Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
28 IOCs
New WhiskerSpy Backdoor via Watering Hole Attack -Detection & Response
Malware Families
Excerpt
Security researchers say a new backdoor called Whisker Spy is being used in a campaign by a relatively new advanced threat actor tracked as Earth Fox, known for targeting individuals showing interest in North Korea. The actor used a tried and tested method and picked victims from visitors to a pro North Korea website, a tactic known as a watering hole attack. ALSO READ : Anatomy Of An Advanced Persistent Threat Group Watering hole attack According to Trend Micro,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →28 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | fbac7b40a12970cdcc36f48945beb83bf9461f14c59cb8106ad8e43e5d22a970 | Medium | Score 53/100 | First seen |
| SHA256 | 902902b5457c6945c2b3878521d23d05d448de179d19761c718fb67c15a4bcc0 | Medium | Score 53/100 | First seen |
| Domain | updategoogle.servehttp.com | High | Score 58/100 | First seen |
| Domain | googlemap.hopto.org | High | Score 58/100 | First seen |
| Domain | selectorioi.ddns.net | High | Score 58/100 | First seen |
| SHA256 | 371cfa10a7262438e5bc0694ba5628eb21e044dc8173710df51826dafa11e300 | Medium | Score 53/100 | First seen |
| Domain | liveupdate.servepics.com | High | Score 58/100 | First seen |
| SHA256 | 66c8e0acfe030c4eec474cd75c4d831601dae3ef4e1cef78b624de3c346c186d | Medium | Score 53/100 | First seen |
| SHA256 | ce7016067c97421e3050fa8bd7f1950e0707e6deeac20003f5f30f1c58f435bc | Medium | Score 53/100 | First seen |
| Domain | florida.serveblog.net | High | Score 58/100 | First seen |
| SHA256 | 3d4107c738b46f75c5b1b88ef06f82a5779ddd830527c9becc951080a5491f13 | Medium | Score 53/100 | First seen |
| SHA256 | 7365f661ad9e558fdd668d3563e0a1b85ccf1a543be51cb942db508f9ccbcf5e | Medium | Score 53/100 | First seen |
| SHA256 | 20c214d58ccfb5ad797f1a02667078d182629ac7e157162566c123519e039d55 | Medium | Score 53/100 | First seen |
| SHA256 | 1c24d9013b3eae373fc28d40f9e475e1dd22c228e8f1e539ed9229e21807839d | Medium | Score 53/100 | First seen |
| Domain | googlemap.serveblog.net | High | Score 58/100 | First seen |
| SHA256 | 6f0a0ac477c73c2533a39cb3d8fbf45365761d11b7368460964a4572e91c5fcb | Medium | Score 53/100 | First seen |
| SHA256 | 076ba1135b2f9f4dbc38e306dc533af71b311c1dc98788c18253448fca096c46 | Medium | Score 53/100 | First seen |
| Domain | microsoftwindow.sytes.net | High | Score 58/100 | First seen |
| Domain | rs.myftp.biz | High | Score 58/100 | First seen |
| SHA256 | 84e9bcc055225bd50534147e355834325b97ad948c3a10d792928b48c56c1712 | Medium | Score 53/100 | First seen |
| SHA256 | c78cb41f4fb4e5f5476eb2c1414f138643494c2b8abe2cf539fafc54199e2aef | Medium | Score 53/100 | First seen |
| Domain | chromecast.hopto.org | High | Score 58/100 | First seen |
| SHA256 | c357e572dd7c618c54f8333313266a8a9cf07c1038d6b2f711cdbae714bc2654 | Medium | Score 53/100 | First seen |
| SHA256 | 3d62e122e31d7929e76633773d752b8bee31462bb79cb5b8b7c6952341e93482 | Medium | Score 53/100 | First seen |
| SHA256 | e01399d47cda45f1af496fa460f20620a5b08c39714875fe292a5fc3d1c7a215 | Medium | Score 53/100 | First seen |
| SHA256 | effa1ae32dbcf6bc64a5025bca4f4c41572439b69edd58b5f78952a407ceb5df | Medium | Score 53/100 | First seen |
| Domain | windowsupdate.sytes.net | High | Score 58/100 | First seen |
| Domain | londoncity.hopto.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…