Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
CrownX Ransomware Embedded Inside Avalon Framework Targets Recovery and Backup Systems
Threat Actors
Malware Families
Excerpt
A previously undocumented multi-stage malware framework, tracked as Avalon, that embeds a ransomware component internally labeled CrownX and specifically targets recovery and backup systems. By placing malicious content inside an ISO image rather than attaching an executable directly, the actor avoided email-layer scanning and social-engineered victims into mounting a seemingly legitimate “Secure Document” package. A document‑themed shortcut (.lnk) inside the mounted ISO…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | e3ec5926a167d6e3359f98cdfb7ac3b2cce97652843056505d02e6d2898573c6 | Medium | Score 53/100 | First seen |
| URL | https://helloxcherry.com/cdn/static/c3587edc48c37656b29bcd3da9458eea/update | High | Score 58/100 | First seen |
| MD5 | c3587edc48c37656b29bcd3da9458eea | Medium | Score 45/100 | First seen |
IOC Relationship Graph
Building graph…