Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Global Group: Ransomware-as-a-Service with AI-powered Negotiation
Threat Actors
Excerpt
Overview IOCs Initial Inspection API Resolution Mutex Creation Emptying Recycle Bin Config Decryption Crypto Context Setup Custom File Icon Setup Print Ransom Note Clear Windows Event Log Delete Shadow Copies Token Elevation Impersonate SYSTEM Impair Defenses Enumerate Domain Devices Remote Execution Local Encryption Setup Local Encryption Start Remote Encryption Start Set Desktop Wallpaper Self Deletion MITRE ATT&CK Mapping Related Samples Acknowledgment Overview In this…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7 | High | Score 85/100 | First seen |
| SHA256 | 13b82f4ac62faf87a105be355c82bacfcbdd383050860dfa93dfbb7bb2e6c9ba | High | Score 84/100 | First seen |
| SHA256 | 232f86e26ced211630957baffcd36dd3bcd6a786f3d307127e1ea9a8b31c199f | Medium | Score 53/100 | First seen |
| SHA256 | 28f3de066878cb710fe5d44f7e11f65f25328beff953e00587ffeb5ac4b2faa8 | Medium | Score 53/100 | First seen |
| SHA256 | c7b91de4b4b10c22f2e3bca1e2603160588fd8fd829fd46103cf536b6082e310 | Medium | Score 53/100 | First seen |
| SHA256 | 1f6640102f6472523830d69630def669dc3433bbb1c0e6183458bd792d420f8e | Medium | Score 53/100 | First seen |
| SHA256 | a8c28bd6f0f1fe6a9b880400853fc86e46d87b69565ef15d8ab757979cd2cc73 | Medium | Score 53/100 | First seen |
| MD5 | c5a8d4c07e1dca5e9cfbbaadfc402063 | Medium | Score 53/100 | First seen |
| SHA1 | c95056c8682373d0512aea2ed72c18f79c854308 | Medium | Score 53/100 | First seen |
| URL | http://vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…