From d4e1cdc0d22ecd64b88f702ea4ed70b6087a5c56 Mon Sep 17 00:00:00 2001
From: StrangerealIntel <54320855+StrangerealIntel@users.noreply.github.com>
Date: Tue, 10 Sep 2019 01:08:00 +0200
Subject: [PATCH] Create New samples from the August compaign.md

---
 .../New samples from the August compaign.md   | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 Russia/APT/Gamaredon/09-09-19/New samples from the August compaign.md

diff --git a/Russia/APT/Gamaredon/09-09-19/New samples from the August compaign.md b/Russia/APT/Gamaredon/09-09-19/New samples from the August compaign.md
new file mode 100644
index 0000000..6895883
--- /dev/null
+++ b/Russia/APT/Gamaredon/09-09-19/New samples from the August compaign.md	
@@ -0,0 +1,44 @@
+# New samples from the August compaign
+## Table of Contents
+* [Malware analysis](#Malware-analysis)
+  + [Initial vector](#Initial-vector)
+* [Cyber Threat Intel](#Cyber-Threat-Intel)
+* [Indicators Of Compromise (IOC)](#IOC)
+* [Links](#Links)
+  + [Originals Tweets](#Original-Tweet)
+  + [Link Anyrun](#Links-Anyrun)
+
+## Malware analysis <a name="Malware-analysis"></a>
+### Initial vector <a name="Initial-vector"></a>
+###### The first two samples are maldocs use the CVE-2017-0199 for call a remote template to get the second stage.
+![alt text](link "")
+
+
+## Cyber Threat Intel <a name="Cyber-Threat-Intel"></a>
+
+
+## Indicators Of Compromise (IOC) <a name="IOC"></a>
+
+###### List of all the Indicators Of Compromise (IOC)
+
+| Indicator     | Description|
+| ------------- |:-------------:|
+|протокол.docx|9a1384868090f54630bc8615c52525a26405a208da1857facb7297d66c69b5c1|
+|18f4aebeac09bd57cf90452facf456a4c6b56dd53a79d08eb5a1d20435acaca6|18f4aebeac09bd57cf90452facf456a4c6b56dd53a79d08eb5a1d20435acaca6|
+|481eee236eadf6c947857820d3af5a397caeb8c45791f0bbdd8a21f080786e75.docx|481eee236eadf6c947857820d3af5a397caeb8c45791f0bbdd8a21f080786e75|
+
+||Domain requested|
+||IP requested|
+||HTTP/HTTPS requests||
+||IP C2|
+||Domain C2|
+###### This can be exported as JSON format [Export in JSON](https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Russia/APT/Gamaredon/06-08-19/IOC_Gamaredon_06-08-19.json)	
+
+## Links <a name="Links"></a>
+###### Originals tweets: 
+* [https://twitter.com/spider_girl22/status/1169830999837986819](https://twitter.com/spider_girl22/status/1169830999837986819) <a name="Original-Tweet"></a>
+* [https://app.any.run/tasks/99305ee6-3b20-4950-ab29-9dc44a18b380/]
+###### Links Anyrun: <a name="Links-Anyrun"></a>
+* [протокол.docx](https://app.any.run/tasks/99305ee6-3b20-4950-ab29-9dc44a18b380)
+* [18f4aebeac09bd57cf90452facf456a4c6b56dd53a79d08eb5a1d20435acaca6.exe](https://app.any.run/tasks/31b1bef7-948e-4813-9445-b22ef3ab3837)
+* [481eee236eadf6c947857820d3af5a397caeb8c45791f0bbdd8a21f080786e75.docx](https://app.any.run/tasks/a7eab6e6-b57f-4892-9607-c615a940bf6b)