Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI
Excerpt
By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain gets used as it’s just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 | High | Score 64/100 | First seen |
| SHA256 | 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0 | Medium | Score 53/100 | First seen |
| URL | http://pestrear-lamp.xyz:443 | High | Score 58/100 | First seen |
| SHA256 | 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 | Medium | Score 53/100 | First seen |
| SHA256 | d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96 | Medium | Score 53/100 | First seen |
| URL | http://anus-staylard.xyz:443 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…