Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
14 IOCs
Fake Zoom Installer Delivers Overlord RAT to macOS and Windows Systems
Excerpt
A malware campaign using a fake Zoom installer to deploy Overlord, an open-source remote access trojan (RAT) , across both macOS and Windows systems. Documented by Jamf, notable for its unusual delivery mechanism: a .NET-based downloader, a framework rarely used in macOS malware, which enables the same codebase to target multiple operating systems. The malicious binary, named ZoomMeetings, is a macOS ARM64 Mach-O executable built as a self-contained .NET 10 single-file…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →14 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | dash.zoom.com.kg | High | Score 58/100 | First seen |
| SHA256 | 7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233 | Medium | Score 53/100 | First seen |
| SHA256 | 527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d | Medium | Score 53/100 | First seen |
| Domain | hub.zoom.com.lv | High | Score 58/100 | First seen |
| SHA256 | 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522 | Medium | Score 53/100 | First seen |
| Domain | cdn.zoom.com.kg | High | Score 64/100 | First seen |
| Domain | hub.zoom.com.kg | High | Score 64/100 | First seen |
| SHA256 | b5f1a21dcd315676a4a9217a40ef830c159121528114c6436e671c2fa5455681 | Medium | Score 53/100 | First seen |
| IP | 179.61.227.46 | High | Score 86/100 | First seen |
| SHA256 | d4cf150d6effeea315f136cdf448e32f4a8daac9e95f46def6a31ba18787dae3 | Medium | Score 53/100 | First seen |
| SHA256 | 5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8 | High | Score 61/100 | First seen |
| SHA256 | 2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00 | Medium | Score 53/100 | First seen |
| IP | 18.204.152.241 | High | Score 58/100 | First seen |
| SHA256 | 9d8948e64f75c203e28f90f5bd7678dde6bd351c7507eecdaaeab2fbe4ec43bb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…