Indicators of Compromise Hash Downloader used in the campaign:  76b1f75ee15273d1226392db3d8f1b2aed467c2875e11d9c14fd18120afc223a 4edcff56f586bd69585e0c9d1d7ff4bfb1a2dac6e2a9588f155015ececbe1275 1b5a1751960b2c08631601b07e3294e4c84dfd71896453b65a45e4396a6377cc  Hashes detected as part of the BKDR_ANEL Family: 5.0.0 beta1  af1b2cd8580650d826f48ad824deef3749a7db6fde1c7e1dc115c6b0a7dfa0dd  5.1.1 rc  2371f5b63b1e44ca52ce8140840f3a8b01b7e3002f0a7f0d61aecf539566e6a1  5.1.2 rc1  05dd407018bd316090adaea0855bd7f7c72d9ce4380dd4bc0feadc6566a36170  5.2.0 rev1  00030ec8cce1f21120ebf5b90ec408b59166bbc3fba17ebae0fc23b3ca27bf4f  lena_http.bin  303f9c00edb4c6082542e456a30a2446a259b8bb9fb6b0f76ff318d5905e429c  Tools used in the campaign: Getpass.exe  52a8557c8cdd5d925453383934cb10a85b117522b95c6d28ca097632ac8bc10d  event.dll  6c3224dbf6bbabe058b0ab46233c9d35c970aa83e8c4bdffb85d78e31159d489  mail.exe  2f76c9242d5ad2b1f941fb47c94c80c1ce647df4d2d37ca2351864286b0bb3d8  URLs and IP Addresses related to the campaign:  www[.]nasnnones[.]com trems[.]rvenee[.]com contacts[.]rvenee[.]com 91[.]207[.]7[.]91 89[.]18[.]27[.]159 89[.]37[.]226[.]108 185[.]25[.]51[.]116 185[.]81[.]113[.]95 185[.]144[.]83[.]82 185[.]153[.]198[.]58 185[.]159[.]129[.]226         Tags  Malware | APT & Targeted Attacks | Endpoints | Cyber Crime | Research | Network