Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
Malware Analysis — AgentTesla Agent Tesla is a widely-used remote access Trojan (RAT) known for its keylogging and data exfiltration capabilities, often used in cyber espionage and information theft. In this report I will Analyze an AgentTesla Sample that was uploaded to MalwareBazaar. MalwareBazaar — Initial Sample Stage 1- As usual I downloaded the file and extracted it using the password “infected”. .BAT file Just from looking at it I noticed that I’m dealing with JS and…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 416c046fdcf4625c189ec37230052b62 | Medium | Score 53/100 | First seen |
| URL | https://didaktik-labor.de/mx1.jpg | High | Score 58/100 | First seen |
| URL | http://knoow.net/ | High | Score 58/100 | First seen |
| URL | https://account.dyn.com | High | Score 58/100 | First seen |
| MD5 | 2e8ecadb887cb758c0b0dcb79442d616 | Medium | Score 53/100 | First seen |
| MD5 | 11d8ddcb74dd3c1c10dcf8e6df8e5af9 | Medium | Score 53/100 | First seen |
| MD5 | 380c9e85f6960add801843076c33ec3b | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…