Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
Malware Analysis — njRAT njRAT is a remote access Trojan (RAT) that allows attackers to gain unauthorized access to a victim’s computer. It is capable of keylogging, taking screenshots, and controlling the victim’s webcam and microphone. It can also download and execute additional malicious payloads. Figure 1: Malware Bazaar Entry After downloading and extracting the zip file, I used OLEtools because I knew I was going to deal with an Office file — specifically, a PowerPoint…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://paste.ee/d/ea2Mw/0 | High | Score 58/100 | First seen |
| URL | https://pt.textbin.net/download/insdj4bhn2 | High | Score 58/100 | First seen |
| MD5 | edf8f50f318c20bccb889743172d9fd2 | Medium | Score 53/100 | First seen |
| SHA256 | cefa4ebf82b3d077a68ce1933be3dc6e9cadce8bc27671a5fcd76ee2f4d04977 | Medium | Score 53/100 | First seen |
| MD5 | 4b7d118b20d8854372129f53365d529f | Medium | Score 53/100 | First seen |
| MD5 | d189af41737b287469ca5f5589dcbdf1 | Medium | Score 53/100 | First seen |
| URL | https://pt.textbin.net/download/tmo7gc3cgs | High | Score 58/100 | First seen |
| URL | https://pt.textbin.net/download/itm1dkgz7c | High | Score 58/100 | First seen |
| MD5 | 6175e14e465756c626ccc0f398fcdcb0 | Medium | Score 53/100 | First seen |
| URL | https://paste.ee/d/jtSmT/0 | High | Score 58/100 | First seen |
| URL | https://pt.textbin.net/download/igvxdijw4q | High | Score 58/100 | First seen |
| URL | https://paste.ee/d/ESa4q/0 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…