Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
KongTuke FileFix Leads to New Interlock RAT Variant
Threat Actors
Malware Families
Excerpt
KongTuke FileFix Leads to New Interlock RAT Variant - The DFIR Report Read our latest report Click here X Public Reports Products Products Overview Threat Intel Threat Feed Private DFIR Reports All Intel Active Defense DFIR Labs Case Artifacts - Detection Pack AI Training Ground - bruteratel From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More - dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 64.95.12.71 | High | Score 58/100 | First seen |
| Domain | ferrari-rolling-facilities-lounge.trycloudflare.com | High | Score 58/100 | First seen |
| Domain | existed-bunch-balance-councils.trycloudflare.com | High | Score 58/100 | First seen |
| IP | 184.95.51.165 | High | Score 58/100 | First seen |
| SHA256 | 28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3 | Medium | Score 53/100 | First seen |
| Domain | evidence-deleted-procedure-bringing.trycloudflare.com | High | Score 58/100 | First seen |
| Domain | ranked-accordingly-ab-hired.trycloudflare.com | High | Score 58/100 | First seen |
| Domain | nowhere-locked-manor-hs.trycloudflare.com | High | Score 58/100 | First seen |
| Domain | galleries-physicians-psp-wv.trycloudflare.com | High | Score 58/100 | First seen |
| SHA256 | 8afd6c0636c5d70ac0622396268786190a428635e9cf28ab23add939377727b0 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…