Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
33 IOCs
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Malware Families
Excerpt
In this article Attack chain overview Campaign scope and targeting Mitigation and protection guidance References Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →33 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 47.243.218.255 | High | Score 58/100 | First seen |
| SHA256 | aea879a0689d4f0510d63043570474978bf51013a2d5b5d9154ec1238d8b2da5 | High | Score 85/100 | First seen |
| URL | https://www.gehie246.com/712down | High | Score 58/100 | First seen |
| SHA256 | e4fe2dee8f0bb132fa15fc686d1f93df39530a2d3a8d3a1f3a605a057c04e7b3 | Medium | Score 53/100 | First seen |
| Domain | pc-razerzone.com.cn | High | Score 63/100 | First seen |
| Domain | hl.cn | High | Score 58/100 | First seen |
| Domain | mindmoster.com.cn | High | Score 58/100 | First seen |
| Domain | translate-youdao.hl.cn | High | Score 58/100 | First seen |
| IP | 202.95.14.237 | High | Score 58/100 | First seen |
| SHA256 | 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7 | Medium | Score 53/100 | First seen |
| URL | http://www.gehie246.com/712down | High | Score 58/100 | First seen |
| Domain | steelseries-cn.com.cn | High | Score 58/100 | First seen |
| Domain | sejda.hl.cn | High | Score 58/100 | First seen |
| Domain | kaspersky-lab.hl.cn | High | Score 58/100 | First seen |
| Domain | iualef.net | High | Score 58/100 | First seen |
| Domain | baidu-pan.com.cn | High | Score 58/100 | First seen |
| SHA256 | 6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002 | High | Score 85/100 | First seen |
| IP | 47.239.232.245 | High | Score 58/100 | First seen |
| Domain | ocam-pc.com.cn | High | Score 58/100 | First seen |
| Domain | gw-sogou.com.cn | High | Score 58/100 | First seen |
| Domain | app-microsoft-edge.com.cn | High | Score 58/100 | First seen |
| Domain | calibre-ebook.com.cn | High | Score 58/100 | First seen |
| IP | 103.183.3.162 | High | Score 58/100 | First seen |
| Domain | cn-drawio.com.cn | High | Score 58/100 | First seen |
| SHA256 | c6100166e2d3b40388980f7674712ef39e937ac04925ca5d370415399ed73faf | Medium | Score 53/100 | First seen |
| SHA256 | 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 | Medium | Score 53/100 | First seen |
| Domain | zh-diskgenius.com.cn | High | Score 58/100 | First seen |
| Domain | oijfwe.net | High | Score 58/100 | First seen |
| IP | 103.156.25.35 | High | Score 58/100 | First seen |
| SHA256 | f33d160d757e4b39019fdef21cf90cafb501b800ca0d4039366bc30856e3d81b | Medium | Score 53/100 | First seen |
| Domain | com.cn | High | Score 68/100 | First seen |
| SHA256 | c4100ad39d8db98f063feb6c3b6c8e9a9f9d9bf25a1e0233f43b058ff8a7dbdf | Medium | Score 53/100 | First seen |
| SHA256 | 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…