Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
Malware Analysis — Xworm Xworm is a type of malware that spreads through removable drives , such as USB flash drives , infecting Windows systems and potentially stealing information or allowing remote access. Malware Bazaar Sample As always, this sample has been downloaded and extracted using the password ‘infected.’ At first glance, it seemed like a simple deobfuscation task, but I later found out that it is a multi-stage malware. Stage1 — Obfuscated VBS code This seemed…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 983865b130c91b9b3a36d488afbdd1bd | Medium | Score 53/100 | First seen |
| Domain | pastebin.com | High | Score 61/100 | First seen |
| MD5 | ddb09774c5a870c73cf0cf71e6d97d3e | Medium | Score 53/100 | First seen |
| Domain | febxworm39090.duckdns.org | High | Score 58/100 | First seen |
| MD5 | 1a2b23fd06525561826e61fc104b66d0 | Medium | Score 53/100 | First seen |
| URL | https://uploaddeimagens.com.br/images/004/739/227/original/new_image.jpg?1707826222</li><li>http://45.74.19.84/xampp/bkp/vbs_novo_new_image.jpg</li><li>https://wayoutkwt.com/bk/fexrw.txt</li><li>https://pastebin.com/raw/G9zY5tnh</li><li>febxworm39090.duckdns.org</li><li>45.74.19.84</li><li>85673635.vbs | High | Score 58/100 | First seen |
| Domain | wayoutkwt.com | High | Score 58/100 | First seen |
| MD5 | ce91eb459e4f6a9e2871088d855cd211 | Medium | Score 53/100 | First seen |
| IP | 45.74.19.84 | High | Score 58/100 | First seen |
| MD5 | 032c2cc1862303d06832c0ebe34b9dae | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…