Severity

High

Analysis Summary

APT C-35 aka (Donot Team) has been actively dropping malicious files for template injection. The group has a history of attacking Pakistani government officials and military personnel and has been linked to India. They 
previously targeted Pakistani users with android malware named (StealJob) was used to target Pakistani android mobile users by Phishing on the name of “Kashmiri Voice” The attackers hunt for confidential information and intellectual property. The hackers’ targets include countries in South Asia, in particular, the state sector of Pakistan.

Impact

• Information theft and espionage
• Exposure of sensitive data

Indicators of Compromise

Filename

• NHQ Approval Letter[.]doc

MD5

• 3c71395a0863fcc262e9e819ba4907b1

SHA-256

• 97c006df64af975288a1d2af40db9ceeca2743fe9f75b33797725198e93b5c80

SHA1

• b30445e6472df7d87ef725d102b963196db639d1

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.