Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Abuse.ch ThreatFox (5915 indicators)
Mentioned in this report
Excerpt
ThreatFox url: https://mail.quwatt.com/ Malware:unknown Type:payload_delivery Confidence:90% ThreatFox domain: toad.ampwin123.com Malware:js.clearfake Type:botnet_cc Confidence:90% ThreatFox ip:port: 150.129.80.247:8083 Malware:win.vshell Type:botnet_cc Confidence:100% ThreatFox ip:port: 143.92.62.110:8083 Malware:win.vshell Type:botnet_cc Confidence:100% ThreatFox ip:port: 114.132.178.92:8084 Malware:win.vshell Type:botnet_cc Confidence:100% ThreatFox ip:port:…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(15)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://mail.quwatt.com/ | High | Score 86/100 | First seen |
| IP | 143.92.62.110 | High | Score 86/100 | First seen |
| Domain | toad.ampwin123.com | High | Score 86/100 | First seen |
| IP | 150.129.80.247 | High | Score 86/100 | First seen |
| IP | 114.132.178.92 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…