Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER
Threat Actors
Excerpt
Key takeaways A South Asian financial institution was targeted with two custom malware components: a modular backdoor ( BRUSHWORM) and a keylogger ( BRUSHLOGGER) BRUSHWORM features anti-analysis checks, AES-CBC encrypted configuration, scheduled task persistence, modular DLL payload downloading, USB worm propagation, and broad file theft targeting documents, spreadsheets, email archives, and source code The keylogger masquerades as libcurl via DLL side-loading, capturing…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7 | High | Score 64/100 | First seen |
| SHA256 | 4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…