Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE29 IOCs
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Indicators of Compromise29
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://gcm.setelagoas.mg.gov.br/files/ti.zip intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://minacu.go.gov.br/ComprovantePDF.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | http://suporte.ourinhos.sp.gov.br:443/files/s.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78a file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce6 botnetfile-hashintel-blog | High | 85 | Sep 2, 26 |
| URL | https://jmcov.gov.py/cxv.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4f file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | http://gcm.setelagoas.mg.gov.br/files/notepadd.exe africaai-assisted malwarebanking software | Medium | 45 | Sep 2, 26 |
| URL | http://suporte.ourinhos.sp.gov.br/files/s.zip intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://cmgovernadorluizrocha.ma.gov.br/Comprovantepdf.exe exfiltrationintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | de4e533c9062c62b3ba3a5d88eff111156075f2c92d243737edeead6481a9fd5 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | d2aa40cc53b40c6e76ac0677c4a54387b3f27ee94c85d9b2c3a3d66aeef92a66 aptbotnetespionage | High | 85 | Sep 2, 26 |
| URL | https://tisup.camaratunapolis.sc.gov.br/SoftEther.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://sit.baer.gob.ve/r.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | dontpad.com exfiltrationindicatorintel-blog | Low | 32 | Sep 1, 26 |
| SHA256 | 6d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6ceb file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | https://www.mrtb.gov.ng/apps/attvpn.vip intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://servicos.salto.sp.gov.br/j.jar intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://suporte.camaratunapolis.sc.gov.br/ti/attvpn.zip intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://conseg.ssp.go.gov.br/ComprovanteBBpix.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | http://suporte.ourinhos.sp.gov.br/files/a.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://suporte.camaratunapolis.sc.gov.br/ti/1.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | http://gcm.setelagoas.mg.gov.br/files/tes.exe africaai-assisted malwarebanking software | Medium | 45 | Sep 2, 26 |
| URL | http://credeb.gov.gn/r.zip intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | 447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e8 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 2214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439a file-hashindicatorintel-blog | Medium | 55 | Sep 2, 26 |
| URL | https://conseg.ssp.go.gov.br/COAF-POLICIAFEDERAL.exe intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://procon.go.gov.br/ComprovantePDF.exe exfiltrationintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | 3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec aptbotnetespionage | High | 85 | Sep 2, 26 |
IOC Relationship Graph
IOC Relationship Graph29 total IOCs
URLSHA256Domain