October 15, 2020 – December 14, 2020  193.56.28[.]25  Scans TCP port 445 and 1433  May 21 – May 26, 2020  195.191.235[.]155  Scans UDP port 389   August 22, 2020   Files  SHA256  Filename  Description  Trend Micro Pattern Detection  Trend Micro Machine Learning Detection  c4a61b581890f575ba0586cf6d7d7d3e0c7603ca40915833d6746326685282b7  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  f364729450cb91b2a4c4e378c08e555137028c63480a221bb70e7e179a03f5cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  N/A  e3894693eff6a2ae4fa8a8134b846c2acaf5649cd61e71b1139088d97e54236d  info.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  83fbd76d298253932aa3e3a9bc48c201fe0b7089f0a7803e68f41792c05c5279  decrypt_v2.4.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  fe00bd6fba209a347acf296887b10d2574c426fa962b6d4d94c34b384d15f0f1  email.exe  