Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
17 IOCs
Carry-On Compromise: TA4922 Packs PackClient
Threat Actors
Excerpt
Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor, Chinese-speaking TA4922. With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem. Overview Proofpoint researchers recently discovered a RAT framework we named PackClient. PackClient is being used by at least one threat actor,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →17 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 35712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e9 | Medium | Score 53/100 | First seen |
| IP | 64.81.30.99 | High | Score 62/100 | First seen |
| SHA256 | 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c | Medium | Score 53/100 | First seen |
| IP | 206.238.196.96 | High | Score 61/100 | First seen |
| SHA256 | 83d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d2 | Medium | Score 53/100 | First seen |
| SHA256 | da90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba293 | Medium | Score 53/100 | First seen |
| SHA256 | aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69f | Medium | Score 53/100 | First seen |
| SHA256 | 832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb242 | Medium | Score 53/100 | First seen |
| SHA256 | 7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94 | Medium | Score 53/100 | First seen |
| SHA256 | 7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a | High | Score 85/100 | First seen |
| IP | 192.229.87.219 | High | Score 58/100 | First seen |
| IP | 192.252.180.45 | High | Score 86/100 | First seen |
| IP | 154.36.188.201 | Medium | Score 45/100 | First seen |
| URL | http://154.36.188.98:8080/Sz9110.bin | High | Score 58/100 | First seen |
| SHA256 | 109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7 | Medium | Score 55/100 | First seen |
| Domain | gov12366.com | Medium | Score 57/100 | First seen |
| SHA256 | fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53 | Medium | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…