Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
From KMS Auto to Scareware: Tracking a Multi-Stage Intrusion Linked to APT36?
Threat Actors
Malware Families
Excerpt
KMS Auto is an unauthorized key management and software activation utility commonly used to activate Microsoft products without a valid license. While the tool itself is not inherently malicious, cracked or repackaged versions of KMS Auto have been abused by threat actors for a long time as a delivery mechanism for malware. Over the past several years, our analysis of critical incidents reveals that KMS Auto is frequently present on compromised endpoints, particularly in…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 6dc495f33d4e1b6beb27cd418c8ed5ae | Medium | Score 53/100 | First seen |
| MD5 | d87d7173116eb5fa992ae2b4e57fa025 | Medium | Score 53/100 | First seen |
| MD5 | ac458ece671fdde066ce60e448f12bc0 | High | Score 85/100 | First seen |
| MD5 | d4e0f18025b3f8f329b136bbbee6deea | Medium | Score 53/100 | First seen |
| MD5 | d24448ec0257adfb258846b3317c3b7c | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…