Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
Malware Analysis — Formbook Formbook is a type of malware that specializes in stealing sensitive information from infected systems, primarily focusing on capturing keystrokes, clipboard data, and form data from web browsers. Figure 1: Malware Bazaar Entry After downloading and extracting the .bat file, we observed a relatively simple obfuscation technique — Base64 encoding. At the end, there was a large chunk of code that appeared to be a file. Figure 2: Obfuscated Base64…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 2effd68ca29fb310fbe40749eb566d0e | Medium | Score 53/100 | First seen |
| MD5 | f362f6f1dd0d9521752008cb1789a699 | Medium | Score 53/100 | First seen |
| Domain | mail.agagroup.lv | High | Score 58/100 | First seen |
| remiset@remisat.com.uy | High | Score 58/100 | First seen | |
| SHA256 | 463b92101e5f2912781dd6eb61374b97f14fb27b6fe05c0ef3fb734d8ef4d4ec | Medium | Score 53/100 | First seen |
| MD5 | cbd924de2846331d88a342757c53fe08 | Medium | Score 53/100 | First seen |
| info@agagroup.lv | High | Score 58/100 | First seen | |
| MD5 | 56e3f56dda234344fb2799c10727e642 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…