F45478
	JTI (ATP Rules)	JTI/Suspect.196612!fbb499f45478
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AA3D57993BBC7AEFDC05E0E99CCDB5E884AA530AE90437157C7BA2308D9C4D3C	AVEngine V2	GenericRXKH-LK!3C3AD5B94E69
	AVEngine V3	GenericRXKH-LK!3C3AD5B94E69
	JTI (ATP Rules)	JTI/Suspect.196612!3c3ad5b94e69
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3794CFE8F3DA39924CABD03D74AA95FB5D0C25C73D09CC99AD95C3F4E17252B8	AVEngine V2	Trojan-FTZF!A8CBB4A8DE87
	AVEngine V3	Trojan-FTZF!A8CBB4A8DE87
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
89DB68DCDBAE6FCA380029C1E5C5158FB5D95DB8034F1EE7DBAC36CF07057828	AVEngine V2	Trojan-FTZE!15680B03F0AB
	AVEngine V3	Trojan-FTZE!15680B03F0AB
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8EA420DEAA86C778FC6A3B1B22BD0C2EA822089E948AD8F113C9E5B0539E92A7	AVEngine V2	PHP/Webshell.bo
	AVEngine V3	PHP/Webshell.bo
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
68DDB86DD74285A0B6F12EC8ADCA9A8EA4569EF1143BEC9E8EBE411B2A71720F	AVEngine V2	Trojan-FTZE!A8A8A94BEC5B
	AVEngine V3	Trojan-FTZE!A8A8A94BEC5B
	JTI (ATP Rules)	JTI/Suspect.196612!a8a8a94bec5b
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
91ACDC04A03134C17CCFF873F10E90C538ED74C7AB970B9899AC5C295E165A75	AVEngine V2	Trojan-FTZE!643B11C3F6A6
	AVEngine V3	Trojan-FTZE!643B11C3F6A6
	JTI (ATP Rules)	JTI/Suspect.196612!643b11c3f6a6
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7C12A820FD7E576F3A179CDCCAEFBFCD090E0F890FCCFAB7615BC294795DC244	AVEngine V2	Trojan-FTZE!F0B43A3F4821
	AVEngine V3	Trojan-FTZE!F0B43A3F4821
	JTI (ATP Rules)	JTI/Suspect.196612!f0b43a3f4821
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5F6571251FD36A4EC0B101C3B0BE4099BC1C812D57BEF57F310291D314E638BA	AVEngine V2	Trojan-FTZE!46394A5B5BD3
	AVEngine V3	Trojan-FTZE!46394A5B5BD3
	JTI (ATP Rules)	JTI/Suspect.196612!46394a5b5bd3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F8748C726BDA6D67C7130AAE8777D7DCB5B0CCA8695041B290E9D9CB95A0A633	AVEngine V2	Generic trojan.mi
	AVEngine V3	Generic trojan.mi
	JTI (ATP Rules)	JTI/Suspect.196612!cc0b18781e58
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
41B1C3FA6B8A11FDE6769650977D7BC34E0DA91A23DD2B70220BEEC820E17D7A	AVEngine V2	W97M/Downloader.dsz
	AVEngine V3	W97M/Downloader.dsz
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CF2261C7911F8481F7267B73B64546CA851B5471DAB3290CE0140F956823348A	AVEngine V2	PWS-FCXD!AB166040DB28
	AVEngine V3	PWS-FCXD!AB166040DB28
	JTI (ATP Rules)	JTI/Suspect.196612!ab166040db28
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
824BB11EF1520AECCA35AD9ABD8E043E4E00193668590D4AEE2A41F205DB7388	AVEngine V2	W97M/Downloader.dsy
	AVEngine V3	W97M/Downloader.dsy
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2B7AC9063A530E808FFAC5CF9812D850DD5FA4D1F014BA5134AD023FDE503D21	AVEngine V2	AgentTesla-FCTY!B526BD60ECE5
	AVEngine V3	AgentTesla-FCTY!B526BD60ECE5
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
999F4892D10EB6CFABE172338C1E7DD3126A2CD435BDB59748178F1D4D2D3B33	AVEngine V2	Trojan-UACByPass.a
	AVEngine V3	Trojan-UACByPass.a
	JTI (ATP Rules)	JTI/Suspect.196612!ed2fee7925c8
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CD43BAC8F7A0A3DF4F654ED698F5828DB7A05C771956B924BFD6BD5BA09E2360	AVEngine V2	GenericRXKH-LK!BB24EB65B802
	AVEngine V3	GenericRXKH-LK!BB24EB65B802
	JTI (ATP Rules)	JTI/Suspect.196612!bb24eb65b802
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
BDB40D5E73E848ADA64F334EDDD184FB67E2FCDC149248DB641BB8D804468F1D	AVEngine V2	W97M/Downloader.dss
	AVEngine V3	W97M/Downloader.dss
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A20970AA236AA60D74841E7AF53990C5DA526F406C83FD1BEDB011290517D9B0	AVEngine V2	Trojan-FTZG!810BA7D14F14
	AVEngine V3	Trojan-FTZG!810BA7D14F14
	JTI (ATP Rules)	JTI/Suspect.196612!810ba7d14f14
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
87FC9901EB7C3B335B82C5050E35458A2154747CD3E61110EED4C107F4FFADA9	AVEngine V2	Trojan-FTXY!BF7FDF666BAC
	AVEngine V3	Trojan-FTXY!BF7FDF666BAC
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
E6A73EF757C834E155A039619A1FDB1388F2A7EBE80ACCAE8D13DEEB3FD66471	AVEngine V2	W97M/Downloader.dsy
	AVEngine V3	W97M/Downloader.dsy
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5226A12DC7F7B5E28732AD8B5AD6FA9A35EADFBEEC122D798CD53C5EF73FE86A	AVEngine V2	Trojan-FTZE!DBD37B8C044A
	AVEngine V3	Trojan-FTZE!DBD37B8C044A
	JTI (ATP Rules)	JTI/Suspect.196612!dbd37b8c044a
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6F8267A673CA5BC9FA67198C9C74D34109BAF862F9194BBB0EBCC7DDD7B66B91	AVEngine V2	GenericRXOJ-DE!A502180DA025
	AVEngine V3	GenericRXOJ-DE!A502180DA025
	JTI (ATP Rules)	JTI/Suspect.196612!a502180da025
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5A351ACFE61A0AD9444B8D23C9915D7BEB084ABD7B346B9D064E89914552596D	AVEngine V2	Trojan-FTZF!0A6D99FBB494
	AVEngine V3	Trojan-FTZF!0A6D99FBB494
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
369E794E05E0D7C9BBA6DDE5009848087A2CD5E8BF77583D391E0E51D21A52CD	AVEngine V2	Trojan-FTZE!F6E2893312DC
	AVEngine V3	Trojan-FTZE!F6E2893312DC
	JTI (ATP Rules)	JTI/Suspect.196612!f6e2893312dc
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
977D5B4B945CFCE92E40E4D5447626F3FFB7697D98F651B9598EDFD58074B9C0	AVEngine V2	GenericRXKH-LK!468262C24E81
	AVEngine V3	GenericRXKH-LK!468262C24E81
	JTI (ATP Rules)	JTI/Suspect.196612!468262c24e81
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AA2B8412CF562C334052D5C34A2E5567090E064B570884D6F4D3E28806822487	AVEngine V2	Trojan-UACByPass.a
	AVEngine V3	Trojan-UACByPass.a
	JTI (ATP Rules)	JTI/Suspect.196612!04bc10e10643
	RP Static	Real Protect-PEE!04BC10E10643
	RP Dynamic	-

IOC	Scanner	Detection
2443E8CCDF51E82D310466955A70013155C139564672B2F79DB7209207776BD2	AVEngine V2	Trojan-FTZF!A8CBB4A8DE87
	AVEngine V3	Trojan-FTZF!A8CBB4A8DE87
	JTI (ATP Rules)	JTI/Suspect.196612!a8cbb4a8de87
	RP Static	Real Protect-XGPE!A8CBB4A8DE87
	RP Dynamic	-

IOC	Scanner	Detection
CF2AEC2969353DC99A7F715AC818212B42B8CFF7A58C9109442F2C65FF62DE42	AVEngine V2	Trojan-FTZE!467E17B8D446
	AVEngine V3	Trojan-FTZE!467E17B8D446
	JTI (ATP Rules)	JTI/Suspect.196612!467e17b8d446
	RP Static	Real Protect-XGPE!467E17B8D446
	RP Dynamic	-

IOC	Scanner	Detection
6B0FDE73E638CB7CDB741CFF0CC4EC872338C106FFE0C3A6712F08CDB600B83D	AVEngine V2	W97M/Downloader.dsz
	AVEngine V3	W97M/Downloader.dsz
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
051F67BA58BD2B7751541BF2EB3A09642A00A43052C0D3487A182345828EE076	AVEngine V2	GenericRXKH-LK!532C4C4403CE
	AVEngine V3	GenericRXKH-LK!532C4C4403CE
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2A7F0AF4650EDB95EB7A380DE6D42DB59D8DD220BB4831E30E06450E149EEA49	AVEngine V2	Generic trojan.mi
	AVEngine V3	Generic trojan.mi
	JTI (ATP Rules)	JTI/Suspect.196612!382d38adea66
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D5B7EDFC886C8228197B0CF20AB35F1BC0B5C652B1D766456D4E055BA6C9EA6E	AVEngine V2	Trojan-FTZF!6C6D641DCF69
	AVEngine V3	Trojan-FTZF!6C6D641DCF69
	JTI (ATP Rules)	JTI/Suspect.196612!6c6d641dcf69
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EA201379E3D7343FC7A8FBE0451766F1CEA36B66C13CFBF78C4AC7FFB1EB3D93	AVEngine V2	PWS-FCXL!891857EE5BFB
	AVEngine V3	PWS-FCXL!891857EE5BFB
	JTI (ATP Rules)	JTI/Suspect.196612!891857ee5bfb
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
49485A737673365489CB89EF1F5C29545051B33AA1642A8940E15AD281B76DFC	AVEngine V2	Trojan-FTZH!8722D8337B72
	AVEngine V3	Trojan-FTZH!8722D8337B72
	JTI (ATP Rules)	JTI/Suspect.196612!8722d8337b72
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8284550711419F4C65083DC5DE3C6B92164D8D0835EC864E9A2DB9C4C0D067E4	AVEngine V2	Trojan-FTZE!AF1BD3BAEACB
	AVEngine V3	Trojan-FTZE!AF1BD3BAEACB
	JTI (ATP Rules)	JTI/Suspect.196612!af1bd3baeacb
	RP Static	Real Protect-XGPE!AF1BD3BAEACB
	RP Dynamic	-

IOC	Scanner	Detection
3CDEDD433C9DDE56BFA0A6559A97287C7AEC3346178CE2D412A255D8ED347307	AVEngine V2	Trojan-FTZE!11355C8F7EC6
	AVEngine V3	Trojan-FTZE!11355C8F7EC6
	JTI (ATP Rules)	JTI/Suspect.196612!11355c8f7ec6
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
1455A003412E344D60C8BAD71977AA42BB9825CFFA5417E45B08070B14E5DF3F	AVEngine V2	Generic trojan.mi
	AVEngine V3	Generic trojan.mi
	JTI (ATP Rules)	JTI/Suspect.196612!56257737faad
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
140E0524F4770FC2543B86F1D62AAA6B3018C54E40250040FEAA2F24BDBE974D	AVEngine V2	Trojan-UACByPass.a
	AVEngine V3	Trojan-UACByPass.a
	JTI (ATP Rules)	JTI/Suspect.196612!e944b348629a
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
304C2F88CCD6B0B00CFCB779B8958D9467C78F32B7177949899D3E818B3B9BED	AVEngine V2	AgentTesla-FCTY!B526BD60ECE5
	AVEngine V3	AgentTesla-FCTY!B526BD60ECE5
	JTI (ATP Rules)	JTI/Suspect.196612!b526bd60ece5
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0DF12B0F704DBD5709F86804DB5863BD0E6D6668D45A8FF568EEFBAA2EBFB9FD	AVEngine V2	Trojan-UACByPass.a
	AVEngine V3	Trojan-UACByPass.a
	JTI (ATP Rules)	JTI/Suspect.196612!bcdf4208f2f2
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A8AF6228296BC9AC2CD7B7BF503C9755947C844FEC038255189A351BCB92BB6D	AVEngine V2	PHP/Mailer.a
	AVEngine V3	PHP/Mailer.a
	JTI (ATP Rules)	JTI/Suspect.196612!15680b03f0ab
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2B23C976B4ACA2B9B61C474E0D6202644D97B48FA553CD6C9266C11B79D3CD13	AVEngine V2	W97M/Downloader.dta
	AVEngine V3	W97M/Downloader.dta
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3E59B3504954EFD9B4231CB208296ED9F19F4430E19DB81E942B304EE0255324	AVEngine V2	GenericRXKH-LK!92BDA2B020F6
	AVEngine V3	GenericRXKH-LK!92BDA2B020F6
	JTI (ATP Rules)	JTI/Suspect.196612!92bda2b020f6
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
DE10443785CF7D22DB92FADA898A77BC32C7505931B692110D2D5CD63C5B4853	AVEngine V2	Trojan-FTZF!0A6D99FBB494
	AVEngine V3	Trojan-FTZF!0A6D99FBB494
	JTI (ATP Rules)	JTI/Suspect.196612!0a6d99fbb494
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EB40D1AAB9A5E59E2D6BE76A1C0772F0D22726DD238110168280C34695A8C48F	AVEngine V2	W97M/Downloader.dsz
	AVEngine V3	W97M/Downloader.dsz
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 309 Block processes attempting to launch from office applications. Rule enabled only in high security policies
Rule ID: 5 Use GTI URL reputation to identify trusted or malicious processes
Rule ID: 4 Use GTI file reputation to identify trusted or malicious files
Rule ID: 301 Blocks cmd.exe from being spawned by office applications

Endpoint Security - Exploit Prevention:

Rule ID: 6086 Powershell Command Restriction - Command
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 6127 Suspicious LSASS Access from Powershell
Rule ID: 6096 Powershell Command Restriction - InvokeExpression
Rule ID: 2844 Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability

Host Intrusion Prevention:

Rule ID: 6086 Powershell Command Restriction - Command
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 6096 Powershell Command Restriction - InvokeExpression
Rule ID: 2844 Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability

Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Virusscan Enterprise - Access Protection Rules:

Prevent programs registering to autorun
Prevent creation of new executable files in the Windows folder
Prevent programs registering as a service

Host Intrusion Prevention:

Rule ID: 990 New Startup Folder Program Creation
Rule ID: 2265 Delay Delete File Protection
Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 910 Uninstall Registry Key Modification
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 344 T1547 - New Startup Program Creation
Rule ID: 1148 CMD Tool Access by a Network Aware Application
Rule ID: 6053 Accessing other users home directory
Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 1020 Windows Agent Shielding - File Access

Affected Products

MVISION Insights

Knowledge Center

MVISION Insights: Operation Armor Piercer Targets India with Commercial RATs

Environment

Summary

Affected Products

Title

Title

Knowledge Center

MVISION Insights: Operation Armor Piercer Targets India with Commercial RATs

Environment

Summary

Affected Products

Choose your region

Title

Title