VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder
<h1 style="text-align: left;">Introduction </h1>
<div class="interval_12">We have recently started a new blog series called #VTPRACTITIONERS. This series aims to share with the community what other practitioners are able to research using VirusTotal from a technical point of view.
</div>
<div class="interval_12">Our first blog saw our colleagues at <a href="https://blog.virustotal.com/2025/10/virustotal-success-stories-seqrite.html" target="_blank">SEQRITE tracking UNG0002, Silent Lynx, and DragonClone</a>. In this new post, <a href="https://www.acronis.com/en/tru/" target="_blank">Acronis Threat Research Unit (TRU)</a> shares practical insights from multiple investigations, including the ClickFix variant known as FileFix, the long-running South Asian threat actor SideWinder, and the SVG-based campaign targeting Colombia and named Shadow Vector.
</div>
<h1 style="text-align: left;">How VT plays a role in hunting for analysts
</h1>
<div class="interval_12">For the threat analyst, web-based threats present a unique set of challenges. Unlike file-based malware, the initial stages of a web-based attack often exist only as ephemeral artifacts within a browser. The core of the investigation relies on dissecting the components of a website, from its HTML and JavaScript to the payloads it delivers. This is where VT capabilities for archiving and analyzing web content become critical.
</div>
<div class="interval_12">VT allows analysts to move beyond simple URL reputation checks and delve into the content of web pages themselves. For attacks like the *Fix family, which trick users into executing malicious commands, the entire attack chain is often laid bare within the page's source code. The analyst's starting point becomes the malicious commands themselves, such as <mark class="red">navigator.clipboard.writeText</mark> or <mark class="red">document.execCommand("copy")</mark>, which are used to surreptitiously copy payloads to the victim's clipboard.
</div>
<div class="interval_12">The Acronis team's investigation into the FileFix variant demonstrates a practical application of this methodology. Their research began not with a specific sample, but with a hypothesis that could be translated into a set of hunting rules. Using VT's Livehunt feature, they were able to create YARA rules that searched for new web pages containing the clipboard commands alongside common payload execution tools like <mark class="red">powershell</mark>, <mark class="red">mshta</mark>, or <mark class="red">cmd</mark>. This proactive hunting approach allowed them to cast a wide net and identify potentially malicious sites in real-time.
</div>
<div class="interval_12">One of the main challenges in this type of hunting is striking a balance between rule specificity and the need to uncover novel threats. Overly broad rules can lead to a deluge of false positives, while highly specific rules risk missing creatively crafted commands. The Acronis team addressed this by creating multiple rulesets with varying levels of specificity, allowing them to both find known threats and uncover new variants like FileFix.
</div>
<div class="interval_12">In the case of the SideWinder campaign, which uses document-based attacks, VT value comes from its rich metadata and filtering capabilities. Analysts can hunt for malicious documents exploiting specific vulnerabilities, and then narrow the results by focusing on specific geographic regions through submitter country information. This allows them to effectively isolate threats that match a specific actor's profile, such as SideWinder's focus on South Asia.
</div>
<div class="interval_12">Similarly, for the Shadow Vector campaign, which used malicious SVG files to target users in Colombia, VT content search and archiving proved essential. The platform's ability to store and index SVG content allowed researchers to identify a campaign using judicial-themed lures. By combining content searches for legal keywords with filters like <mark class="red">submitter:CO</mark>, the Acronis team could map the entire infection chain and its infrastructure, transforming fragmented indicators into a comprehensive intelligence picture.
</div>
<h1 style="text-align: left;">Acronis - Success Story
</h1>
<div class="interval_12"><i>[In the words of Acronis…] </i></div>
<div class="interval_12"><a hreaf="https://www.acronis.com/en/tru/about/" target="_blank">Acronis Threat Research Unit (TRU)</a> used VirusTotal’s platform for threat hunting and intelligence across several investigations, including FileFix, SideWinder, and Shadow Vector. In the FileFix case, TRU used VT’s Livehunt framework, developing rules to identify malicious web pages using clipboard manipulation to deliver PowerShell payloads. The ability to inspect archived HTML and JavaScript whitin the VirusTotal platform allowed the team to uncover not only known Fix-family attacks but also previously unseen variants that shared code patterns.
</div>
<div class="interval_12">VirusTotal’s data corpus also supported Acronis TRU’s broader threat tracking. In the SideWinder campaign, VT’s metadata and sample filtering capabilities helped analysts trace targeted document-based attacks exploiting <mark class="red">tag:CVE-2017-0199</mark> and <mark class="red">tag:CVE-2017-11882</mark> across South Asia, leading to the creation of hunting rules later published in <a href="https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/" target="_blank">“From banks to battalions: SideWinder’s attacks on South Asia’s public sector”</a>. </div>
<div class="interval_12"> Similarly, during the <a href="https://www.acronis.com/en/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/" target="_blank">“Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys”</a> investigation, VT’s archive of SVG content exposed a campaign targeting Colombian entities that embedded judicial lures and external payload links within SVG images. By correlating samples with metadata filters such as <mark class="red">submitter:CO</mark> and targeted content searches for terms like href="https://" and legal keywords, the team mapped an entire infection chain and its supporting infrastructure. Across all these efforts, VirusTotal provided a unified environment where Acronis could pivot, correlate, and validate findings in real time, transforming fragmented indicators into comprehensive, actionable intelligence.
</div>
<h1 style="text-align: left;">Hunting Exploits Like It’s 2017-0199 (SideWinder Edition)
</h1>
<div class="interval_12"><a href="https://attack.mitre.org/groups/G0121/" target="_blank">SideWinder is a well-known threat actor</a> that keeps going back to what works. Their document-based delivery chain has been active for years, and the group continues to rely on the same proven exploits to <a href="https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/" target="_blank">target government and defense entities across South Asia</a>. Our goal in this hunt was to get beyond just finding samples. We wanted to understand where new documents were surfacing, who they were likely aimed at, and what types of decoys were in circulation during the latest campaign wave. VirusTotal gave us the visibility we needed to do that efficiently and at scale.
</div>
<div class="interval_12">We started by digging into Microsoft Office and RTF files recently uploaded to VirusTotal that were tagged with <a href="https://docs.virustotal.com/docs/writing-yara-rules-for-livehunt" target="_blank">CVE-2017-0199</a> or <a href="https://www.virustotal.com/gui/search/tag%253ACVE-2017-11882?type=files" target="_blank">CVE-2017-11882</a> and coming from Pakistan, Bangladesh, Sri Lanka, and neighboring countries. <a href="https://docs.virustotal.com/docs/writing-yara-rules-for-livehunt" target="_blank">By filtering based on VT metadata such as submitter country and file type</a>, and by excluding obvious noise from bulk submissions or unrelated activity, we could narrow our focus to the samples that actually fit SideWinder’s operational profile.
</div>
<div class="interval_12"><pre>
/*
Checks if the file is tagged with CVE-2017-0199 or CVE-2017-11882
and originates from one of the targeted countries
and the file type is a Word document, RTF, or MS-Office file
*/
import "vt"
rule hunting_cve_maldocs {
meta:
author = "Acronis Threat Research Unit (TRU)"
description = "Hunting for malicious Word/RTF files exploiting CVE-2017-0199 or CVE-2017-11882 from specific countries"
distribution = "TLP:CLEAR"
version = "1.2"
condition:
// Match if the file has CVE-2017-0199 or CVE-2017-11882 in the tags
for any tag in vt.metadata.tags :
(
tag == "cve-2017-0199" or
tag == "cve-2017-11882"
)
// Originates from a specific country?
and
(
// Removed CN due to spam submissions of related maldocs
vt.metadata.submitter.country == "PK" or
vt.metadata.submitter.country == "LK" or
vt.metadata.submitter.country == "BD" or
vt.metadata.submitter.country == "NP" or
vt.metadata.submitter.country == "MM" or
vt.metadata.submitter.country == "MV" or
vt.metadata.submitter.country == "AF"
)
// Is it a DOC, DOCX, or RTF?
and
(
vt.metadata.file_type == vt.FileType.DOC or
vt.metadata.file_type == vt.FileType.DOCX or
vt.metadata.file_type == vt.FileType.RTF
)
// Different TA spotted using .ru TLD (excluding it for now)
and not (
for any url in vt.behaviour.memory_pattern_urls : (
url contains ".ru"
)
)
and vt.metadata.new_file
} </pre> </div>
<div class="interval_12">Next, we began translating those results into new livehunt rules. The initial version was intentionally broad: match any new document exploiting those CVEs, uploaded from a small list of countries of interest, and restricted to document file types like DOC, DOCX, or RTF. We also added logic to avoid hits that didn’t fit SideWinder’s patterns, such as samples calling out .ru infrastructure tied to other known threat clusters.
</div>
<div class="interval_12">A good starting point when creating broad hunting rules is to define a daily notification limit and if everything works as expected and the level of false positives is tolerable, begin refining the rule as more and more hits come to our inbox.
</div>
<div class="central_box interval_12"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASIAAAC9CAYAAAAX+XCUAAAQAElEQVR4AeydD1yUVb7/P0oxLQr+TzSkNXC3ZbQVciMsE6NEagXrRrkCFQyJQVo/Fu9e5uo6bd2hbsRt9VrQgrSBXYu9FWMJeCVHLWnMwH451C5j/hqxkPyTYlwHtX7f88wAg87AgDMwzHzn9Zxnzp/v+Z7veZ95PpzneezVyJCZd/7EiRnwb4B/A0P5GxgJ/jABJsAEhpgAC9EQLwAPzwSYAMBCxL8ClxPgAZhAXwRYiPoixO1MgAm4nAALkcsR8wBMgAn0RYCFqC9C3M4EmIDLCVyxELk8Qh6ACTABjyfAQuTxS8wTZALuT4CFyP3XiCNkAh5PgIXI45fYAybIU/B4AixEHr/EPEEm4P4EWIjcf404Qibg8QRYiDx+iXmCTMD9CbhAiEIRnb4KBeocZD8QjqC+GDjcnoiN1RWoWB3ucA82ZAJMYHgQcK4QBSeibGcRilfEIHxmJJL/JR811WoogvuGodpSBc0aK7tlauykvslWVbKrfCHzs6rgLBNgAh5BwKlCFJWVgCi/Rrx8fwIWxCciYo4S5bUNqDH2zcrXj0RGZmXn44sxAVTXVVWB9LsSEP90Q1cNZ5gAE/AMAk4Vokl+pCQXTTjdxUaHvBcq0NxZjl6BsupKGD6vhWF/JTS5kdSSgOLqKjw4HQiJq4JeV47ivxZB/2Q4AvzDka2jui2ruuy6dk1ryGZLDjJfKYf+APk7UIWa5+PIznyEZaixcy/1FW376Vv4kXZYgVBssPShOOo1amRHmfvw2VMJ8LzcnYBThUjzhg6HfMORu6UUZesSENZj9nTb9qdEyI++hfhZMYj+ow7+/7QSBVE6lBRUoqENOLIrH7nPFqHk9U3I3fUt0NaI8meprnAbeaLdkdghkdZRAZBRWR6DRHyA9PgkZG87gZDYJciVGlfgucfC0fa3lZDPprbtJ2D6phbpi2iHtiwHWfOAmqdiEDorA8V1RtTXSZ34xASYwBARcKoQoS4fsY+sx1tfAPL7VkFzgHY9a2LMD6yfuAMRMhIWxWY00mSbt6lR980UyO9pQR0JxTmq62ivhWbrHtTV6qBpP081JrRupTqtgfI2jjY9yh/fhDpjCzSFjTjiMx4hi8luWSiCZC04WCD6UdsXLcB0OWKpCW0dMPn4Y1pUHAmlAS/nFUIL/jABJjCUBJwrRGIm+kooFamIiM9BnrYNIQ/l4D8yqGHyaHrQHAaFuEWypITJJAomanPGYexAB2iXNJac0c5M3xaMKHUMiWAgFNEzEHC0CTXUhK3rkfd6EyYuyYFGVwGNOoFsRAMnJsAEhorASJcNbGxAyVOVqG/zRdBsenZzpgNob0RJZBzkVin+2SuNwFZ/2lUdPIkxt69Cja4UWZP0KHmBdmCSKe2QXsjBgsgkpBTq4b9wFV5eLTXwiQkwgSEi4EQhCof6nUrsfCkRUZbX9UH3zECQXwe+a6oC3mxAo08YFku7FPNsw24Jt+xGTsJkAnz9rP6NkBAuHxnGYCCfZCREmaBNTpBELyJeSbszi58lK6CiWzeAbglLq9D4PeA/LtDSyF9MgAkMBQEnClEDyit06IhYgbL3a6HfXwvt8/RUeM8mZBbQ1IyFyNyoAxYqobW8xap4KQ0pEdSGWtR8dhLTFubTW7NKVIgdikW4MoVttQrxwszhVIu6LycgXlNF/ixpdymKsyMRPyMU87OLzPX71Yj1obgL6RmSw77ZkAkwAWcTcKIQAY1v0IV9B70RU6iQ+7QKKffGYcHKiq7X982lSiyYk4QUJb0J+8NKyOeuRF69eUoVTyUiWvT7w++R+ALVkXDFz8lA+tNqpC9XQYMKpMyNQexaahPH2lSEzs1BichLiR6Uz0pAShkVliQidrIeefErkSXeulHKq78a0Q8kYpK4LaMY0tdSDDkZCF1APozUhw8mYJ8At7iYgFOFqDPW5n17zG+/bF7gLfSWrBYaG2/CpH496g3QirdoNv10jmbj++YpmNRxFoeMoj+NtVWPM8Ls1Ek0im9xW7ad6nuMJTXwiQkwgSEg4BIhGoJ59BzyL9ugvRCJ4v30zOqdUtTtLYXqxharB9Y9zbnEBJjA0BLwTCEyViB9URxC71fhuU2bkL00DhGLxD8nGFrYPDoTYAK2CXimEHXO1diAmr5v7Tqt+ZsJMIEhIuDZQjREUHlYJsAE+keAhah/vNiaCTABFxBgIXIBVHbJBC4lwOXeCbAQ9c6HW5kAExgEAixEgwCZh2ACTKB3AixEvfPhVibABAaBAAuREyCzCybABK6MAAvRlfHj3kyACTiBAAuREyCyCybABK6MAAvRlfHj3kxgcAh4+CgsRB6+wDw9JjAcCLAQDYdV4hiZgIcTYCHy8AXm6TGB4UCAhcgdVoljYAJeToCFyMt/ADx9JuAOBFiI3GEVOAYm4OUEWIi8/AfA0/cWAu49TxYi914fjo4JeAUBFiKvWGaeJBNwbwIsRO69PhwdE/AKAixEHrHMPAkmMLwJsBAN7/Xj6JmARxBgIfKIZeRJMIHhTcBlQjR6zLWIXPgYlj75OtLWvg/FH6sGlERf4UP4Ej6HN26OngkMWwIuDdwlQvTLiEV4cFUpwm6Jx6gxkzBixMCHEX2FD+FL+BS+XUqEnTMBJjDoBAauEHZCFUIRuXA5RpD4jBx5lR2r/lcLX8Kn8C3G6NNDcDhiF8cgvjNFh/bZpdsgEWV7a1HzTHfNsMtFrUDFjnJsTBl2kXPAXkjAqUIkbp1uu3clrvb92YBRfvW5FoX/fBteemIm3i/OvsyP8C3GEGNd1mhdMT8JeWol8tbkmFN+EQy6chSnBlpbDU1+mRo7q9VIduLoyRvKsXNDgpXH0ZD5ySCzquEsE3BXAk4VInlkAn766ccBz/X9kmxoip7AufbTko+mA9slQZIKVicxhhjLqspO1ojKyDjIRZqThJcNExD9QBqi7FgPWrWPL8YE+DpVJGR+/hjj59s9hbp8xM9NRHpZd1UvOW5iAkNKwKlCNP1X8yBuoX76qeecHCmb2s+gqWF7z46WktghWbLSlxhDjCUVHD61oOCrFmDceIRRH7GD0G9ZRTnLIXYpuiKoYPsT9JASNburYPi8Foa9Vjur6FXQ7KY6Ua+rgOaZOIuDQCSrS1G/39xWTzsgRTA1rSmC/slwBPiHI1tXhR4xUDOCY5D9Unc/w95SFCwRDeYUdM8quuWyxHGgkm4f46DaUoXsm0cj4OY06MmnZo2wpbjEDnAZEL6OxqxWIVFUW1JmSQXq/5omlezOTWrlExNwPQGnCpFfwAQp4hEjpK+ukyPlfdv/0mV/aeacZYdkXd85lnVdr3m6wAsiSAmOGlFDhmIHIbPeQYhdCpWt9hRkZTmiclCyeh7wYT6iZ9Fzp7+eQsSKf0UmNaufTEBQU6FUH/10Leq+aqBaIGpdHnIXAto/JiF0VgaKj8mR/UwS8M4m5O76FmhrRPmz+cgt3CbZd52MgQgZ14SNmeZ+JVSOf0wJaRcn4vhTAkK+rkDKvTGIVlZBS+O9VZgP7VHgjL4SueSz4B3hjXZctEuS+QAN279G63VyxHYJWhIWzByNQ59sokDtz0144cQEBoOAU4XoigK+dNt0Rc46OwcjgXYIYpeg1ygR69OAko3r0dzZ7OB31AOzEXJcB5WyVurbWLQb+ovBiKIHwW0XAFkgXeS3BKJ5WyHySmnXhXAkRwWjddd6ZG8TZQNe3tEE04xwKPQ6aNrPAzChdWstNFoD5a2Pzch6RI2SfS0Ii74e+qMn0LmLk+LoaMBGxSbUGdE1XqO2Fqcvko9zJ6Ahn1o95a2Puk2oOzwe8tg4c23GrQiDAXX/STrUy9zMxnxmAs4h0JuXkb019ret/QxdNP3tZLG/ZVGGJXf51zWjxlxW6dhY30JLO4TcNwww+VD+uRzkaS9z1WdF2Fh/IDASxZ2ipktDhE8bTBeBPNV61HSEI/fVzajXqJEbLdyFIiAAmDZfLd0qSUL4hByyMx0kP6K9txRquaWrQvm/JCNlhqzLWIrjeAtKumoczbTg5ToDJt04T7o9y5xLbxC//BgF1F3yaWdu1MwHExgUAk4VosNf7MGPP16gB9bmh0Sdm5yfLBlzLWy2y37mj9DZd0uT7rSXCnTKeO5DOlM/6QxpDDGWpdjL13mcph2C5s//hoovJyA2OwdRvVjba/quvQNo0SFdPPTuSslIf4N60O1Q9n0JCE3Kh6ZNDsU6NeJxEiYTcGSXEvIue3povkiJcurS67F6NVQxHah4JA4Ri1KR+NnZLnMpDv/xiO+qcTzTvFmPxnEzELs4EVEzgMa9m6XOkk97c5Ms+MQEXE/AqUKk11VixIiRGDHC/JDI8tVdtsxnxAjb7b9N/w8krNiIn40eK1nOCF+Ip/7zoI3+I2mnUSnZOHZqQd5GHY5MpwfBTwRKXWqOtQGTZyCXHhsBkVDFz0CA1HL5SVPbhO+uC0d2Bu0kpOZARN0i8oFQrF6BeOFDX4XiT1tgkvliEmpRc/AkpkWlIVMudQCCwxHVmaedEXxkGIPLP/HB44G2b1GnF22hyBRlkaUkxTExHOm5kVSig557KZaZ820mQHaNP1XaOYzrodWPhvzhuyCHHtVFZjvJp825mdv5zAQGg8BIZw5y9nQrPnp/A853/O+A3U6fOR8rnv9IEqB7FeLmoacr4VuMIcbq2dJHSatC+b4OhC/LgYKEo7nwQzT6hEKhoTdX+5WIqG/AoS4XBnx3CghZuAG5ou5dJXLfaEHI40UkgFXQ7y9F8Z+SkXzTPMjnxqFA+KDbtpqHg9FcWwFx61SxMh/lxmBkbyZ7atO/rYY6LUF4A95soLHDkLmf2qpVsN7haP5bh0Nj56FYtOleRMKFFpwx9wKkOIwIekhtjoOee2XdG45wai/bR8+abkqS6ne+FEM1lx8Fuw0IuDEUps9qpRglC8mnjblJjY6f2JIJXAkBpwqRCOTv9dXQbX+Vbr9+lG6hRJ0zkvmW70fJtxijT59lOYiYlQqllWGJgm6h5tJbIiNVGgsRPycD6WvzkfVIAuLzVIjtsm9A9uM5yHq2HJ37Lm1eBiJmZ1BdPrIzUyFfRML2fytgvi1T0dsqNdLj4xC7VkfOxaGDaimNl2Rpuz8OC35v8dY59tPUZ7kKGmHembT5iBVxibbEBMQqaFwRs6XdOo6spBhEJBWigdqaX8iAfCkJ5lolUp6qpRryMysBKWWU7TyKVkJOb/2iHq/qrJG+rX12zU1q4RMTGBwCThciEbYQirfWp6JxnwY/nP5OEiVRP5D0008/Sj6EL+FT+B6IH9t9DNDSM6TL3jIJY2MDarbq0CjyXclsX0NvtLqqREa8Cdu6R3qTJYo9kt024ctOH3qjpbXnT3Iu+tbisrjFWNsb0CzZ9Pdk9nnZ3Prrhu2ZwAAIuESIRBzi1km3/S/Y8ueHsemZe1Hyp7gBJdFX+BC+hE/hmxMTYAKeRcAhIfKsKfNsmAATi/mmJgAAEABJREFUcDcCLETutiIcDxPwQgIsRF646DxlJuBuBFiI3G1FvDUenrdXE2Ah8url58kzAfcgwELkHuvAUTABrybAQuTVy8+TZwLuQWBwhMg95spRMAEm4KYEWIjcdGE4LCbgTQRYiLxptXmuTMBNCbAQuenCcFj9JcD2w5kAC9FwXj2OnQl4CAEWIg9ZSJ4GExjOBFiIhvPqcexMwEMIDBMh8hDaPA0mwARsEmAhsomFK5kAExhMAixEg0mbx2ICTMAmARYim1i40gsJ8JSHkAAL0RDC56GZABMwE2AhMnPgMxNgAkNIgIVoCOHz0EyACZgJeIsQmWfLZybABNySAAuRWy4LB8UEvIsAC5F3rTfPlgm4JQEWIrdcFg5qOBLgmAdOgIVo4Oy4JxNgAk4iwELkJJDshgkwgYETYCEaODvuyQSYgJMIsBA5CJLNmAATcB0BFqL+spVHIj46tL+92J4JMIFeCDhXiILDEbs4BvFSmoeo4F5GttGkeKkcdZtXIEq0PVMKw958KER+iFKPeCiGaIpJv1mNvPw8lK1dgYod5diYQg1OOxKxsboCFavDneaxV0c0n27GVzL2lfTtNUJu9BICzhWi+UnIUyuRtyaHkhJl79ei/h0lkh0VJJkMMt/RQ4R+FTS6Iqhg9ekRTwySbw9Ga20O5HMSkbJjNGR+FK+Veb+zy9TYWa1GslVH2VW+5NeqYhCzVzJ2z742WA7iPIbtUF4cuHOFSAJpRGVkHOSUQpdugn5CDHL/nGPe5Ujt9k8ljyciIjEfdfZNXNgiBMAXvlYj9IxnPEiX0NHeYLaoy0f83ESkl5mLAzr7+GJMgC9kXZ0rkH5XAuKftozRVT8YmSsZ+9K+NCc/3x4sB2MGPMbwJeACIbKCod+MlAIdzoRGQrFY1Icied0G7NxbBcPntTDsr0DZE923IckbyqHfskoY9kjh64qgr1Yh0apW8UoF6v+aZlVD2TVktyUHma+QnwPk/0AVap6Po4bOIxK5JeWoF200fr1GhUw5tYmdyf44hCAYCboqGsu8S7GOR7UlDVH+QEhcZ7v4q1+O4mXUXzpCkflSaZdvfXU+sqOAoHvSsPGdSui7xlSa5yFifTIcAf7hyBZjSvNOQHF1FTRrJId0CkSymnzup7lQvPodG6C6J5DqxSFsafxsimN3rZnnTvOYohWIhGpLpbmeONQRF2t+Zhvrs/BnNbaIb4tS4iXFfoDWKpXWT8Qj5nKgEprcSIsDq752WFoM+YsJ2CTgWiESQ77bAEPbeEy7RRT8EXadCbv+fSVCZyUh+0MTolLSkCmaKMn8/Om2xJdyPY+GUj0OBYYjvut5TCKifz0ezQc39TSU+UImj6EL/QOkx5P/bScQErsEuRYrxatKKGacQoUyCaH3qqGlizX7RRWiP6zAc2804gy+hfbZfOQWVFAbKJbueN4qrERDG3BkV2c7jSXi9YH0Ubz6IrJvB7SqDJpbBjbuMqCetnbN04Jx7RflFE8MQpdWoHlyDDKfJ/F9ZxNyd30LtDWiXIxZuI38kE+xQ7JskaLW5SF34dWoK7D4/DqYhPxfkS3d6grbKYh+QI6Dop12nw2ycCQuiyE/dKxbQbfETci7l8aNz4fm069B4VCDvUP4o2QZGxLLeVjYVoHE2Rko+MwXUVkboLheB5Vgq21D2JJkZEvuqF9n3HZYSmZ8YgJ2CLheiHoM3ADl8hyo3jUg6JYZgPEUzviNRlAPGxsF43po9b6IuCvJ3JgSCblPI7QvmIs9zm16lD++CXXGFmgKG3HEZzxCpN1YGhb9ejQO7fo35G1robFrkZ2nw5HrwqG4vQE135kAnMfprbXQbG9AM5Wsj0btCZyjio72WhvtFt9VucimuQEGvJxXCC3oU0Q7OWUF6oyhiL6hCUeOA2Mm0ls3vQ6a9vNkYEKrGFNroLz1EY7kqGCYPqtE1huijXwqSAwRhtjUbrtDtRlQijFp91n9xVlMCiSuorm9A/ANRERMOIKMtch7gURQ1PcnCZZPVaJRzEfbhDOyFtQlFUIj2H7aIq3dxEv9GftmeWkXLjOBka5H4I9rfGiUC5QQiPjV+dKtmUadhvSocZCJagdSwW66GG+8VfoLrIieAZmhAQV99TN2oAP013qsMByPAL+zaP0HiZAoilR3ltpH41rLtSuqBpZs+O50JE9Agbg12/8i1qUtQahfZ0Nf36EICAC++6bCyrAN5y4Ck65LsKq7JCuzPOx/4QWotp9H1JP50O4uRXF2523UJfaOFqX1c9SY7ZhA/wi4XIiC6BlQmN+30G+nwBavQu7DgWh8NpV2N6mI17TARNUOHUXbUNcehujVMYi6wReNuy+5LevTyVmYLo7GmEArw2BfkikSp6+s6gaUteHb4idXtQqxpiokzknAgvtW4tM2S0OfXydhIjgBYy23Wlb23x2rtCrZyxpQriTOszOQW3UWEak5KF5sz5brmcDQEnChEAUiKlWFskfDYNpXiQLxgOLGCZjU/gM92xG7Etod/SoQ9EffQQJVKNn3LUJiUiH3M2BnkYPduszeRV1TB8KilYgPFpWBUKyLxLS2JmjFm6/vO0gUr8aYKNHW32TxHUsPuSXfQNiyRHpGE4MQunc509KARuFSnoQZVBZZKZ2h2ycfGcbA1qcWNQdPYtLNS8wP1Mkk+pl7EOFnxKfbqNDHEZS6ArnSg20DKjbr0dzuC5n12H30v6LmK2J5RSN7eefhO/2Rzg89GA/SGx7D55tRlhWOju3rkaywPJ94cwftakKheJvePOmK8H8mn8IRewE00y6D3iglv9i9I6jbuI8eWk9BwJcf42V7/ezWtyDv95ug9ZmHAg2Nv38zcmeeRM2f81Ei+mzdg/pjUxD7CrXt3YBcUedwsvi+EA6V8E1vwTTZCYi6vRblHxoREK2Gnur0r9yFc0fPdnt9swGNPmHI3E9jVqsQ390i5SpW5qPcGIzszdRO/YsXj0bj64VQClGXLOydwhB7YyQS1ZvN476diJBv9qCk9BJ7G4wvsRhY8YpYDmxI7jW8CThXiMpyEDErht4aWRLdjsQqxcNOCyRjBVIWJCFFmY+sNLpVUazEglmpUFqaSxQJCKU3PFKxaCUSV6rx3Jt6qSidjCROprOo37FZKl52WpuK0Lk5ZmGRGvMROysBKWLHI8o0fvqiOEQvVyNXmYPoyFRkvSl2Z6KxCln0MDzlnym2x1Yij6p6xAOKfW4MYtdSg3T04nutEtFzkukhM6ClmORJSuRSXewdqUhJTEAECbPkwliI+DkZSH9ajfTlKmguG0MH1VJikqRC7rMkVLMTkVigk7riMlugO95GlPzBfFuWRW/ksjOTIL8vH9LDc1h9ejC+ZH4Udw+W0tp2rxV6lC/pi8tZWo3KWSZwGQHnCtFl7m1V0JuX7bX0FsxWW8+6Ri3dnuwTQhGIoOBQZJYkIPxUA0o6haWnucOl5n17bLz5Et0dj01Y20o2fYs3ZDbexJn7G6ClHUSd0VyyeRb9t+og3d7ZNLBXKXx3MrRt083YdvvAa6+c5cDH5p7DjcAQCNEAEMWkoUxThKzrjSh5ToXL/rLDGz48RybguQSGhxDVqrFgdgzkd9EtE6uQ5/4aeWZeS2B4CJHXLg9PnAl4BwEWIu9YZ54lE3CEwJDZsBANGXoemAkwgU4CLESdJPibCTCBISPAQjRk6HlgJsAEOgmwEHWS8PxvniETcFsCLERuuzQcGBPwHgIsRN6z1jxTJuC2BFiI3HZpODAmMPwIDDRipwvRlGm/wG/m3Yf5camcmAH/BjzkNyCuaXFtD1Ro+urnVCESgV53fRj+cXAvdlWVcmIG/BvwkN+AuKbFtS2u8b5EZSDtThWioJ/L0aSvw+lTxwYSC/dhAkzATQmIa1pc2+Iad0WIThUiv9FjWYRcsUpu4pPD8G4CQozENe4KCk4VIlcEyD6ZABPwfAIsRJ6/xjxDJuD2BFiI3H6JOEAm4PkEuoTI86fKM2QCTMBdCbAQuevKcFxMwIsIsBB50WLzVJmAuxJgIXLXlfHEuHhOTMAOARYiO2C4mgkwgcEjwEI0eKx5JCbABOwQGFwhCo5BtjofNburoFljFdGaIvP/GllXZf7essqqkbNMgAl4OgHnCZEjpK4bjwB0ADJfyGTdHYL8RsF0cBPkkXHmtHR9dyPnmAAT8HgCgytEdRVQKRvQerEn19jJ/sBFEqie1VxiAkzASwgMrhD1AlU2Mw314tZsbzmKUwN7seQmJsAEPI2AWwhRSYEaWY8lIIJuzbK0QPRjOVB4GmmejxMIsAtPJeAWQkRPqKHVmxFrlQdwyH8CQsxFPjMBJuAFBEYO/RzjkLs6AUGWQMLWyBHSdgKHLGX+YgJMwPMJDKoQJW8op81PGqLo2XRIXBX01WokB/ti0tw01OyvRN2OSlQsvhrav+SjxPPZ8wyZABOwEBhUISpfmSy9ng+dFYPQOfSqfpES5cZKZN+XAPkjauT9uwqxkclIL22xhMdfTIAJeAOBQRWiXoHqddBsb0Bzr0bcyASYgCcScB8h8kS6PCcmwAQcIsBC5BAmNvIQAjwNNyXAQuSmC8NhMQFvIsBC5E2rzXNlAm5KgIXITReGw2IC3kTAk4TIm9aN58oEPIoAC5FHLSdPhgkMTwIsRMNz3ThqJuBRBFiIPGo5eTKuJsD+XUPAqULUfvZ7jBk32TWRslcmwASGlIC4tsU17oognCpEzf9PjxnyKBYjV6wU+2QCQ0hAiJC4tsU17oownCpE3x75B45+3YhfzJyL+XGpnJgB/wY85DcgrmlxbYtr3O2FSAQoAv1kzzvYVVU67BLHzGvGvwHbvwFxTYtrW1zjrkhO3RG5IkD2yQSYgOcTYCHy/DXmGTIBtyfAQuT2S8QBehQBnoxNAixENrFwJRNgAoNJgIVoMGnzWEyACdgkwEJkEwtXMgEmMJgEBl2I/G64DTddN2Yw5zh4Y/FITIAJDIiAc4Vo5lIsfzwZN11jFcu4hXgwKxu/nWmum3zDTNz0q2nmgiPnkeMx9df34LfJWbj7l450cLGNvXhGTsdv/ikLjy5fBcXSxZjuZ4nDXj2uwuRbH0VyOtkvV+COG8ZYOvAXE/A+As4VIuLXcX4Mpv9qFOXMx1gSHZ+2H8wFOh/eUYTyHQcp5+DhOwYBuADIZJBd7WAfV5rZiWdq9D0IPbkNr726Hv/VNAHz58+Wophqpx7T4nD3L1rxP5vWo6TcgIl33o1Qp6+GFAKfmIDbE3D6T9909BhkoXPgK019OuTBp3H8TLcwTZ6fgd/Nny61inzCnQuR8IjYSWRjefJCXPafzJ47jC8/a8Kp81KXPk/yJRm4+/b78DtFFhSPZ+N382bixlgFHlWsot3ao/jNOOFChqmRS/E72o2IeoUiGTeJ+pE34s7UDNwx5SoyGgX5klW4/+ZLdio245mG6UEXYPz8MPUD2vWHcWbqdATDXj0w8RXXXAwAAARCSURBVOdTcfHw5zj2I3Vp34/DpycjuB8bRerFh1cS8MxJO12I0H4QTQjFr8X1O20mgtsM+KYXdhMnmLCrbCNee3UbDLLp+OWUXowdahqFib4H8VbJRpS8/SVw02249mA5XitZj+qmUQidKa52E443bsdbxeul+vcMoxBx843Aj1/igw9P4Ib5d2DstDsRfs1BfPDpaQdGnYpx/qfx/XGL6blz6LhGBn/YqwcmTxiFtlNHYP78gI7zMvj5m0t8ZgLeRmCk8ydsgt5gwnT5FEydMRXH/3Gg1yHaW434XuwK8CWOnRiFgAm9mjvU2NbahIvC8tgJtOE0Thw1iRJM5y8AI8VuB+ig28VxMxbizt8m47YbZPAdLZSTzJqq8PHZmXjwt1NxeOcH+B78YQJMwNUEXCBEdJF/cRim4PmIuLYVf29y9RQG4n8KfvNQOu6Y2or6/9mCtz9ptXISAP/RF9HRAfhYRMuq0U62FafaxmDsREsz9fO5eAEm2KsHjp/6Af7jxO5M9LkKGEn2Zr0UFZyYgFcRcIkQ4ZwO+rZrMbb1IIyuwjlyCqaHzYDfgPwHY/LEE/j7rgP4ni5+/1HXdHnxuzkW8tMfoWxHK4LvXojJDhE6jG+OyTD5evOuyjdsGia2HIEB9uqBY0daIQu8wRz/NTdj+sRWfHOoKwzOMAGvIuDQZdZ/Ihdg2FGOt/dc+XZo4q2P0oPmxbhxFDB1Lj3UfuhOSBuPn9+KOxcsxK3X9z860G3g4aPX4taHH8X9yxSYPwnmWzm/23D37HP4ZOcBXPx6Kz7+LhR3zjM/WO8cxV48h/fo0D47GQ8mKrAsEvh4u07qYq8eX32AT/53Jh5c9igeTJqDC3uroJduUaVufGICXkXAuUJ0cAv+a5f5zRFMJ9F+3sxS/24B3jtozh/bVdRlY50XrdZ2oizS8Y9fw2v0oLnklQK8+io91H7zA0jPhL/aig8Mp2Hq/pcBwhw9fejw3sYt0EsttAvpGvs02a3Ha3/T4L0tRXjvvddQ8i4JR/tHqCzZAv050eECDFXru2IVNSLZjaddh+qSIrxb/TeUCR/twpqSvXp6dqV/j+bz3xTD6xtRfdCRh+Lkjw8m4IEEnCtEgwho7M1LcRMJx0fHBz7oxfaT6HDqLuQCPQQ/bd5d9QjLXj0ZWQk2lfhgAq4m4Jb+h60Qff9pOSr3WHZfbomWg2ICTMBRAsNWiBydINsxASbg/gRYiNx/jThCJuDxBFiIPGuJeTZMYFgSYCEalsvGQTMBzyLAQuRZ68mzYQLDkgAL0bBcNg6aCQwdAVeMzELkCqrskwkwgX4RYCHqFy42ZgJMwBUEWIhcQZV9MgEm0C8CLET9wuX5xjxDJjAUBFiIhoI6j8kEmEAPAixEPXBwgQkwgaEgwEI0FNR5TCbgzQRszJ2FyAYUrmICTGBwCbAQDS5vHo0JMAEbBP4/AAAA//+0iUQ0AAAABklEQVQDABOfO7j7ibhUAAAAAElFTkSuQmCC" > </div>
<div class="figures centrar-texto">It’s always a good idea to not spam your own inbox when creating broad hunting rules
</div>
<div class="interval_12">In our case, the final hunting rule ended up matching a hexadecimal pattern for malicious documents used by SideWinder. By adding filters for submitter country and only triggering on new files, the rule produced a reliable feed of samples that we could confidently attribute to this actor for further analysis.
</div>
<div class="interval_12"><pre>
/*
Sidewinder related malicious documents exploiting CVE 2017-0199 used during 2025 campaign
*/
import "vt"
rule apt_sidewinder_documents
{
meta:
author = "Acronis Threat Research Unit (TRU)"
description = "Sidewinder related malicious documents exploiting CVE 2017-0199"
distribution = "TLP:CLEAR"
version = "1.0"
strings:
$a1 = {62544CB1F0B9E6E04433698E85BFB534278B9BDC5F06589C011E9CB80C71DF23}
$a2 = {E20F76CDABDFAB004A6BA632F20CE00512BA5AD2FE8FB6ED9EE1865DFD07504B0304140000}
condition:
filesize < 5000KB
and any of ($a*)
and vt.metadata.new_file
// Getting spammy samples from a CN submitter
and not vt.metadata.submitter.country == "CN"
}</pre> </div>
<div class="interval_12">Once we refined the rule set, SideWinder activity became much easier to track consistently. We began to see new decoys appear in near real time, allowing us to monitor changes in themes and spot repeated use of lure content and infrastructure across different campaigns. Using the same logic in retrohunt confirmed our observations that SideWinder had been using the same tactics for months, only changing the decoy topics while keeping the underlying delivery technique intact.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/8lflR4871YiY9bMEHxBnO4gkf6PyLVZ_-PTxhwDpWGk/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VnZ0RRTUNKQ2hldnYxSXBQWXh1MUc4MndZWnRkSzBsNnVhNUVRWS1ILXFjZ2JFRnNSSVJpeXFWcURHeTgtRllEZEkyZ2kwRUlrOHl5VTd4aTdnS0NlT1dHR2QtVXFrallxSjRoMmx5VUJqcXVMRnF3ODFIbmt0eXVnb0xIbUV0UjJkRkYxRUluWkZFUVNtM2JNWjRqbzJIS1U5WkJQTlZ5MGZXeS1ZaENySmtqU256bHdySExWX19DcWxHX3M"> </div>
<div class="figures centrar-texto">Using Retrohunt to uncover additional samples and establish the threat actor’s timeline
</div>
<div class="interval_12">We also observed geofencing behavior in the delivery chain. If the server hosting the external resource did not recognize the visitor or the IP range did not match the intended target, the server often returned a <a href="https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a" target="_blank">benign decoy file</a> (or an HTTP 404 error code) instead of the real payload.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/oKonS7_goGvIxVebW4jLkgjyWmsf5IhbKYwNGtRrLxI/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VnM01CVXVRTjBzY0ZCY0gydnhSTGNXelVnWHZEZ1VUSF9vZTE2ZWR2ZjI1c3RoeWlCZklIVzM2eU1wQnloV0I2cGVnbGY4d21FcDNRY2RUbGdrUzBlTTdsR3ByczJsbnlfNjh3VWduSEdvU01oNklObGVJamVXQlBIdmdUdEE0cThOOFpucmFTOV9sM1IzamJUd0ZSWG9ZbXhkT0dzSnZFNHVIeXdLenFTUG8xRTBFbWItTEEzRko4QmFBRUU"> </div>
<div class="figures centrar-texto">While relying on exploits from 2017, SideWinder carefully filters the victims that will receive the final malicious payload
</div>
<div class="interval_12">One recurring decoy had the SHA256 hash <a href="https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a" target="_blank">1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a</a>, which corresponds to an empty RTF document. That decoy is useful as a hunting pivot: by searching for that hash and combining it with submitter country and file type filters in VT, you can separate likely targeted, genuine hits from broad noise and map where geofencing is being applied.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/4CLXxskUqc6oTCrURCrN8ufk2QKBbm7hdGfLTybW-os/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoZlJ0am9YWlFSTnk5ZW9hbnp0TFBPRDZEVk9hU2FaYkI0WW9uN0NVNkp1ZnBzVW5rTGtOT2cyUWlwWWRzV1dOT2diZXF6NGkyVldLMXNBNmdDanZXNVU1dkVCd2xXdEpMb3VJNnduN1BDY3lYRllPN2YzVHZOTnlEZFl5cktuNlVvS3JkbUl1NWt3djM0R1Y3cGVIeU11WXZCVnphbWZnWVJvaDJ5WXR4Y1V3SWotY1VlSzNxeDRtN0FiSEE"> </div>
<div class="figures centrar-texto">RTF empty decoy file used by SideWinder still presents valuable information for pivoting into other parts of their infrastructure
</div>
<div class="interval_12">In addition, VirusTotal allowed us to trace the attack back to the initial infection vector and recover some of the spear phishing emails that started the chain. We pivoted from known samples and shared strings, and used file relations to follow linked URLs and artifacts upstream, and found an .eml file that contained the original message and attachment. One concrete example is the spear phish titled <a href="https://www.virustotal.com/gui/file/40fc70e61157b3903a7517b9928c87784070af59d533cdbae5ca2d4d7cbb45ac/behavior" target="_blank">54th CISM World Military Naval Pentathlon 2025 - Invitation.eml</a>, indexed in VirusTotal with behavior metadata and attachments tied to the same infrastructure.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/XPncvoReHTxK6EC1JTQ_0NXPLS3vSJDSsrJllbGhIYg/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoV3RWVmZhVWk4VXZseHotc2loS0ZPaWk0WEE4OFpzLUdOdWUwdW9PTTRfUG1FTzVTVTNCX2pOME1BcjhrMTZ6VFNMLWd2UjJYWHBZaFh2TzNJQThSZ0VTVUR4NFk0X25EQ3RCdGFicFZVZG5vTzFGR1YtX2NQRkk4S1FPdEd3Tnl5V0JvQzE0RTNIVl8wTTUtRDZQY3Z2MnlNWm02S2xYRDF1cjV0M0pGVnhpWDlJT29jV0l2NGJ3UDJ2Q28"> </div>
<div class="figures centrar-texto">Getting initial infection spear-phishing e-mails allowed us to put together the different pieces of the puzzle, from beginning to end
</div>
<div class="interval_12">For other hunters, the key takeaway is that even older exploits like CVE-2017-0199 can reveal a lot when you combine multiple VirusTotal features. In this case, we used metadata, livehunt, and regional telemetry to connect seemingly unrelated samples. We also checked hashtags and community votes, including those from researchers like Joseliyo, to cross-check our assumptions and spot ongoing discussions about similar activity. The Telemetry tab helped us see where submissions were coming from geographically, and the Threat Graph view made it easier to visualize how documents, infrastructure, and payloads were linked.
</div>
<div class="central_box interval_12"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAc0AAACmCAYAAAC4AdQwAAAQAElEQVR4AeycC3hU1b3237kkk+tMSEgCyWQgBAYIREGDgoTGQgylCEdDUxW8nKZyapQqF8+naA8iz6ngOUX0FEt90FiraGsKUihypJFjJJQoEYSQgOESmIRL7vfLJDOTb+2ZCeEWSMo42ZO8k732Xpf/Wuu/fms/885aeybKsLBRHQxkwHuA9wDvAd4DvAdufA8owRcJkAAJkAAJkECPCFA0e4TJzUbsjgRIgARIQJYEKJqynBY6RQIkQAIkIEcCFE05zgp9kiMB+kQCJEACoGjyJiABEiABEiCBHhKgaPYQFM1IgARkSIAukYCbCVA03Qyc3ZEACZAACXguAYqm584dPScBEiABORLo1z71WjRHxyeBgQx4D/Ae4D3Ae2Ag3gO9Fs3v8rLAQAa8B3gP8B7gPTAQ74Fei6Zc1t30gwRIgARIgATcTYCi6W7i7I8ESIAESMBjCVA0PXbq5Og4fSIBEiCB/k2Aotm/55ejIwESIAEScCEBiqYLYbIpEpAjAfpEAiTgOgIUTdexZEskQAIkQAL9nABFs59PMIdHAiQgRwL0yVMJUDQ9deboNwmQAAmQgNsJUDTdjpwdkgAJkAAJyJFAT3yiaPaEEm1IgARIgARIQBDwcNGMRcJUvRiGhx+3TkZC9PcwhlsTkXRrD9uNFj701LaHTdKMBEiABPobAfeIpnhDnp06BympyZeLQ2f+3Mkw9JrsHGQc3IrNW3Yia9X3K5xp7++G6VQ+TJ+t6LWXV1W4MiN1PfJ3/RGbs7dipSScj2/EfqmvU1ux+krbXqX1WPnaemzavhOrb79RxVRs2vZHbH5nPZJuZNpNeVRUJO666048+GAKpHg3ZswmARIgAY8moHSL98VT8OSra7Fh/Xqs/FlXjwkvvIKM9SL//83pyuwm1ilcWa9eYmC9JP49RjV+Wmj8NfZw425WIEsSvbyNSLuxsd2i1WK/OE4qb+icfWkcOf/cOXEJZo/XwPztNiz/xtFEXPICLH93K/KLxAeAy0Q5Exv2lgJRiViy1GHb07MkkFu2vI9nn/0lpk69w15Niufl/R/F006DJxIggf5EwD2iiXXYX+zAZhjXJSVJIxwrRNPR7TA5isVZL7ZcY8X18mO8QW8XLY2mM3870uKNCA+PQ9IK8YbfmX3xeu127MU93Q69od01tocfj4HBXwis1hsXXbV36jjFTb1iVZ25CJMixTgM92Glk5HD8spzLJKSr+ZypVVnOuVxqZ967N+xwZmVhpXrX8LiH8ciTCf8k3x0lkiXnFf3oUh4HD/7eSnZoyAJ5ieffIDf/GY9nnnmefz3f/8Wf/rTFnv8/vsfxhtvrPEU4ezReGlEAiRAAkp3IcjILbR3pTNOQYo9tgSToqVIBYp25YpIIlZuFtugZbvFlutWlJ3Nw571C8S27QJsOliEBWOEiTiMDxWhrOg9pCMNm4tEvKwIe14XBRfTu7Fp/U4UnXW2ky9s7f0AhqekrU9RR9oOzRVXUbdMhKLNXUIutYToBcjIyUeZ0+5Joz33kpPwddtelJVJ28O7UWYSfT4lPgC8uhWml6dAJ1nqpmClaNvuW/Lz2JSTJ+yLkLXlj9hflo/976eJsQnDX7yHImFXVrYTr4nk1UciVn8m1d2KTe9fyuVqy66cybh3bChgKUX+W525u7Du2WVIf/Mg6jqzLr0W58JULjKixgq24tqDQxLFp59+Hv/4x1d2a0lEpSAlSkrO2sVTspHSDCRAAiTQHwi4TTRNbxeIlYxAFqZ3PNd8fAJG+Yt0eSE2ZwLpH69FeoJYTZqFiB4rRZ1aC2Pq88hYpUZZiUg7tzDN506iSJSXiarXPvRIStXDXCzqSAZhUzD/GSFoQlTXPZMoVoFmmD79AJu+rZdKgepSHD9d4Yg7z+m/WYLZo8Q60emLJljrLHFc7L7eGQqz8D3r80KUQ/S5bC0Wl5XiTLnZYWSph+nYSRw3ieRxINygRV3JSbvvdWJFZ0j+OVY/JMpudKxagrQJov+6QuzIzEZRE1Bfkg2p2e6rxkInqqC6AocvGpUiZ9t2bClrvZhzeWQ7yqpFji4Ktzg/ZIjUdQ9JGDsFs9MwKkpi7UhJ5VKsU0ilOAMJ9JgADUlAhgSUbvOpeDuO2LcfY3CLeK6ZcGeUfUVWV7QPW7AE98ZL7/JA/vsPYFridKz8XBIyDeISjVg69wPkC7GQfD2TPQvT5r6ILVKim2DKnIW4hOl49xuHgIVHJQvLGLEtKS4oxZ6frcLSLQWwr7jKv8DsZdulAmdIQ1Lc5b6sy613lkmXJU5fK8RK+B1s/uQd/O2I6Mc/BtOaFmFadqlkBDQVICNxFtKk5WPxGqSJMc174QN8mncQJkmcEArDnQ7THp3VQsTP7cLymfGY/aqzj24rOsdaV35dTldWP14pjVOLMAnXlYVXpKUv/JSWnr0s91LB7CzYt+9rsUXbJaSd+bySAAmQgCcSULrP6Vxsyne82UvPNVOM0htpPfJ3ZQgXBkPrLy6oR53JYfNhufQGLvLEyvSKzVORef2jVWxLSha1LULMpIg9bMf+Y1Jaj3u2bcSOJ26zi7bp6C57adfJKTiX+NJVJsU6fQ1F0qq12LB+LdJuF4ImFXUXotOwOnMnst5/CYsfTIbRocndWV+ev2IdMqRVsRDl2c/8GpuznVvBl1u5PWUyXS6YkgMGQySkIMUvDdfKu7SccRIgAY8hMOAddaNoAjm7ToqtTEBnTMWkKMG+6STy7M/cKlFvX0lq4BMk8sUxP8ypLOWlkGRVZN3kkYtP86XVK6AZMxlx/kKwM19G2hPS89RLmxY+2pegWugMkrBfWibFO32tQM4ry5C+qDO8gHVX6q9kLkLaq08iKUr6JmsGkiLj8Bf7ilsU9OjItq8uJ6WscWwpa/RIeuIlOJ4Ld9eA00cfHRK6M7lGfniQxFx8cDl2jcIrskrElvmUKY5vy15RdFlSr4/E3r2OZ56XFTBBAiRAAh5IwK2iicxtOFwuKIXFwCitLIsPwvFbxHX4W560stQg/ue7sUesplbOCBWGZuRnS9/+3CWeFYqkOIYl/hmbNj5/A9EQhlcdC5A+Q4hgUyn2Z/4Oi19cg99l18Nw1T9HyEB+sbQiBeIe+TP2ZO/Ek5MkMelsUPh6UPI1FAlPLcGC5Ltx74NPYsn9euQUC5uj5Y5tX904zP9wI15bKkRaJfKlI2wilny4E/eOkhLdhF2VjvrQ455302F46j0UmfYi46lx8G2U+hX1murtHz5ErJvjBGqlDyHBoZh20SIdGWIse342zr7ChtS+lBZ9OEwmwyB9g0l6FpvtyLneuaTkLKQg/Taz005afUqhMy2VSc8zJbvOPF5JgARIwJMJuFc0sR05Rc43fkEtf+8acXYcG366zLENqdPDOEYPncWMom3iWaD95ySleP2jfSi3AJqIiUiam4x7oh31en7ehKyDYqUptjmTHl9i31aVtlYztuzEnrWTL2tm5dpNyJPEXRMK45gYQGwZO2TUYbbh2Zcv+powdw5mJ8Rg2IjbkCYVv5WBv9m3gbUwzkjEvVPTsOGtz1AkGpB8n52ohemI8EOyvVYozsQee30NwuJvw79GCCVThSJuxhykJAjRN5ci6/11yLlW3Yt5Ts7+eoxP7czUY5QYizFa68wQ7UvpUaJNe87dMAwVkeKCHq/sf/Ob3+J//meN/Z8aiJr2b9F2fjFIEstnn11k/watVMZAAiRAAv2BgNLdg9gwLx7h4UZ7SFpxae/Z9m3I8OSFYstzEeYlxGHawk3o/Jao6c3HEJfwKNIWLROru+lIL87APKOjnWmLpXauTAOdfRnniQ3exF9jfoJYvRZvx3LRRvqiddh0RBJwDYzxyVIDXWHXGsyOm455C5chLWW66Hc6DJLPCS86bKQ2Zopx2H2V/DHCMHmRU2yysTQxDkmPiG3bhY8iSep714uYlij5Lo1rKpJmTLWP3+73W4/BKLUdPgtiUSrazxX1Zzn6fuJlrHrxPhgjHb6ki/YmGaZjwZuO577CuNtjw18OitVoKG65v1M1hQ/2fhzMOucg3Dkmw6/FlrUayM/egE7m3TbuLJBWkPff/zAeeOB++28y//3ffwkpSD8zkYL0203JxmnOCwmQAAl4PAGl7EZwKBtbMnc5tjqvdK44FzsytyPr0JUFPUiLFVW4RtgFx2JG4t24J/E28VxVWnVJW8BCVEXR5Uep/ScaO6T/lHN5QVfK7uu1/cnftR1btuV2CZDd927G1dWiM3Zl3470Ze05Lbu9fPSOnWHY5J9g+Q1X5YlYOTMWqNuHzS+WdtPktbMlUZTEUVp1SvG9e7+2ry5TUh6xb99euxZzSYAESMAzCchPNL8vjm+/iDWZJ1HnE4OkVLHVef9khDedRNZbLyDNvgX8fXXcV+3mIv3dD7BprVhRS89ar+tGNtat/QAb3ngR0hPk65p2UygJpvTfgDq3Z7sxYzYJkAAJeDSBgSOaKEXGolkwGpzbk5FxME6chQUrLv0Xfh49l1c7/9YqLH3zktXu1RYXc/I/WoWVPdj2vViBEVkQoBMkQALuJTCARNO9YNkbCZAACZBA/yNA0ex/c8oRkQAJ9CkBdt6fCVA0+/PscmwkQAIkQAIuJUDRdClONkYCJEACJCBHAq7yiaLpKpJshwRIgARIoN8ToGj2+ynmAEmABEiABFxFgKLpKpJSOwwkQAIkQAL9mgBFs19PLwdHAiRAAiTgSgIUTVfSZFtyJECfSIAESMBlBHotmqPjk8BABrwHeA/wHuA9MBDvgV6L5nd5WWAgA94DvAdu6h7g+wjfRz30Hui1aLpsjcuGSIAESIAESMDDCFA0PWzC6C4JkAAJfE8E2GwPCFA0ewCJJiRAAiRAAiQgEaBoShQYSIAESIAESKAHBNwumj3wiSYkQAIkQAIkIEsCFE1ZTgudIgESIAESkCMBiqYcZ8XtPrFDEiABEiCBnhCgaPaEEm1IgARIgARIQBCgaAoIPEhAjgToEwmQgPwI9Fo0B+K/TeKY+e/CeA/wHuA90D/ugZuV4V6LptQh/30W/4Ua7wHeAwPzHuC8e/K8S/p1s+GfEs2b7ZT1SYAESIAESMATCVA0PXHW6DMJkAAJkMBFAu6MUDTdSZt9kQAJkAAJeDQBiqZHTx+dJwESIAEScCcBimZPadOOBEiABEhgwBOgaA74W4AASIAESIAEekqAotlTUrSTIwH6RAIkQAJuJUDRdCtudkYCJEACJODJBCianjx79J0E5EiAPpFAPyZA0ezHk8uhkQAJkAAJuJYARdO1PNkaCZAACciRAH1yEQGKpotAshkSIAESIIH+T4Ci2f/nmCMkARIgARJwEQGXiqaLfGIzJEACJEACJCBLAhRNWU4LnSIBEiABEpAjAYqmHGfFpT6xMRIgARIgAVcRoGi6iiTbIQESIAES6PcEKJr9foo5QDkSoE8kQAKeSYCi6ZnzRq9JgARIxAAWXAAAEABJREFUgAT6gIDHiWZ46GDM+/EP8cqLT+P9lU9g959ex7d7NuOv763F2n9/HP+Z/jBSZiRgzHADfDWaPkDKLkmABDyTAL0mgRsTUN7YRB4Wd065A6+8kI4tv/sVnn7wHiSMjcSwsED4WtrQcaoMvrWtsFgsaG9rxYihwZg8ejgW/SgJL8yYiBm36eUxCHpBAiRAAiTg0QRkL5rDDWr88uk4LHr6x0iYPB5+IWHw1ergGxQMH29/eFu84HOyEbbCClSdq0JrSyNUsEHR0YEfhk/DY/q7kfGLCXj5X2yIGOIPvkiABEiABDyHgNw8lbVo3v+j2/H8v02Bt38Qzl44KQSxGS31dTDX10LdaIV/uRdsKh80jQ1G3VA1rG1N0LSaIWKwwoz69i9RUn8QluZmRFi1iB89DNEjhsltDugPCZAACZCAhxCQrWg+9cAcvDQnErbWIGh9fBHYUQ+fjlr4aHXw8g+AskON5gsNuFBrQ5XGB4ogPwwJ0iJ0kA7BYSqEDmuFbdrXyI84h2PWwShs88PBE2cwTD8Ys2f/qI+nR4+EqbF97AO7JwESIAES6C0BZW8ruMP+3x75AR58aD7qI+ah3VsPtU1svzaeg63xLDrEM0yVlxpNXmYcVl1ATsE3+PbAQVyoqITC1wtKP19oI9oRYGjEzoJwfNmmx9tFZnypHoYm3SB7+R3joxE3MqprKG6OrfxsJzZv2Yr891Pd3DO7IwESIAESuBkCshPN224ZgpT7YtA2yBsIj4LKLxiwKhDi0wZNcDRsHRZY2tux5+v9+N8D+/GPf+zG3z/bgf/L2YtjJWdRabXheI0/DpwPw+Hzw3G8wRdHq1tRo/KHly4I5g4rys6fRXiILyLCB90Mu3++rtVZ1eK8dnd5fCP2n8qH6bMV3VlclZ/2/m6YRJ2sV68qYgYJkAAJkMBNEpCVaProtAgJCUHRSR+0lRyE4kIuIqvq4d3YgVqLH7wC61BbWYycnN3YujML/zh0FIcLC3G4oAD5R4/h0LEifFN4DOeqfFBSGQybECerxQqrzQYoFPDy8UFDYyNqqqsQPTIaj947CpFh/nD3a+WP4xAebkTczzIv69owNREJ0ZdkjdXD4K+BRoRLcq8bHW/Q2+37wa9trjtOFpIACZBAXxCQlWiG6MPQ2NyBr/efEsJ5Hs1l2Thl+hol9R0wWYcI8buAENtRFBSewHcni1FeVYPqmlrU1tYIIazGqdMm5OYdQE1FBdRmMzRWC4LVSoSrVTBo1DB4K3BHkBfi9SHw1ygQGWLFfdPEStbN5NM356GsrAhFm9PsPRue2oj9piLs37IRm3OLYMp7D3/5370oezjGXo5RqcI+D5t/kYbNRUXOuKMIqRuRL9oqK/oMOQeLsGCMI9/4kLAreg/pjiTPJEACJEACLiAgG9EMCg7EuKjBGCpWmmUXysSKUIWTBQEoOtOG89XtsDbVCBENQ2V9APYfOYnK8gq0NtbDV9GB2FAd7o8bjh+OCIcGNlQWHUN74SFoTh5Hx9EjUBQehjn/IGJbqvFglA5DAzSoq69FU2MtJhtVGK33Q9+95mD1E4kwaABTznbs+KoUsDSI1XMpTNVOr5oqUHTsJM5UZyArv15kamFMmCOuQEJyDMJEzHzsGL4uKUWdc8vXfO6kqFOKMlHGgwRcRoANkcAAJyAb0YwfG4QhOn/cNS0Rxthx4jGmGu1+QxAxeiwiQtWobzEDfkMRMHYG6hqbEOqjxk8mjMbKB2bjB3Fj0WBVY+SIEZgUo4dWPPf0am5EW/k5tFeWo768HOXny9GuVMESNRIHKhtQXiNWp3U2bM2uRH1zqyxuAx/fVhxevwiGyYuwatkDyCiUBFK4du4LTEt8AEszgQ27ClAnssLGzkQC9EgRW7iAGflfPIOlcz9AfpMoFMeZ7FmYNvdFbBFxHiRAAiRAAq4hIAvR1Ph4Q+nng8CwEESMHIGQ8CE4WnwaOw7vQ37VTpypqxKyEAhLWztQV4f5c36EwAA/FNc24IjpPKpr63H6XBmazW24+9axSB0WipGDgtEEJUyirKbdApu3Gm3mdpyzqHDOpkRVsxUffF6Knd+UIzwyCoFarWuI9rqV7Vj++2yYxGeCsNtTsfz9rSj6bAWSumvnrWzkS6oZFYOU6IdxS7QwbCrE318TVx4kQAIDkQDH7EYCshDNoEF+OF9jRkVNM86bzkDVoUCAnxYNNhWO13gjbNAI3DUmFq1qf6i0Qbgn8Q6MjdZDoQDabMAP42/Honn3ImnKJIQNDkFIzHDMnj8P/zL3Huj8/RDp64UfaICgikp8d+QoWlobEKoPhsrPD8FDIjHm9njEjBvtRuyXd2V6cyEmGe7Dkjcc4qmb8DCeX3W5TVeqc4s2Brf8ZiKMarHOPPIFXgdfJEACJEAC3zcBWYimPliDH0+OwTi9NxrKj0FpbYRhkA6zbrsLt42ZiUFBwxHo5S9CBWAzIyDAB6MD/ZE4OgrxUaEiq0XUaUNzbRWKTSUobmlHcWUFGusaALUaoyLCMFWrgl5hQVuHFePix+DWO8bDIFa1Fyorca61Gt6x2u+bdTftJ2JDbj6Kcp5DUoQZdfadYjPMtcCOEjFeqZbhbuz4cD1WpkoJXNyijZs8UTzDNYut2Q2OAuzCmXJHdFjin7Fp4/NIcSR5JgESIAEScAEBZU/b+D7tLpRX4/iRM9BqvBCus0DnW4aQ0EaEh5qF4GlgtlWjsbEcCks52psbYGvvQJTRCF+xpVtRW42sfV+h4KQJx89dQOGZUpyqaUHBgQKcOXkW8PZDUWMb3jlvxtetKpwpOYfMjC349qsiWDuUUPt6oz06AJhhQJ+8omOgFatF3agpmJ2ajDid2IH+NhPrxHar6Y1M5JQLrzShiJ+RjNmJepEQR+cWragHsTWbI2xFrjhK8fpH+1BuATQRE5E0Nxn3RItsHiRAAiRAAi4hIAvR9PfWoKHOhgv1XjDVtuJ0xTG0Ww7BT/UlBnnvQ01jAUqaT+NEuQ0VTXWw+Wkw4t5ZaBkUhqPl1ahvtaKktAz7j5wQwlmB1upaqEzn0HahEh2i3Wax4rQp1eK5qR+sAputzYIzJ0pw9kwJfHx9MBTBuF09TpS45xgVrnV0ZDUDxRlYEB+H8OSFSF+0DAuSjTDOXIUsyUKUzYubjnkLlyH9kfswaVGplCtCBuaJDw3Sbz3DRzyA1SKn8zC9+RjiEh5Fmr2t6Ugv7izhlQRIgARI4GYJyEI0Bwdo0NbSiNw9X+C7Y4XIP12M0uoSqHwbxCqzCmdLq3DgmAlZh8WK8kKh2H6tQXlHEyxhIShuaMGpujrkl5fjTE09WsztCPRWIsTPFx3qDniplND4SGKpgFdQCLwCAhGk06K2Sqxea2qhtNjg1WCFprbtZln2uP6CUZKpGcdzN0kRRziUjS2Z25F1yJHsOpciZ9t2bNlV2JV1MdZNpDgXO67ZVjf2zCYBEiABEugRAVmIps2mQGN9LcxlVfCvV0HRGIgTlRocMPnjiElsVzbYUFnTjJL6ClS0W1BwuhSFBQdRVlmONpU3zjc04kJDAyztbRgVFoShWi9EjB+FIfGTYNHpUNWsgJePP3yDB0PjHwirRSWCJKY+UPsohXC2ouWctA/aI2Y3bWSuFkL4hxeQ/tpNN8UGSIAESIAE3EhAFqLZ2tKGppZ2hMIXQ4aMQnC4EWW1wOdfncXhU+2ormtBnXh22S6eQbY1CjHNLsCxQ9WIDNFjkFoJQ6APYoL8MH5wIOL0oQjXahAaGYy7fjQXan8dzlfXw6pUwWxth9XWAT+NL8aOHIHJd05ChD4Cvj6+8DJ3uA27YazYcn1uO8TnAbf1yY7cR4A9kQAJ9F8CshDNppYW2NRqFFbX4WRFNfwCBmGkPhY6r2CE+IYjSAifpa0D/lYvIayDxIpShajBEQgQIhqutGFMcCCMIowI1iHY3x/aAB1GDRuJ6GEGPL34F0idPw++YWHieWgTzlfWob21HZF6A0ZNmAq/kFjUNylRXtXYf2eZIyMBEiABEnAJAVmIZk2LFY0WwFuvR5u3AuqORvijGZE6LwwOsGJ4mDeGBKgwPmwUJhlj8cSTC6G0NcPb0oHpdyYibmwcDJHRGBoZgxHG2zAqdppYaY5D6ekTGDN2LB58ZD6WrvgV5i14CIPCh6DD2xf5RRfw0eYv8G3hBVwob8TRY6dcApSNkAAJyJEAfZIvAQXmB4cgKzYCe2KDsRjyfslCNJtsKrR3KKAdJFaRgteh4rP4/NApfHWqBntPVOBgaSPCY36AH6X8EoqQwfZvy9Y3tUMbHI5xk6bi1rvuwfg7ZyBmYgLCYm6Fb+gw5J0pxkdvv4lVS9Nx4sR3UPn6YtwttyB59ix4BQXju9MlKD56BI01NbBCjbqKCtEzDxIgARIgAXcRSIsaDtP0WKy7bQjiIgbBGOEHg7s6/yf7Uf6T9VxazSoEc1ry3YjSR0BviIJK7YeGhna0tHTA0qrAMP0o/HTOI1ArOtDU2oQ2SzvuiI+DzlsJf90ghAzVY8jwEQiNGAaNvxbtVitaFUqMv/0O2JQKHP72W1RUVuD0mRJEGqJx5+RJUCnaYDXXwdpwAQGqdlSd5RNGl04qGyMBEiCBGxCwF7dZYLbaYx5xkoVotpnbEOAbhDGjh0Nls6GjsRVa+EKn0ECn1OCeKT/AEJ0PtKoWaLxU8Fd3AFUliIrUQyGigAJKpQpS1GKxor29HYHWVoyLjcH0WTMxauQIBHor4OOlQGNjA2JHj8S//Wsqfv5ICh5MSYYGFjTV14MvEiABEiAB9xHIKDkNQ853WH3a7L5Ob7In5U3Wd1n1vLwCKBXCHZsCI6PFs8sJt2PC+ImYEHc7tP5BUAgBFdqKVosaXl6+GDt5BvwDBkEh/iSRlEJbWxvazWaYxUpUNzwSQUGDMGzEaIQPHQqNsgNeaIeqo1WqIVa1QzFeiOqkW0bi5HdFLhsHGyIBEiABEui/BJRyGVphwVF8lZePQCF0QyOiMHRoFCIiDDCOiYVWGwibcLSmvhGlJSVCLAOgHTQYSiF/KhFsVhtaW82w2qywWi1QeKkRGBIBi8ILHV4+sIhnpk1NbaIFFXxVoiWLGRofFQID/WAqLcfRgmOibIAfv3gPRUXvIX2AY+DwSYAEXE8gQbwnp3ir0RmSlK7vw10tysr1g98ehUrtBZvYorWK55Jt7RYEhwRj0CCdyBdrSrEXW1NxAX6+GiGVgE0IZEdHBxRKBVrMLahrqENruxkWHy+7yIqdWmFjhbfGG+0WC5RqtXhW2oiamir4aFRQKpX45JOd7mLd1c/rO1F2Nh+mU86QtxFpXaXuiT2+Efv7ol/3jI69kAAJyIaABktuH40NP+gKLw2WjXO9dkTZ6xrfY4XyC+X4++f7IHRQrBg77D1pxHNIadtWYWvDoAAvqJRWtDbXo7mhEo1NDWhpb4NNVFAolGhqbEJNXS3aRR2zuUmsJhVBOS4AAAu3SURBVDUwNzehubFOPOcUYioE1dbeKtoAvDS+2PTRDpw/e97ej7tP5kMZMIyIc4T4hci4woG45GQkRAOGqclISXXEAT0S5s5BytzJMFxlL/Iv2jkKpbpJt4r4rYmijTmYPVUvEo4jLkQLnVYLQ+oc2G0c2eIciySRd2UfcclS+1faCnPnIfWVItVLjnXmdF6c7Ull9pCIOMBe2Fnn8v7tRTyRAAn0GwJWnKmsQdG5rnC8xXMHp5Sb6wfyDmL/NwX2rVZvsaT303jZv+DT0NQkVpL1aG0xo6KyFmfLqlBVWyfEsF2IbId4zukFEUF9fZ1YTVajqb4CNls7mkW6ubYKHW0t6LC0ihWmN9Riy3bbjhzkfLmvT4afFhEqxlF33b5/tmI9Nny0E1nrl2D5r9dj87b3sCl7KzJWPImX1/8RO95PddZPxGvZ+Xa7Jc+8hA9z9mLzUw5xnL30FWS8tRP5f3oJS557CRlb/oxND4lqYpWZ8dRE6HQTkfbqK3h+PhwvdRTSDv4RqxctwZoNXX2kf5znaH/Rk1iXuROv3ekw7zwvFuU5bz+PJaL85bf/jD1rJzuKotOw+eifse7xn2DBspew4VXJJhUzhPinf7wX+z8Sfom+fvdpPva8nuiowzMJkEA/I2DB0hPnMK2wK6Q1eO4QZSeaEsovv8jBAbFV6+/vg4AAf0jfeD1w8Ai+OXgMRUeP41TxWZy7UIvG5jahkx1SFahUKvGs0x/tIllyvhznzpfh/IVqlJWV47ujhbC1NUGlVIlyNT7L+gofb8q01+uLk9gZhm7Sk8g/mAeTKR97Ni64auUo+aU5m4mkibMwaeZ2mMJuQ3j2ozDGz8LsLScRNiEZKcLI8OslWDD0AFbOnI5pCVOR9okZCU+8hE4d1KAQS8aKsvj7sKU4FMbpQtDeXohJog3U7cNqsdpNek40JB0aIO+5eExKnI6kT0oRNjYRCUhD0gQg5w3RRuIsxBlnYelXknFXeP25+5Ag9SHKZ2+rgDHxYVFPlC9KRULdLsye+RjmTf4dciyAaf0ivP7QS3hyqhlbHp+KaVJfrxxAeOoSrI4WdXj0HQH2TAJuJaDB5snjUJY0DitjxJuPvW8dFoh0WZIer9nT8jvJUjQlTPtycoW4iZWgSo3mhlq7OFptCqjUCvEMswNqLxUUKoVYTQqVBKBQKODj6wcv/wCcPV+Fz/+ejd27dqPw8BGx8mwSq9IGIZhKvPPeJ/jbXz9FX742PPsokhLjETcxHgkrDiBo7s+x/BoLrbKSDNh/PVrcilaYUXe20O626Wg56sRz2nCRmj1Gj7r8bGwoFglxZK09KARWj3gRl466swXIkiIoRYsQLV1wrD11zVNTCQ7vcpSYLGZAGyi2UjOw4dMKTHohH/mfrUX6VMcq1mHVeZ6IBe+KFab4EJCVHOqsJ8qaRBsaDYwiiugw6NRSRNpyjkFYyUGs3uVIm97MRn6THsZkR5pnEiABEpArAdmKpgQsd+9XeOqXL+HrA8cwODgAY0ZGIXpYBAbrfBE1RAt/P2nr1iqZ2kVToVDALzgISmUHAgP9oRLbuxofDbS6QBw5UY7nfvU6dn+egz5/FRci3ylypj9ko6hOi7AxrvRKA18XrtqyFs+C4cer8OG5WCz5eCs2/+JSX1OxadsrmO+fi+Up8TB+WtpVuOId7EAyMg7uxP5PfwLd3newPLOr+KqY+qocZpDAQCfQj8dvxrzcAoRnXSuUYqlMRy5r0ZSYlZw24fdvvovfvbkJx0+WIDJiKBQqNYJDQuEtVjEdYqHZYbNBrVQK4QT8Ar3gr2jGWGMMhg83AMJ29+79+PDDv+L0qdOQw+u19eliBefwxPBUIuL8S1HkXHU5cnt+3lFQCp+JM7HcKZJJL0yEofwk9jhFuduW6s3dFl1eoEfKQ3NgOJSJ1T9biM9LtAgbe6nFBBjCKpDz3DrkFAtbnbarUDzLTDBvR4K0xTxWbPs+4lg5m/aeRHnURKxMdpganpuJST6lyO/bDQCHMzyTAAmQwHUIKK9TJquiQ4cKsPLXv8eq1e/go48/Q1bOtyipakCz2Yz2tja7r3UNTSg+V46jxefx6ReHkJHxF2z++G8oOn7aXi6Xk2/cz7FDPMuUfnKy/4VxMP1hHZbfSOS6cd60YhFW5+mRnu34+UrGDDM2LVuID7uxv5j9bi7yfaZg+dE87P8w7WL2VZHb52DesleQc3Q39uRtxWz/ffjwjUuttmP/sVCkfL4X+Ue3YvkIs9hIdpYfL0VZ1BzkdP60RrSxY714fvvRQizJNCPpbYfPOU/psf/VRVhZ7KzHCwmQAAnIlIBdNGXq2zXdqqmpRe4/vsJ//ddv8cx/rsVPV7yCe5e/jOnPPIef/Md/4ulf/Rfe/dNn+DJ7H+pq667ZRl9npovnmYY5i7D4uUVIioxH0ovZV7m0NMGIaYs7s1/EtPB4zHvLmX7rMRiNj2GDPVmKDT+dCnt7ixciYcQsLHWuWjfME9ul8zLsVtJJatPYmS5eI56rPor0FcuQNl/YXNamsBZbsuFSH99swIL4OCQ8vgbrVi1CQpzo9zJxy8XSxDgkPbEGSx4Uq8nE6TBI9UQTCQ9NQXjuGuFTHAwjHkDa2pMwpD6MxQCyRPuGxIVIFwxmG6Zi3pulIpcHCZAACcibgMeJprxx9sK7Q9nYkpmN/F5Uua6p1N62XJiua3RFYXEudvTQB9PeXdhynfbzd21H1qHL24+PCAW8NNBBetVDO0EPXXU5jsP56kX/zhq8kAAJkECfElD2ae/s/DoEPL/o9f9Yg881D2PzqTwUFW3FckMhVj4oVqqePzSOgARIYIASoGgO0Il3y7APbUL6zKkwjhDbxEaxdTt3GTKuWI26xQ92QgIkQAIuIkDRdBFINjMwCHCUJEACA5sARXNgzz9HTwIkQAIk0AsCFM1ewKIpCZCAHAnQJxJwHwGKpvtYsycSIAESIAEPJ0DR9PAJpPskQAIkIEcC/dUnimZ/nVmOiwRIgARIwOUEKJouR8oGSYAESIAE+isBzxbN/jorHBcJkAAJkIAsCVA0ZTktdIoESIAESECOBCiacpwVz/aJ3pMACZBAvyVA0ey3U8uBkQAJkAAJuJoARdPVRNkeCciRAH0iARJwCQGKpkswshESIAESIIGBQICiORBmmWMkARKQIwH65IEEKJoeOGl0mQRIgARIoG8IUDT7hjt7JQESIAESkCOBG/hE0bwBIBaTAAmQAAmQQCcBimYnCV5JgARIgARI4AYEKJo3APT9FLNVEiABEiABTyRA0fTEWaPPJEACJEACfUKAotkn2NmpHAnQJxIgARK4EQGK5o0IsZwESIAESIAEnAQomk4QvJAACciRAH0iAXkRoGjKaz7oDQmQAAmQgIwJUDRlPDl0jQRIgATkSGAg+0TRHMizz7GTAAmQAAn0igBFs1e4aEwCJEACJDCQCchXNAfyrHDsJEACJEACsiRA0ZTltNApEiABEiABORKgaMpxVuTrEz0jARIggQFNgKI5oKefgycBEiABEugNAYpmb2jRlgTkSIA+kQAJuI3APyWao+OTwEAGvAd4D/Ae4D3gSfeAK5S116L5XV4WGMiA9wDvAd4D170H+D4pU624WeHstWjebIesTwIkQAIkQAKeSoCi6akzR79JgARIgAR6R8AF1hRNF0BkEyRAAiRAAgODAEVzYMwzR0kCJEACJOACAhRNF0C8vAmmSIAESIAE+isBimZ/nVmOiwRIgARIwOUEKJouR8oG5UiAPpEACZCAKwhQNF1BkW2QAAmQAAkMCAIUzQExzRwkCciRAH0iAc8jQNH0vDmjxyRAAiRAAn1EgKLZR+DZLQmQAAnIkQB9uj4Biub1+bCUBEiABEiABC4SoGheRMEICZAACZAACVyfQN+I5vV9YikJkAAJkAAJyJIARVOW00KnSIAESIAE5EiAoinHWekbn9grCZAACZDADQhQNG8AiMUkQAIkQAIk0Eng/wMAAP//yWCClQAAAAZJREFUAwCZH/Vqpfy8swAAAABJRU5ErkJggg==" > </div>
<div class="figures centrar-texto">Every single data point counts when hunting for new samples
</div>
<div class="interval_12">Using these tools together turned a noisy set of samples into a clear picture of SideWinder’s targeting and operations.
</div>
<h1 style="text-align: left;">Uncovering Shadow Vector’s SVG-Based Crimeware Campaign in Colombia
</h1>
<div class="interval_12">During our research, <a href="https://www.acronis.com/en/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/" target="_blank">we identified a campaign we refer to as Shadow Vector</a>, which used malicious SVG images crafted as court summonses and legal notifications to target users in Colombia.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/0b6FVletF5SLcE74WFFnDpmkUoVMAOySGrTtSN6MJV0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VnZjV3NkZsSVNrM293MzBLYmt2c0c4d2FXUzdhTmRPWUxpWnhQd1h0SGFWa3VBX3NlWnVWb3Nybk1OcXZ0YXk0Qkxwd1E1SmtnLUNRZWowdUNlYzczX3k3SnpEVktWWFM5bE1sTFozdWJxZFJUb2NWakxaR1JCbC11YWVLTHFIRFdqNFdMdnNoRzYwSVJNaGRHaTBuaVAyLTVPT2xCb3Eyd1k2QTJJQkh2cjJvNzVwRTc2V1hSdkhheWNJbjg"> </div>
<div class="figures centrar-texto">An <a href="https://www.virustotal.com/gui/file/15818f97142d49cbc9662d51bb0155a7a8dc650bf1daf26e07a5fff4ff15d93f" target="_blank">example</a> of a rendered SVG lure with a judicial correspondence theme
</div>
<div class="interval_12">These files mimicked official judicial correspondence and contained embedded links to externally hosted payloads, such as script-based downloaders or password-protected archives. The investigation began after we noticed an unusual pattern of SVG submissions from Colombia. By using a small set of samples for an initial rule, we began our hunt.
</div>
<div class="interval_12">
<pre>
<!--
This YARA rule detects potentially malicious SVG files that are likely being used for crimeware campaigns targeting Colombia.
The rule identifies SVG images that contain legal or judicial terms commonly used in phishing scams,
along with embedded external links that could be used to deliver a payload.
-->
import "vt"
rule crimeware_svg_colombia {
meta:
author = "Acronis Threat Research Unit (TRU)"
description = "Detects potentially malicious SVG files that are likely being used for crimeware campaigns targeting Colombia"
distribution = "TLP:CLEAR"
version = "1.1"
// Reference hashes
hash1 = "6d4a53da259c3c8c0903b1345efcf2fa0d50bc10c3c010a34f86263de466f5a1"
hash2 = "2aae8e206dd068135b16ff87dfbb816053fc247a222aad0d34c9227e6ecf7b5b"
hash3 = "4cfeab122e0a748c8600ccd14a186292f27a93b5ba74c58dfee838fe28765061"
hash4 = "9bbbcb6eae33314b84f5e367f90e57f487d6abe72d6067adcb66eba896d7ce33"
hash5 = "60e87c0fe7c3904935bb1604bdb0b0fc0f2919db64f72666b77405c2c1e46067"
hash6 = "609edc93e075223c5dc8caaf076bf4e28f81c5c6e4db0eb6f502dda91500aab4"
hash7 = "4795d3a3e776baf485d284a9edcf1beef29da42cad8e8261a83e86d35b25cafe"
hash8 = "5673ad3287bcc0c8746ab6cab6b5e1b60160f07c7b16c018efa56bffd44b37aa"
hash9 = "b3e8ab81d0a559a373c3fe2ae7c3c99718503411cc13b17cffd1eee2544a787b"
hash10 = "b5311cadc0bbd2f47549f7fc0895848adb20cc016387cebcd1c29d784779240c"
hash11 = "c3319a8863d5e2dc525dfe6669c5b720fc42c96a8dce3bd7f6a0072569933303"
hash12 = "cb035f440f728395cc4237e1ac52114641dc25619705b605713ecefb6fd9e563"
hash13 = "cf23f7b98abddf1b36552b55f874ae1e2199768d7cefb0188af9ee0d9a698107"
hash14 = "f3208ae62655435186e560378db58e133a68aa6107948e2a8ec30682983aa503"
strings:
// SVG
$svg = "<svg xmlns=" ascii fullword
// Documents containing legal or judicial terms
$s1 = "COPIA" nocase
$s2 = "CITACION" nocase
$s3 = "JUZGADO" nocase
$s4 = "PENAL" nocase
$s5 = "JUDICIAL" nocase
$s6 = "BOGOTA" nocase
$s7 = "DEMANDA" nocase
// When image loads it retrieves payload from external website using HTTPS
$href1= "href='https://" nocase
$href2 = "href=\"https://" nocase
condition:
$svg
and filesize < 3MB
and 3 of ($s*)
and any of ($href*)
and vt.metadata.submitter.country == "CO"
}
</pre>
</div>
<div class="interval_12">By including reference hashes from manually verified samples, we used a broad hunting rule both as detection mechanism and a pivot point for uncovering related infrastructure or newly generated lures.
</div>
<div class="interval_12">Once the initial hunting logic was in place, we refined it into a livehunt rule specifically tailored for SVG-based decoys. The rule matched files containing judicial terminology and outbound HTTPS links, while filtering by file size and origin to reduce false positives. Using this rule, we began collecting and analyzing related uploads.
</div>
<div class="interval_12">We used the <a href="https://gtidocs.virustotal.com/docs/diff" target="_blank">VT Diff</a> functionality to compare variations between samples and quickly spot patterns, such as repeated words, hexadecimal values, URLs, or metadata tags that hinted at automated generation (i.e. the string “Generado Automaticamente”).
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/gAEDEOVBko9WZJKFFvhEdtKG1cyyvd0e_IzKKjZMhU0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoN1h2OTV6MmxTN1Mxb18yT0UzWkE0cEFpVGdCNW1FRF9vcmt3MGxtSHBZbV9TemdsZGFGeWJGc2xvQkJKa1ZXRGhDR3B5ZUFoenFoNHFLQmtOX1E1N2Q0c0JkRmc4bXAwLTA2djA1dDcwaE95RkdKYWx6SmlSei00dTdOOXFPLVAydTJyVzIwY3RlZFRRM1lFOXVvVTNpVG5FdXVpWWdoaW8zS1ZGNzFZYWRvOE5IcEp4d2JsekJPd1BWRGM"> </div>
<div class="figures centrar-texto">VT Diff feature helped us to identify patterns
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/gE5C8HsWkXAAa-j-kwtfFnRmNXLLEcYlKJNxCQ2Nl9o/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VpZ1RvTGpqTEdNaEpaVTJRZHBEZWR1RkpZZXFYS3BhYTVkRjF0MEZ2UGs0UTMzLWxndkwyOElHNEU4YWhxQU5meXhfdXJlVWhtX2NsZVZaX3Z6eUU0UFFPenBHTlJHOC1Yd3VYZ2lvYlBXdEVHbllmS0JySUVoTTM2YkFxcXdDZ1F6SWFMUUpZbUVHRnRkRmpuVzBvcVA1SEtQbXI1WEJnSFpIUXFFVHM2ZkRXekZ5aDBUSDNndWlCSVZzNVE"> </div>
<div class="figures centrar-texto">Results of our VT Diff session
</div>
<div class="interval_12">While we could not conclusively attribute the SVG decoy campaign to <a href="https://attack.mitre.org/groups/G0099/" target="_blank">Blind Eagle</a> at the time of research, the technical and thematic overlaps were difficult to ignore. The VT blog <a href="https://blog.virustotal.com/2025/09/uncovering-colombian-malware-campaign.html" target="_blank">“Uncovering a Colombian Malware Campaign with AI Code Analysis”</a> describes similar judicial-themed SVG files used as lures in operations targeting Colombian users. As with other open reports on this threat actor, attribution remains based on cumulative evidence, clustering campaigns based on commonalities such as infrastructure reuse, phishing template design, malware family selection, and linguistic or regional indicators observed across samples.
</div>
<div class="interval_12">
<pre>
rule crimeware_shadow_vector_svg
{
meta:
description = "Detects malicious SVG files associated with Shadow
Vector's Colombian campaign"
author = "Acronis Threat Research Unit (TRU)"
file_type = "SVG"
malware_family = "Shadow Vector"
threat_category = "Crimeware / Malicious Image / Embedded Payload"
tlp = "TLP:CLEAR"
strings:
$svg_tag1 = "<?xml" ascii
$svg_tag2 = "<svg" ascii
$svg_tag3 = "<!DOCTYPE svg" ascii
$svg_tag4 = "http://www.w3.org/2000/svg" ascii
//used by Shadow Vector (possibly generated in batch)
$judicial = "juzgado" ascii nocase
$judicial_1 = "citacion" ascii nocase
$judicial_2 = "judicial" ascii nocase
$judicial_3 = "despacho" ascii nocase
$generado = "Generado" ascii nocase
condition:
filesize < 3MB and
3 of ($svg_tag*) and
(1 of ($judicial*) and $generado)
}</pre>
</div>
<div class="interval_12">The evolution from the initial hunting rule to the refined detection rule illustrates our approach to threat hunting in VT, iterative and continuously refined through testing and analysis. The first rule was broad, meant to surface related samples and reveal the full scope of the campaign. It proved useful in livehunt and retrohunt, helping us find clusters of judicial-themed SVGs and their linked payloads. As the investigation progressed, we focused on precision, reducing false positives and removing elements that did not add value. Tuning a rule is always a balance: removing one pattern might miss some samples, but it can also make the rule more accurate and easier to maintain.
</div>
<h1 style="text-align: left;">FileFix in the wild!
</h1>
<div class="interval_12">A few weeks ago, the <a href="https://www.acronis.com/en/tru/about/" target="_blank">TRU team</a> at Acronis <a href="https://www.acronis.com/en/tru/posts/filefix-in-the-wild-new-filefix-campaign-goes-beyond-poc-and-leverages-steganography/" target="_blank">released</a> research on a (at the time) rarely seen variant of the <a href="https://logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-technique" target="_blank">ClickFix</a> attack, called FileFix. Much of the investigation of this attack vector was possible thanks to VirusTotal’s ability to archive, search, and write rules for finding web pages. We, at Acronis, together with VT, wanted to share a bit of information on how we did it- so that others can better research this type of emerging threat.
</div>
<h2 style="text-align: left;">Anatomy of an attack- where do we start?
</h2>
<div class="interval_12">Like many phishing attacks, <a href="https://attack.mitre.org/techniques/T1204/004/" target="_blank">*Fix attacks</a> rely on malicious websites where victims are tricked into running malicious commands. Lucky for us, these attacks have a few particular components that are in common to all, or many, *Fix attacks. Using VT, we were able to write rules and <a href="https://gtidocs.virustotal.com/docs/livehunt-guide" target="_blank">livehunt</a> for any new web pages which included these components, and were able to quickly reiterate on rules that were too broad.
</div>
<div class="interval_12">One thing all *Fix attacks have in common, is that they copy a malicious command to the victims clipboard- copying the malicious command, rather than letting the user copy the command themselves, allows attackers to try to hide the malicious part of the command from the victim, and only allow for a smaller, “benign” portion of the command to appear when they copy it into their Windows Run Dialogue or address bar. This commonality gives us two great strings to hunt for:
</div>
<div class="interval_12"><ul> <li>The commands used to copy text into the victims clipboard
</li> <li>The commands used to construct the malicious payload
</li> </ul> </div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/TD121XKsZ0T5ndCcKJ7PEHPKRouz7MxStIqmOjbIvu0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0Vpa3dxRXdJcHVSN2swdmw0c3A2Q0hsdDZKT21HRmpSU21JbldEeVczZV9MVWJrRXVRajEtby1aYVo3cVlYYjlqRl9HcnpQajltT0h6ZGs4RVh4UUt3Q1FwcnhYNjFNZm0tTGtqZUFQamtLRFJZQ0N5R1BlcTEtbkhYOF8zUEtiRUE0SVVfU1duczVVWU9MdVhMX0U4WDVNX0FQNlJWaldJdWtqcGxDajdHU0VsbGtFa0FVYXA0TlNUanVSdDg"> </div>
<div class="figures centrar-texto"></div>
<div class="interval_12">We began our research by using the Livehunt feature, and wrote a rule to detect <mark class="red">navigator.clipboard.writeText</mark> and <mark class="red">document.execCommand("copy")</mark>, both used for copying into clipboard, as well as any string including the words <mark class="red">powershell</mark>, <mark class="red">mshta</mark>, <mark class="red">cmd</mark>, and other commands we find commonly used in *Fix attacks. At its most basic form, a rule might look like this:
</div>
<div class="interval_12">
<pre>import "vt"
rule ClickFix
{
strings:
$clipboard = /(navigator\.clipboard\.writeText|document\.execCommand\(\"copy\"\))/
$pay01 = /(powershell|cmd|mshta|msiexec|pwsh)/gvfi
condition:
vt.net.url.new_url and
$clipboard and
any of ($pay*)
} </pre>
</div>
<div class="interval_12">However, this is far from enough. There are plenty of benign sites that use the copy to clipboard feature, and also have the words powershell or cmd present (the three letters “cmd” appear often as part of Base64 strings). This makes things a bit more tricky, as it requires us to iron out these false positives. We need to make our patterns look more similar to real powershell or cmd commands.
</div>
<div class="interval_12">Unfortunately, there is such a huge variance in how these commands are written, that the more rigid our patterns became, the more likely it was for us to miss a true positive that included something we haven’t seen before or couldn’t think of. This requires a balancing act- if your rules are too rigid, you will miss true positives that employ a creatively crafted command; too loose and you will receive a large number of false positives, which will slow down investigation.
</div>
<div class="interval_12">For example, we can try narrowing down our rule to include more true positives of powershell commands by searching for a string that’s better resembling some of the powershell commands we’ve seen as part of a ClickFix payload, by including the “iex” cmdlet, which tells the powershell command to execute a command:
</div>
<div class="interval_12"> <pre>$pay03 = /powershell.{,80}iex/</pre></div>
<div class="interval_12">This will match whenever the word powershell appears, with the word <mark class="red">iex</mark> appearing 0 to 80 characters after it. This should reduce the number of false positives we see related to powershell, as it more clearly resembles a powershell command, but at the same time limits our rule to only catch powershell commands that follow this structure- any true positive command with more than 80 characters between the word <mark class="red">powershell</mark> and <mark class="red">iex</mark>, or commands forgoing the use of iex, will not be caught.
</div>
<div class="interval_12">We ended up setting a number of separate rulesets, some were more specific, others more generic. The more generic ones helped us tune our more specific rulesets. This tactic allowed us to find a large number of ClickFix attacks. Most were run of the mill fake captchas, leveraging ClickFix, others were more interesting. As we continued fine tuning our rules, and within a week of setting up our Livehunt, one of our more generic rules has made an interesting <a href="https://www.virustotal.com/gui/url/0c91dbdf806b35d57c332e71ff73c5e18ca86e1d1906099543698b3155c95ca7/content" target="_blank">detection</a>. At first glance, it appeared to be a false positive, but as we looked closer, we discovered that it’s exactly what we were hoping to find- a FileFix attack.
</div>
<h2 style="text-align: left;">Analyzing payloads
</h2>
<div class="interval_12">One of the nicest things about researching a *Fix attack is that the payload is right there on the website, right in plain site. This offers a few advantages- the first is that we can examine the payload even when the phishing site itself is down, as long as it’s archived by VT. The second advantage is we can further search for similar patterns on VT via VT queries to try and catch other attacks from the same campaign.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/tt-6w0YSK9yXCJ2dun1xYjEY4g2B32MQ7duhgdOGlds/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VpLXpnTnBSUGRJbjl4UDBKSFQwYnFYRkp3dGY1alVGWWFXVDUyX1NuTWwzOUtmUkN5aG5LSzF1RGJnTk1nVVNOc0YtRV96SjVDTWpWMENvTnRiWEowdzlOUWJtN24tTmdLZFZMZEFGN0pCRWM1cnRKOE9DTFh6MjJodTVNYVlNR3pwc1VZRGhqbVZrZ2N3RlVURXRPUkFKSnBLdFJFMEkxUHI2R1ppeUJqTWQ0b2FXNWYwOW1YbmlFbXlYanc"> </div>
<div class="figures centrar-texto">Payloads are visible directly in VT, by using the content tab on any suspected website (and in this case- obfuscated)</div>
<div class="interval_12">Often, these payloads may contain additional malicious urls which are used to download and execute additional payloads. These can also very easily be examined on VT, and any files they lead to may also be downloaded directly from VT.
</div>
<div class="interval_12">In our investigation of the FileFix site, we found that the payload (a powershell command) downloads an <a href="https://www.virustotal.com/gui/file/06471e1f500612f44c828e5d3453e7846f70c2d83b24c08ac9193e791f1a8130/detection" target="_blank">image</a>, and then runs a script that is embedded in the image file. That second-stage script then decrypts and extracts an <a href="https://www.virustotal.com/gui/file/70ae293eb1c023d40a8a48d6109a1bf792e1877a72433bcc89613461cffc7b61/behavior" target="_blank">executable</a> from the image and runs it.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/3pUxVxaOgXfx7h7jlREQW5qqFvHQlmpbXaws-69g8D4/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VqV1ZJbWZseFRTQTA1QUs1TXpEaG4wLVg1M2VkM1phRUktazdlX3JDRjNFd3JfZjhRNTlRSkVkNzJpY0Y3Vm4xeG1XUnBpcWNjX0dLcEN5SzRScnRVTDhSOXFCcUFwTkRYT0djWV9mcG9yNDMtdTV6V3BoZm9ZT0hIYWFUanVELVNXUTRRRER2bUNCYW8tRGxXZXAwLWZnVGtDVkhBeE5MS2Q2TGp4VXFZc0xMQURwVGxXby13THlGclR4NWs"> </div>
<div class="figures centrar-texto">FileFix <a href="https://www.virustotal.com/gui/url/0c91dbdf806b35d57c332e71ff73c5e18ca86e1d1906099543698b3155c95ca7/content" target="_blank">site</a> downloading and extracting code from an image (highlighted)</div>
<div class="interval_12">We were using both a VM and VT to investigate these payloads. One interesting way we were able to use VT is to track additional examples of the malicious images, as parts of the command were embedded as strings in the image file, allowing us to match these patterns via a VT query and find new <a href="https://www.virustotal.com/gui/search/content%253A%257B24733d302e2e323535%257D?type=files" target="_blank">examples of the attack</a>, or by searching for the file name or the domain which hosts it.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/fodDWbymirHtGRLySSvqKN0OJxj6Vjkh6o7eUuxe6dE/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoVVlCVWwyNjJzQWVucEtjQkFybTdyWTRodVN4QmpnVmx5MXhIN0JhYjlJUm04ejhQVUlFY2ppQlJDdEYzTlZKRHZvcDYxYlRwRFZHcmJuZUxGcFZna2hzbTA5WTF3VnZlRlZaY0E0RzVPYUZNZE5wZU5RTEhJbFd2RTdYdWdnMFRHNUdCZnVES0ZYdkZnRUhLQ1lweThCakE1X1FQRm5UVVBLQ0otZnBtSWV4T245aXQ2dUFSV3VUTEhUY0E"> </div>
<div class="figures centrar-texto">Pivoting on the domain hosting malicious .jpg files, to investigate additional stages of the attack, archived by VT </div>
<div class="interval_12">VT has been extremely helpful in allowing us to very easily analyze malicious URLs used not only for phishing, but also for delivering malware and additional scripts. In some examples, we were able to get quite far along the chain of scripts and payloads without ever having to spin up a VM, just by looking at the content tab, to see what’s inside a particular file. That’s not going to be the case every time, but it’s certainly nice when it does happen.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/30icIooVIFuGTlyV5WUXk3niVGoO76-9MsTZ4Tya0NQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoelF6NG9NcHRZcjU2MGxudzBldzdwR0dJeTB5X3RJbXRUNWVSZXo4ZWpiWlZ3SlYweGF2WDdJa0JSbXBBc2NmR0VjaVAtd2pFRElNbWt5emZBOWVoM1JVODlNazhZZ18wUGRTUk5GQUlWTWt3WmMwMHNpUnhuaXpaZmwtMnN5Q0w4TFBObS1GRHc4RnVUbUxIYTBxTktkY2ZrbGlWa0FDLS00eDlBRHR3OE1kSE53YTVjNG93YTZWaGsyRFk"> </div>
<div class="figures centrar-texto">The malicious <a href="https://www.virustotal.com/gui/file/06471e1f500612f44c828e5d3453e7846f70c2d83b24c08ac9193e791f1a8130/detection" target="_blank">images</a> used during the attack contain parts of the malicious code used in the second stage of the attack</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/YKIB1q31CzT4Ej8He-N64vN6-SYEOoy5FIv3ozEkIOI/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VncGR3UEZJNnptS0Zkd2xSZXkyVUxidkxVRFROaXNHZXYtWG92RUppQkI2TThvZmF3WDFxTDBpb2U3X254cTFGQU53bnJBYmxOM2g2TDFjc3RFTU5YYTI1MnczdjNrckxhY3kwcFMxbVlQcWN4ZG5tV1hHcUlDX2xoQ2pSdjBUQ1F5dDRQZXFCUk5QVUJhc2VuVUxvWlg1cXZtcUtzcmhlTFRHdmFyVDNyTTNDX0tkNFVkSjlTd3VUU1JwQ1k"> </div>
<div class="figures centrar-texto">By <a href="https://www.virustotal.com/gui/search/content%253A%257B24733d302e2e323535%257D?type=files" target="_blank">pivoting</a> on specific strings from within that code, we are able to locate other samples of the malicious images and scripts created by the same attacker, and further pivot to uncover their infrastructure</div>
<div class="interval_12">The ability to investigate and correlate various stages, or multiple samples from the same attacker, were a huge boon to us during the investigation. It allowed us to quickly connect the dots without leaving VT, and should be a great asset in your investigation.
</div>
<h2 style="text-align: left;">Looking for a *Fix
</h2>
<div class="interval_12">So now that you know all this- what's next? How can this be useful? Well, we hope it can be helpful in a number of ways.
</div>
<div class="interval_12">Firstly, working together as a community, it is important that we continue to catch and block URLs that are employing *Fix attacks. It’s not easy to detect a *Fix site dynamically, and prevention may still happen in many cases after the payload has already been run. Maintaining a robust blocklist remains a very good and accessible option for stopping these threats.
</div>
<div class="interval_12">Secondly, those of us interested in continuing to track this threat and follow its evolution may use this to find these threats and potentially automate detection. As a side note, *Fix attacks are great investigation topics for those of us starting out in security, and as long as appropriate precautions are taken, it can be relatively safely investigated via VT, and can be very useful for learning about malicious commands, phishing sites, etc.
</div>
<div class="interval_12">Thirdly, for those of us protecting organizations, this can be a useful guide for finding these attacks by yourself, in the wild, in order to gain a deeper understanding of how they operate, and what relevant ways you can find to defend your organization, although there are certainly many reports written on the subject which would also come in handy.
</div>
<h1 style="text-align: left;">VT Tips (based on the success story)
</h1>
<div class="interval_12"><i>[In the words of VirusTotal…] </i></div>
<div class="interval_12">The Acronis team’s investigation into FileFix, SideWinder, and ShadowVector is a goldmine of threat hunting techniques. Let’s move beyond the narrative and extract some advanced, practical methods you can apply to your own hunts for web-based threats and multi-stage payloads.
</div>
<h2 style="text-align: left;">Supercharge Your Web-Content YARA Rules
</h2>
<div class="interval_12">A simple YARA rule looking for clipboard commands and "powershell" is a good start, but attackers know this. You can significantly improve your detection rate by building rules that look for the context in which these commands appear.
</div>
<div class="interval_12">Instead of a generic search, try focusing on the obfuscation and page structure common in these attacks. For instance, attackers often hide their malicious script inside other functions or encoded strings. Your YARA rules can hunt for the combination of a clipboard command and indicators of de-obfuscation functions like <mark class="red">atob()</mark> (for Base64) or <mark class="red">String.fromCharCode</mark>.
</div>
<div class="interval_12">Combine content searches with URL metadata. The <mark class="red">content</mark> modifier is also available for URLs, when you set the entity to url you can use the content modifier to search for strings within the URL content. For example, the next <a href="https://www.virustotal.com/gui/search/entity%253Aurl%2520(content%253A%2522navigator%252Eclipboard%252EwriteText%2522%2520or%2520content%253A%2522document%252EexecCommand(%255C%2522copy%255C%2522)%2522)%2520(content%253A%2522String%252EfromCharCode%2522%2520or%2520content%253A%2522atob%2522)?type=urls" target="_blank">query</a> can be useful to identify potential ClickFix URLs combining some of the findings shared by Acronis and potential strings used to avoid detections.
</div>
<div class="interval_12"><pre>entity:url (content:"navigator.clipboard.writeText" or content:"document.execCommand(\"copy\")") (content:"String.fromCharCode" or content:"atob")</pre> </div>
<h2 style="text-align: left;">Dissect Payloads with Advanced Content Queries
</h2>
<div class="interval_12">When you find a payload, as Acronis did within the FileFix site's source code, your job has just begun. The next step is to find related samples. Attackers often reuse code, and even when they obfuscate their scripts, unique strings or logic patterns can give them away. Isolate unique, non-generic parts of the script. Look for:
</div>
<div class="interval_12"><ul>
<li>Custom function names</li>
<li>Specific variable names</li>
<li>Uncommon comments</li>
<li>Unique sequences of commands or API calls</li>
</ul> </div>
<div class="interval_12">Focus on the unobfuscated parts of the code. In the FileFix payload, the attackers might obfuscate the C2 domain, but the PowerShell command structure used to decode and run it could be consistent across samples. Use that structure as your pivot. For example, if a payload uses a specific combination of <mark class="red">[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(...))</mark>, you can build a <a href="https://www.virustotal.com/gui/search/behavior%253A%2522%255BSystem%252EText%252EEncoding%255D%253A%253AUTF8%252EGetString(%255BSystem%252EConvert%255D%253A%253AFromBase64String(%2522?type=files" target="_blank">query</a> to find other files using that exact deobfuscation chain.
</div>
<div class="interval_12"><pre>behavior:"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("
</pre> </div>
<h2 style="text-align: left;">Don't forget about the infrastructure</h2>
<div class="interval_12">Acronis has been tracking SideWinder in a very intelligent way. Their experience with VirusTotal is evident. Most of our users use VirusTotal primarily for file analysis, but sometimes we forget that there are powerful features for tracking <a href="https://docs.virustotal.com/docs/nethunt" target="_blank">infrastructure through livehunt</a>.
</div>
<div class="interval_12">In the SideWinder intrusions, there is a continuously monitored hash that corresponds to a <a href="https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a/relations" target="_blank">
decoy file</a>, and this file is downloaded from different URLs.
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/9fJYoVj8Z4gIlMfs3GXovcOWsNc0jukZGNHCbfoCSGc/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VqTXVQNEV0aE1EeGRWSXg4TVhtTnJwOGxiUzZnYzQzY1FLX0pqQktNdU02bnlfWlRGSWpHR3d5cDZYQ3kyRUM3aVpuUXdOZTkzUHJocE0xZTFwV0FQRXNUeFhGV3FreTVjcW13d2EySkluYW9wcjlwb0FtNmJfQXZvNnRwNnVsX21sRHRRQkVzRFFZWXZGYi1JYTZVeGNZLTRDOTROYXNNNHBxMGh0UEpzY0dUX0FVNHlaVzFnekxlUU1wNnc"> </div>
<div class="figures centrar-texto">ITW URLs means that these URLs were downloading the file being studied, in this case the RTF decoy file
</div>
<div class="interval_12">An interesting way to proactively identify new URLs quickly is by creating a YARA rule in livehunt for URLs, where the objective is to discover new URLs that are downloading that specific RTF decoy file.
</div>
<div class="interval_12"><pre>import "vt"
rule URLs_Downloading_Decoy_RTF_SideWinder {
meta:
target_entity = "url"
author = "Virustotal"
description = "This YARA rule identify new URLs downloading the decoy file related to SideWinder"
condition:
vt.net.url.downloaded_file.sha256 == "1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a"
and vt.net.url.new_url
}</pre> </div>
<div class="interval_12">Another approach that could also be interesting is to directly query the <a href="https://gtidocs.virustotal.com/reference/file-object#relationships:~:text=IP%20addresses.-,itw_urls,-In%20the%20wild" target="_blank">itw_urls relationship</a> of the decoy file using the API. One use case could be creating a script that regularly (perhaps daily) calls the relationship API, retrieves the URLs, stores them in a database, and then repeats the call each day to identify new URLs. It's a simple, yet effective way to integrate with technology that any company might already have.
</div>
<div class="interval_12">The following code snippet can be executed in <a href="https://colab.sandbox.google.com/" target="_blank">
Google Colab</a> and once you establish the API Key, you will obtain all the itw_urls related to the decoy file in the <mark class="red">all_itw_urls</mark> variable.
</div>
<div class="interval_12"><pre>!pip install vt-py nest_asyncio
import getpass, vt, json, nest_asyncio
nest_asyncio.apply()
cli = vt.Client(getpass.getpass('Introduce your VirusTotal API key: '))
FILEHASH = "1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a"
RELATIONS = "itw_urls"
all_itw_urls = []
async for itemobj in cli.iterator(f'/files/{FILEHASH}/{RELATIONS}', limit=0):
all_itw_urls.append(itemobj.to_dict())</pre> </div>
<h2 style="text-align: left;">The great forgotten one: VT Diff
</h2>
<div class="interval_12">When we read researchs using VT Diff, we are pleased, as it is a tool that is truly good for creating YARA rules.
</div>
<div class="interval_12">When analyzing a set of related samples, use the VT Diff feature to spot commonalities and variations. This can help you identify patterns, such as repeated strings, hardcoded values, or metadata artifacts that indicate automated generation.
</div>
<div class="interval_12">As the Acronis team notes, <i>"We used the VT Diff functionality to compare variations between samples and quickly spot patterns, such as repeated words, hexadecimal values, URLs, or metadata tags that hinted at automated generation (i.e. the string “Generado Automaticamente”)"</i>.
</div>
<div class="interval_12">You can easily use VT Diff from multiple places: intelligence search results, collections, campaigns, reports, VT Graph…
</div>
<div class="central_box interval_12"><img src="https://imgproxy.citrusreader.com/Egt97lx8fYP2XZLgMRqpoIJbLiZ0Kny9ql5GPC2HHpM/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VnVzFmTFJmeGR3cGdKbUVYTU1UN045UFh2NzNwUE9WOWtDLVJkUTRqM2d1dWpWdXJuallTRlRfVTZFTlZlb1dIR0lXWHdvcFh6bnRhTTBncnJhMHY2eHNrS1hNQUJ5cXlmMElWU1Mtal9PUTEzdlk0cHc0bEREWlZWQU5PWUYtdmhCbFRJcUxTRXhTalZqeU0zNDFKTThTUWgxVTY1RkRpcm9PRElfeHhpR0pJdHJ1cWY1c2hLZ18tMUZlS2c"> </div>
<div class="figures centrar-texto">Creation of VT Diff from a <a href="https://www.virustotal.com/gui/collection/report--2692fe1070152501a8b85deacf45fb68444c00b42e6447e69c5e301f75ad3e43/iocs" target="_blank">Report</a>
</div>
<h1 style="text-align: left;">Conclusion
</h1>
<div class="interval_12">The examples shared by the Acronis Threat Research Unit in tracking campaigns like FileFix, SideWinder, and Shadow Vector demonstrates the power of VT as a comprehensive threat intelligence and hunting platform. By leveraging a combination of proactive Livehunt rules, deep content analysis, and rich metadata pivoting, security researchers can effectively uncover and track elusive and evolving threats.
</div>
<div class="interval_12">These examples highlight that successful threat hunting is not just about having the right tools, but about applying creative and persistent investigation techniques. The ability to pivot from a simple YARA rule to a full-fledged campaign analysis, as Acronis did, is crucial to connecting the dots and revealing the full scope of an attack. From hunting for clipboard manipulation in web-based threats to tracking decade-old exploits and analyzing malicious SVG decoys, the Acronis team has demonstrated a deep understanding of modern threat hunting, and we appreciate them sharing their valuable insights with the community.
</div>
<div class="interval_12">We hope this blog have been insightful and will help you in your own threat-hunting endeavors. The fight against cybercrime is a collective effort, and the more we share our knowledge and experiences, the stronger we become as a community.
</div>
<div class="interval_12">If you have a success story of using VirusTotal that you would like to share with the community, <b>we would be delighted to hear from you</b>. Please reach out to us, and we will be happy to feature your story in a future blog post at <b>practitioners@virustotal.com</b>.
</div>
<div class="interval_12">Together, we can make the digital world a safer place.
</div>
<style>
.my-code{
font-family: "Courier", sans-serif;
font-size: medium;
width: 100%;
background: Black;
color: White;
/*padding: 24px;*/
border-collapse: collapse;
}
.my-yara-code{
font-family: "Courier", sans-serif;
font-size: medium;
width: 100%;
background: #F7F9F9;
color: Black;
/*padding: 24px;*/
border-collapse: collapse;
/*font-weight: bold;*/
}
mark.green {
color:#3cb371;
background: none;
}
mark.gray {
color:Gray;
background: none;
}
mark.yellow {
color:Yellow;
background: none;
}
mark.orange {
color:Orange;
background: none;
}
mark.red {
color:Red;
background: none;
}
mark.blue {
color:#33BEFF;
background: none;
}
mark.dark-blue {
color:Blue;
background: none;
}
.table-fields {
background: #86aaf9;
}
th:first-child { width: 24%; }
th:first-child+th { width: 39%; }
/*
.table-container table td,
.table-container table th {
padding: 16px 32px;
}
*/
table.no-spacing {
border-spacing:0; /* Removes the cell spacing via CSS */
border-collapse: collapse; /* Optional - if you don't want to have double border where cells touch */
}
.pmargin {
margin: 0;
}
a {
color: blue!important;
}
.central_box {
/* Establece el ancho exacto del contenido (la imagen) */
width: fit-content;
/* Centra el bloque .central_box en la página */
margin: 12px auto;
/* Centra el TEXTO dentro de este contenedor (para el pie de foto) */
text-align: center;
}
/* 2. Para la imagen (opcional, si necesita ser un bloque) */
.central_img {
display: block;
/* Quitamos el margin: auto de aquí, ya lo hace el padre */
/* Quitamos el width/max-width de aquí, ya lo hace el padre */
}
.central_img img {
border: 1px solid #000000;
}
.central_img p {
text-align: center;
font-style: italic;
}
.width_10 {
width: 10%;
}
.width_15 {
width: 15%;
}
.width_20 {
width: 20%;
}
.width_30 {
width: 30%;
}
.width_40 {
width: 40%;
}
.width_50 {
width: 50%;
}
.width_60 {
width: 60%;
}
.centrar-texto {
text-align: center;
}
.width_80 {
width: 80%;
}
pre {
background: #f4f4f4;
border: 1px solid #ddd;
border-left: 3px solid #7ad3ff;
color: #666;
page-break-inside: avoid;
font-family: monospace;
font-size: 15px;
line-height: 1.6;
margin-bottom: 1.6em;
max-width: 100%;
/* --- CÓDIGO CLAVE PARA ELIMINAR SCROLL --- */
/* 1. Elimina el desplazamiento. */
overflow: hidden;
/* 2. Permite que las líneas de código largas se rompan. */
white-space: pre-wrap;
/* 3. Asegura que las palabras muy largas (como una URL) se rompan. */
word-break: break-all;
/* --- RESTO DE TUS ESTILOS --- */
padding: 1em 1.5em;
display: block;
word-wrap: break-word; /* Esta es la versión antigua, se recomienda word-break */
}
.width_90 {
width: 90%;
}
.width_100 {
width: 100%;
}
ul{
margin-bottom: 5px!important;
}
.figures {
font-size: 11pt;
}
.interval_12{
margin-bottom: 12px!important;
}
</style>