Files with the following hashes were used in the second series of attacks:  fb5b5906feab268f90789b15351b8a193fb5f445a3ae9afb1da8fb814ed80325 – detected as VBS_KEYLOG.NYKW 306f4f843c5a5a119a3385ad2b18c78a04fac618031ddecabf0633083a6c9a76 – detected as VBS_KEYLOG.NYKW 33709ca050fd0abc2aba38326996bf1c3b6d9b875228c9f15e624f9002c199a8 – detected as VBS_OBFUS.VUJ ff0f9057d3da7b3500f145ce24670c89a93cdb5cbe74946b17397fc466ddfbda – detected as VBS_AUTORUN.ASUHK 9b7cc8f4807df162f99f5fa592bc7cc5c6a756d9c0311c7b2529f19a0ac59c1a – archive file; contents detected as VBS_OBFUS.VUK 587e38fb11bd0c4021ce6965e92838521616ee4c5506ef0fa160452e9c71d5cf – detected as VBS_OBFUS.VUK         Tags  APT & Targeted Attacks | Malware | Research | Articles, News, Reports