Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE12 IOCs
SMTP is the key: BPFDoor and AVERAT hitting the network edge
Malware Families
Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Indicators of Compromise12
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f exfiltrationexploitfile-hash | High | 86 | Oct 3, 26 |
| SHA256 | 4925bcca085ec504f51191645da278d8e96698d91f3c6df44146336c697b4de8 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | a65048eb30661e27f8edc2dd8d8c77ec87faec1f1750f6e04e7ecaf069a32858 file-hashintel-blogmalware | High | 86 | Oct 3, 26 |
| SHA256 | 2fe2dd402ee6f9c578fce6dd4b36daaa407e99133e5dd502f2afca80feb60150 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 7e667ba5f9df912e02275d3cfe3809d16f822fe776f4035c84b118ebd925b1b5 file-hashintel-blogmalware | High | 86 | Oct 3, 26 |
| SHA256 | bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47 botnetfile-hashintel-blog | High | 86 | Oct 3, 26 |
| SHA256 | a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | a4379e115d3c4420f5d4b92561022d6e0897990e7297be65c033d47de68e6a6a file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 925c041807d4fb9dfe2ad84f963c2a4c60ea1289f6a0bdccbfb944478ffc2cf2 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3 file-hashintel-blogmalware | High | 86 | Oct 3, 26 |
| SHA256 | 4435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9 aptespionagefile-hash | High | 86 | Oct 3, 26 |
| SHA256 | 2bedc26d4b29b435c21962beed7db21188a0219a0d28334bba8b4fb1656d7b15 botnetfile-hashintel-blog | High | 86 | Oct 3, 26 |
IOC Relationship Graph
IOC Relationship Graph12 total IOCs
SHA256