The MeDoc Connection
Tags
country: Latvia Ukraine
attack-pattern: Data Credentials - T1589.001 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID fa1547b4-73e2-44b9-a810-a6d6e19305c9
Fingerprint e52ab1592862ad87
Analysis status DONE
Considered CTI value 2
Text language
Published July 5, 2017, 2:22 p.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Oct. 26, 2024, 1:12 p.m.
Headline Vulnerability Information
Title The MeDoc Connection
Detected Hints/Tags/Attributes 37/2/16
Source URLs
Redirection Url
Details Source http://blog.talosintelligence.com/2017/07/the-medoc-connection.html
Details Source https://blog.talosintelligence.com/2017/07/the-medoc-connection.html
URL Provider
Details Provider Source level domain
Details talosintelligence.com blog.talosintelligence.com
Attributes
Details Type #Events CTI Value
Details Domain 5 
upd.me-doc.com.ua
Details Domain 4 
thcservers.com
Details Domain 2 
w32.02ef73bd24-95.sbx.tg
Details File 70 
e.doc
Details File 6 
zvitpublishedobjects.dll
Details md5 2 
1b2eb092215b49f5b1d691b5c38e3a74
Details sha256 2 
f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740
Details sha256 2 
d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac
Details sha256 2 
2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277
Details sha256 11 
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
Details sha256 5 
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
Details sha256 5 
eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998
Details IPv4 3 
176.31.182.167
Details IPv4 3 
159.148.186.214
Details Url 2 
http://176.31.182.167:80/last.ver?rnd=1b2eb092215b49f5b1d691b5c38e3a74
Details Url 2 
http://upd.me-doc.com.ua/last.ver?rnd=