Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
TL;DR Convert Master is a browser hijacker, delivered via ads, that changes the browsers default search engine – and I’ve observed it using a redirector for the “Retro Revive” fake search engine. Table of Contents TL;DR Tactical Pause Summary Up Front Intro Execution Utility Functions Dynamic Configurations Target Browser or FF Key Functions Browser Hijacking wesd mapilor Code Browser Hijacking Flow Thractor Objectives What is Retro Revive? Summary…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | wesd.mapilor.com | High | Score 58/100 | First seen |
| Domain | retrorevivesearch.com | High | Score 58/100 | First seen |
| Domain | dldthis.com | High | Score 58/100 | First seen |
| SHA256 | d0c7471c7950b2f80dbf92f929dfb0f10d518b551b326e56e9b2870de90196f3 | High | Score 56/100 | First seen |
| URL | https://govsalaries.com/salaries/FD/department-of-veterans-affairs#google_vignette | High | Score 58/100 | First seen |
| URL | https://conf.conclie.com/ConMasD | High | Score 58/100 | First seen |
| Domain | searchretrorevive.com | High | Score 63/100 | First seen |
| URL | https://application.convertmasterapp.com/#/. | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…