Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
Following up on my previous post , I wanted to start a weekend hunt from Prospero’s networks, a well known BPH provider. As of this writing, the AS 200593 has 2 IP Blocks. Since there will be a lot of domains and DNS related queries in this hunt, we will be using Validin’t platform as it’s a goldmine of information. First things first, let’s see how many hosts we can find active on those networks. # IP Blocks 91.202.233.0/24 91.215.85.0/24 Breaking the…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | sweedbank-help.com | High | Score 58/100 | First seen |
| MD5 | 55e090957d46b51d03547dba1763cdf0 | Medium | Score 53/100 | First seen |
| Domain | neifiixapp.com | High | Score 58/100 | First seen |
| Domain | trusted-fastbtc.top | High | Score 58/100 | First seen |
| Domain | transport-mondiairelay.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…