Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Hidden World of xattr: Lazarus Group’s Abuse of "Rustyattr" to Evade Detection
Threat Actors
Excerpt
A technique, often overlooked, involves the use of extended file attributes —specifically the xattr command found in Unix-like operating systems such as macOS and Linux. Much like Windows Alternate Data Streams (ADS) , which allows attackers to hide data in the NTFS filesystem, xattr provides a mechanism for embedding metadata alongside files without altering their visible content. This stealthy use of xattr (which we’ll refer to as Rustyattr ) has been…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357 | Medium | Score 53/100 | First seen |
| IP | 104.168.165.203 | High | Score 58/100 | First seen |
| SHA512 | e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f7464850d7d6891418c503d0e1732812d7703d6c1fd5cf3c821f3c202786f9422 | Medium | Score 53/100 | First seen |
| IP | 104.168.157.45 | High | Score 58/100 | First seen |
| Domain | cloudstore.business | High | Score 58/100 | First seen |
| SHA256 | 878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552 | Medium | Score 53/100 | First seen |
| SHA256 | 48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215 | Medium | Score 53/100 | First seen |
| SHA256 | 022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e | Medium | Score 53/100 | First seen |
| Domain | docsend.site | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…