Trusted Design

CHTHONIC and DIMNIE Campaign Targets Russia

概要

A targeted phishing campaign was active in early August 2017 delivering "Подписать документы.doc" (translates to "Sign Documents.doc"), a MS Word document with an embedded macro responsible for dropping both the CHTHONIC banking trojan and DIMNIE spyware to an infected machine. CHTHONIC was discovered in 2014 by Kaspersky security researchers and is considered to be an evolution of ZeusVM malware. DIMNIE is a modular information stealer profiled earlier this year by security researchers at PaloAlto's Unit 42, who found the malware in targeted phishing attacks against open-source developers.

Created: 2026-02-23

Indicators

• domain - babsmarbab.top -
• domain - babslarbab.host -
• FileHash-SHA256 - 7052ab1a3b525a58ef622be2788b42825338de7fc54d32e56b6dad7e9b57860c -
• FileHash-SHA256 - 7e0712cbc8d75d2d5bd00e689fc69a03a9b7799cba125a88d6bae728cd24b647 -
• domain - spoilerultimate.pw -
• IPv4 - 103.208.86.92 -
• FileHash-SHA256 - d6f2a573884944ae968a5772c6a7221d542ee898890ae2b6ec8f8bd0c6a56c59 -

類似Pulses

• Malicious VBScript file delivers Pony Loader (score: 0.62)
• The Curious Case of an Unknown Trojan Targeting German-Speaking Users (score: 0.61)
• "KUHOOK" POINT OF SALE MALWARE (score: 0.59)
• NetTraveler APT Targets Russian, European Interests (score: 0.59)
• Pkybot: A new banking malware (score: 0.59)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る