bd3881964e351a7691bfc7e997e8a2c8ce4a8e26b79e3712d0cbdc484a5646b6

Classification: Malicious

bd3881964e351a7691bfc7e997e8a2c8ce4a8e26b79e3712d0cbdc484a5646b6 is a trojan (Office document, 748.0 KB). Flagged by 46% of antivirus engines (28 detections).

Detection summary

  • 28 antivirus detections (46% detection ratio)
  • 0 IDS alerts
  • 5 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: MUSTANG PANDA (G0129)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Ta428 Maltiverse 2023-07-04 04:29:44 2023-07-05 20:50:42 malicious-activity
Generic.Malware Maltiverse 2023-07-05 11:14:07 2023-07-05 11:14:07 G0129 Mustang Panda
Generic Malware Hybrid-Analysis 2023-07-04 20:00:03 2023-07-04 20:00:03

Tags

apt malware plugx

Sample information

Filenames
bd3881964e351a7691bfc7e997e8a2c8ce4a8e26b79e3712d0cbdc484a5646b6
File type
Composite Document File V2 Document, Little Endian ...
Size
765952 bytes
MD5
47d854867d5f9e8032022c4c0d607c2e
SHA-1
67a2be5e5ae4d25a256f5942f2da4d9a3edc5a30
SHA-256
bd3881964e351a7691bfc7e997e8a2c8ce4a8e26b79e3712d0cbdc484a5646b6
First indexed
2023-07-04 19:28:37
Last updated
2026-09-18 06:35:06

Antivirus detections

EngineDetection
LionicTrojan.Win32.Alien.4!c
FireEyeTrojan.GenericKD.67413522
McAfeeArtemis!B03636CDD974
SangforTrojan.Win32.Agent.Vjoo
K7AntiVirusTrojan ( 005940101 )
K7GWTrojan ( 005940101 )
BitDefenderThetaGen:NN.ZedlaF.36270.eq4@aO0Pdoj
CyrenW32/ABRisk.SXAW-5046
SymantecTrojan Horse
ESET-NOD32a variant of Win32/Korplug.TX
TrendMicro-HouseCallTROJ_GEN.R002H09F923
AvastWin32:MalwareX-gen [Trj]
KasperskyTrojan.Win32.Dllhijacker.aex
BitDefenderTrojan.GenericKD.67413522
Rising[email protected] (RDML:vm91SuP3nuP/7ivsQQe8SQ)
EmsisoftTrojan.GenericKD.67413522 (B)
VIPRETrojan.GenericKD.67413522
McAfee-GW-EditionArtemis
SophosMal/Generic-S
GDataTrojan.GenericKD.67413522
Antiy-AVLTrojan/Win32.Korplug
ArcabitTrojan.Generic.D404A612
ZoneAlarmTrojan.Win32.Dllhijacker.aex
MicrosoftTrojan:Win32/Casdet!rfn
GoogleDetected
ALYacTrojan.Downloader.Script.gen
MAXmalware (ai score=85)
AVGWin32:MalwareX-gen [Trj]

Network contacts

62.233.57.136

Process list

NameCommand line
msiexec.exe/i "C:\bd3881964e351a7691bfc7e997e8a2c8ce4a8e26b79e3712d0cbdc484a5646b6.msi"
msiexec.exe/V
robotaskbaricon.exe
WINWORD.EXE/n "%TEMP%\Comments FRANCE - EU-CELAC Summit - May 4.docx"
robotaskbaricon.exe680