Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE15 IOCs
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
GI
Group-IBThreat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(3)
Capability(5)
Victim
Indicators of Compromise
Indicators of Compromise15
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| IP | 104.248.130.195 intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| SHA256 | 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| SHA256 | d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| IP | 2.59.134.215 intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| Domain | kgbrat.org intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| SHA256 | 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
IOC Relationship Graph
IOC Relationship Graph15 total IOCs
SHA256IPDomain