NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 analyzed a December 2015 spear-phishing attack against an Uzbek diplomat that used a malicious Word document (exploiting CVE-2012-0158) to drop a SFX RAR payload which leverages DLL side-loading to install a NetTraveler DLL. The report details the infection chain, decrypted configuration extraction, runtime behavior (mutex, service enumeration), C2 infrastructure (voennovosti.com -> 98.126.38.107), and provides SHA256 indicators for the malicious components.