Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
57 IOCs
How RL mapped a Midnight Blizzard-linked campaign from two hashes
Threat Actors
Malware Families
Excerpt
How RL mapped a Midnight Blizzard-linked campaign from two hashes | RL Blog The inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security is out GET THE REPORT ReversingLabs: The More Powerful, Cost-Effective Alternative to VirusTotal See Why Get an Inside Look at Spectra Assure Community | Stop Trusting & Start Verifying Your Software Watch Now [ANALYSIS] THE PATCH IS THE ATTACK PAYLOAD READ NOW The Tale of ClickFix: How Malware-as-a-Service campaigns turn…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →57 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 1b97e0df9600335b0cd8db2eb4577d3dbf6e76db | Medium | Score 53/100 | First seen |
| SHA256 | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | High | Score 83/100 | First seen |
| Domain | chamber-ua.org | High | Score 58/100 | First seen |
| SHA256 | 403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f | High | Score 56/100 | First seen |
| IP | 107.189.24.79 | High | Score 58/100 | First seen |
| SHA1 | 510af9bb00ff5d4a6856b1291af55db9f6e13551 | Medium | Score 53/100 | First seen |
| URL | https://213.145.86.112/cdn/chunks/vendor-9f3a1c.min.js?ref=95766022&stub=1 | High | Score 58/100 | First seen |
| Domain | chathamhouse.eu | High | Score 73/100 | First seen |
| SHA1 | 154d8cfd9e304b6644216456759b7fd12daf85c1 | Medium | Score 53/100 | First seen |
| IP | 172.67.136.242 | High | Score 58/100 | First seen |
| SHA1 | 6e5c658261f72fda92d475ac96f0213159af785d | Medium | Score 53/100 | First seen |
| SHA256 | 6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97 | High | Score 56/100 | First seen |
| URL | https://213.145.86.112/s?r= | High | Score 58/100 | First seen |
| IP | 38.146.28.75 | High | Score 75/100 | First seen |
| IP | 188.114.97.3 | Medium | Score 63/100 | First seen |
| IP | 31.57.243.154 | High | Score 75/100 | First seen |
| URL | https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js | High | Score 61/100 | First seen |
| IP | 38.146.28.132 | High | Score 72/100 | First seen |
| SHA256 | 20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38 | High | Score 56/100 | First seen |
| URL | https://213.145.86.112/s | High | Score 58/100 | First seen |
| IP | 104.194.151.133 | Medium | Score 62/100 | First seen |
| IP | 107.189.26.194 | High | Score 71/100 | First seen |
| URL | https://213.145.86.112/cdn/chunks/vendor-9f3a1c.min.js?ref=0f511e19&stub=1 | High | Score 58/100 | First seen |
| Domain | owa-ms365.com | High | Score 77/100 | First seen |
| SHA256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | High | Score 83/100 | First seen |
| SHA1 | 7acb7082d37854877a08999374460c9d7e5cd663 | Medium | Score 53/100 | First seen |
| URL | https://213.145.86.112/t/pixel.gif?r=&m=stage2_entry8 | High | Score 58/100 | First seen |
| IP | 104.194.159.150 | High | Score 80/100 | First seen |
| IP | 104.145.210.184 | High | Score 82/100 | First seen |
| IP | 104.194.159.55 | High | Score 58/100 | First seen |
| URL | https://213.145.86.112/s?r=0f511e19 | High | Score 58/100 | First seen |
| Domain | m365-owa.com | High | Score 77/100 | First seen |
| URL | https://213.145.86.112/cdn/chunks/vendor-9f3a1c.min.js?ref= | High | Score 58/100 | First seen |
| SHA256 | 92cf0b883d220ba37f5ab378920fefdfdddc4fa76ee6c046696a7e5853a95c33 | Medium | Score 53/100 | First seen |
| SHA1 | e82a7c86677c5752dceb6b848754698571fb0aa8 | Medium | Score 53/100 | First seen |
| SHA256 | 5bc3c615da8dd7ef45e421d26a97644679ba0a0647b24efc96ebed8348f403d2 | Medium | Score 53/100 | First seen |
| URL | https://213.145.86.112/t/event | High | Score 62/100 | First seen |
| Domain | ms365-live.com | High | Score 75/100 | First seen |
| Domain | cdncounter.net | High | Score 58/100 | First seen |
| IP | 45.59.122.181 | High | Score 58/100 | First seen |
| anna.manager@russianearabroad.net | High | Score 58/100 | First seen | |
| SHA256 | ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25 | High | Score 56/100 | First seen |
| SHA1 | 937e75e0e1c82eecab69e9b8ad481bd7e0845308 | Medium | Score 53/100 | First seen |
| MD5 | c6f4df18cb880500f3921a179c3a3766 | High | Score 85/100 | First seen |
| URL | https://213.145.86.112/* | High | Score 58/100 | First seen |
| SHA1 | 99f2eac2f00451a9a55521905add54205e336b9d | Medium | Score 53/100 | First seen |
| IP | 192.142.52.31 | High | Score 58/100 | First seen |
| Domain | wa-meeting.com | High | Score 58/100 | First seen |
| SHA1 | 04b64591837c5c2696c2a4423b1bb3dab00a0f01 | Medium | Score 53/100 | First seen |
| MD5 | fba867df17721879df9d8dcca68d6900 | High | Score 85/100 | First seen |
| URL | https://213.145.86.112/s?r=7ed4bb1d | High | Score 58/100 | First seen |
| Domain | ms365-device.com | High | Score 77/100 | First seen |
| SHA256 | 28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3 | High | Score 56/100 | First seen |
| SHA1 | 9c5c539138df6cfcd854c55316bb527520025928 | Medium | Score 53/100 | First seen |
| SHA256 | 1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916 | High | Score 56/100 | First seen |
| events@embassy-protocol.int | High | Score 58/100 | First seen | |
| URL | https://213.145.86.112/t/pixel.gif?m=stage2_ctx_admin_la_true&r=r= | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…