Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
56 IOCs
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Threat Actors
Malware Families
Excerpt
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion - The DFIR Report Read our latest report Click here X Public Reports Products Products Overview Threat Intel Threat Feed Private DFIR Reports All Intel Active Defense DFIR Labs Case Artifacts - Detection Pack AI Training Ground - bruteratel From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More - dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(11)
Victim
Indicators of Compromise
Open the mindmap →56 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 33a6b39fbe8ec45afab14af88fd6fa8e96885bf1 | Medium | Score 53/100 | First seen |
| Domain | kasymdev.com | Medium | Score 67/100 | First seen |
| Domain | altynbe.com | High | Score 78/100 | First seen |
| URL | http://45.129.199.214/vodeo/wg01ck01 | High | Score 58/100 | First seen |
| URL | https://illoskanawer.com/live/ | High | Score 58/100 | First seen |
| SHA256 | 37471af00673af4080ee21bd248536147e450d2eff45e8701a95d1163a9d62fe | Medium | Score 53/100 | First seen |
| Domain | dauled.com | Medium | Score 67/100 | First seen |
| SHA1 | ba99cd73b74c64d6b1257b7db99814d1dc7d76b1 | Medium | Score 53/100 | First seen |
| IP | 217.196.98.61 | High | Score 76/100 | First seen |
| CVE | CVE-2020-1472 | Medium | Score 61/100 | First seen |
| IP | 193.168.143.196 | Medium | Score 62/100 | First seen |
| SHA1 | 4a013f752c2bf84ca37e418175e0d9b6f61f636d | Medium | Score 53/100 | First seen |
| MD5 | c8ea31665553cbca19b22863eea6ca2c | Medium | Score 53/100 | First seen |
| SHA1 | 8dfa63c0bb611e18c8331ed5b89decf433ac394a | Medium | Score 53/100 | First seen |
| SHA256 | 411dfb067a984a244ff0c41887d4a09fbbcd8d562550f5d32d58a6a6256bd7b2 | Medium | Score 53/100 | First seen |
| SHA1 | 5348970723b378c7cae35bb03d8736f8e5a9f0ac | Medium | Score 53/100 | First seen |
| SHA1 | 333e1c5967a9a6c881c9573a3222bed6ada911c6 | Medium | Score 53/100 | First seen |
| MD5 | d7bd590b6c660716277383aa23cb0aa9 | Medium | Score 53/100 | First seen |
| Domain | erbolsan.com | Medium | Score 67/100 | First seen |
| Domain | grasmetral.com | Medium | Score 67/100 | First seen |
| Domain | jarkaairbo.com | Medium | Score 67/100 | First seen |
| SHA256 | 8fb5034aedf41f8c8c4c4022fdde7db3c70a5a7c7b5b4dec7f6a57715c18a5bf | Medium | Score 53/100 | First seen |
| Domain | kasym500.com | Medium | Score 68/100 | First seen |
| MD5 | 50abc42faa70062e20cd5e2a2e2b6633 | Medium | Score 53/100 | First seen |
| MD5 | ad3c52316e0059c66bc1dd680cf9edad | Medium | Score 53/100 | First seen |
| SHA256 | 36bc32becf287402bf0e9c918de22d886a74c501a33aa08dcb9be2f222fa6e24 | Medium | Score 53/100 | First seen |
| SHA256 | 203eda879dbdb128259cd658b22c9c21c66cbcfa1e2f39879c73b4dafb84c592 | Medium | Score 53/100 | First seen |
| SHA256 | 1a8ebf914ebea34402eecbf0985f05ae413663708d2fcc842fc27057ac5ec4ed | Medium | Score 53/100 | First seen |
| URL | https://workspacin.cloud/live/ | High | Score 58/100 | First seen |
| SHA256 | f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de | Medium | Score 53/100 | First seen |
| Domain | avtechupdate.com | Medium | Score 58/100 | First seen |
| URL | https://cloudmeri.com/comm.php | High | Score 58/100 | First seen |
| MD5 | 91889658f1c8e1462f06f019b842f109 | Medium | Score 53/100 | First seen |
| SHA1 | 23fff588e3e5cc6678e1f77fab9318d60f3ac55f | Medium | Score 53/100 | First seen |
| SHA256 | 100e03eb4e9dcdab6e06b2b26f800d47a21d338885f5dc1b42c56a32429c9168 | Medium | Score 53/100 | First seen |
| URL | http://91.194.11.64/MSI.msi | High | Score 58/100 | First seen |
| SHA256 | 77eede38abdc740f000596e374b6842902653aeafb6c63011388ebb22ec13e28 | Medium | Score 53/100 | First seen |
| URL | http://127.0.0.1:11664/ | High | Score 58/100 | First seen |
| SHA1 | 97d72c8bbcf367be6bd5e80021e3bd3232ac309a | Medium | Score 53/100 | First seen |
| Domain | ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io | Low | Score 30/100 | First seen |
| MD5 | a2b6479a69b51ae555f695b243e4fda1 | Medium | Score 53/100 | First seen |
| Domain | samderat200.com | Medium | Score 67/100 | First seen |
| Domain | scupolasta.store | Medium | Score 67/100 | First seen |
| URL | http://127.0.0.1:24003/ | High | Score 58/100 | First seen |
| Domain | uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io | Low | Score 32/100 | First seen |
| MD5 | 495363b0262b62dfc38d7bfb7b5541aa | Medium | Score 53/100 | First seen |
| MD5 | 4b3e9c9e018659d1cf04daf82abe3b64 | Medium | Score 53/100 | First seen |
| Domain | boriz400.com | High | Score 58/100 | First seen |
| MD5 | ccb6d3cb020f56758622911ddd2f1fcb | Medium | Score 53/100 | First seen |
| SHA256 | 6c3b2490e99cd8397fb79d84a5638c1a0c4edb516a4b0047aa70b5811483db8f | Medium | Score 53/100 | First seen |
| Domain | anikvan.com | Medium | Score 72/100 | First seen |
| SHA1 | 2d92890374904b49d3c54314d02b952e1a714e99 | Medium | Score 53/100 | First seen |
| IP | 206.206.123.209 | Medium | Score 40/100 | First seen |
| URL | http://127.0.0.1:49157/ | High | Score 58/100 | First seen |
| SHA1 | 38999890b3a2c743e0abea1122649082a5fa1281 | Medium | Score 53/100 | First seen |
| MD5 | 9eaa8464110883a15115b68ffa1ecf7d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…