Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE14 IOCs
Fake Zoom Installer Delivers Overlord RAT to macOS and Windows Systems
Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
5W+H Threat Analysis
Analysis unavailable
Indicators of Compromise
Indicators of Compromise14
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | dash.zoom.com.kg indicatorintel-blognetwork | High | 58 | Aug 8, 26 |
| SHA256 | 7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233 file-hashindicatorintel-blog | Medium | 53 | Aug 8, 26 |
| SHA256 | 527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d file-hashindicatorintel-blog | Medium | 53 | Aug 8, 26 |
| Domain | hub.zoom.com.lv indicatorintel-blognetwork | High | 58 | Aug 8, 26 |
| SHA256 | 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522 file-hashintel-blogloader | Medium | 53 | Aug 8, 26 |
| Domain | cdn.zoom.com.kg intel-blogmalwarenetwork | High | 64 | Aug 8, 26 |
| Domain | hub.zoom.com.kg indicatorintel-blogmalware | High | 64 | Aug 8, 26 |
| SHA256 | b5f1a21dcd315676a4a9217a40ef830c159121528114c6436e671c2fa5455681 file-hashintel-blogloader | Medium | 53 | Aug 8, 26 |
| IP | 179.61.227.46 intel-blogloadermalware | High | 64 | Aug 8, 26 |
| SHA256 | d4cf150d6effeea315f136cdf448e32f4a8daac9e95f46def6a31ba18787dae3 file-hashintel-blogloader | Medium | 53 | Aug 8, 26 |
| SHA256 | 5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8 file-hashindicatorintel-blog | High | 61 | Aug 8, 26 |
| SHA256 | 2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00 file-hashindicatorintel-blog | Medium | 53 | Aug 8, 26 |
| IP | 18.204.152.241 indicatorintel-blognetwork | High | 58 | Aug 8, 26 |
| SHA256 | 9d8948e64f75c203e28f90f5bd7678dde6bd351c7507eecdaaeab2fbe4ec43bb file-hashindicatorintel-blog | Medium | 53 | Aug 8, 26 |
IOC Relationship Graph
IOC Relationship Graph14 total IOCs
DomainSHA256IP