Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
TL;DR ConvertyFile is a browser hijacker, delivered via ads, that changes the browser’s default search engine. Table of Contents TL;DR Tactical Pause Summary Up Front Intro Google Advertisement Delivery Execution Config Server Search Hijack Flow Closing Thoughts Summary References IOCs WITH PLANNY ALOHA, MAHALO FOR YOUR TIME Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT REFLECT THOSE OF MY EMPLOYER OR ANY AFFILIATED…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | govsalaries.com | High | Score 63/100 | First seen |
| SHA256 | 3d82200083a86df09c3b16c9095b844738a76863b1b01092b6c4dbef3b974b12 | High | Score 56/100 | First seen |
| URL | https://scep.sqlokik.com | High | Score 58/100 | First seen |
| Domain | searchretrorevive.com | High | Score 63/100 | First seen |
| Domain | portite.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…