Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan
Threat Actors
Malware Families
Excerpt
Authors: Dixit Panchal & Vaibhav Krushna Billade Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoy: Technical Analysis: Stage 1: Analysis of LNK File. Stage 2: Analysis of HTA/JavaScript Payload Stage 3: Analysis of Stage-1 Loader DLL Stage 4: Analysis of Stage-2 Loader DLL and Shellcode Stage 5: Analysis of XenoRAT. Infrastructural Artefacts & Threat actor Attributions. Conclusion: Operation XENOFISCAL?…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | a63e90ee57a1f213a8fe76ef1a6cff5ae9ed7ebceda258431533825e648c0c67 | Medium | Score 53/100 | First seen |
| SHA256 | 8f2d979ef33b2900351c94c7335275a9342c75189e1a901998e90a539e944a1a | Medium | Score 53/100 | First seen |
| SHA256 | 99127c8c67d90e2776beeb85281f9c68399bf4567b07a6b638d68b760212e88d | High | Score 61/100 | First seen |
| SHA256 | 194b912c242604d6f9a79369f22338c58a13ce0cc2ed280ce505075808bc2f14 | Medium | Score 53/100 | First seen |
| URL | https://abimj.edu.af/institute/7/ | High | Score 58/100 | First seen |
| SHA256 | 3b4194bdfe40d94031a94b30397ffd8a4b09d0a4057668e897b8bdcd1703dd01 | Medium | Score 53/100 | First seen |
| SHA256 | 0019212f25eb04bbb33bb194879c095265db7855d6003bdd777cf0cbb90eb772 | Medium | Score 53/100 | First seen |
| URL | https://abimj.edu.af/institute/10/ | High | Score 58/100 | First seen |
| SHA256 | df9173a28c0b0b878c10a53d35cd7ce6f6ed66d207b6b7c4ff723721f1c027ab | Medium | Score 53/100 | First seen |
| URL | http://abimj.edu.af/institute/cloudiyaf/document.pdf. | High | Score 58/100 | First seen |
| SHA256 | 9ae3d785486022af82ea92e51b26e3f55c1bba88a7be2ad9790f4240e8499d14 | Medium | Score 53/100 | First seen |
| URL | http://abimj.edu.af/institute/cloudiya/ | High | Score 58/100 | First seen |
| SHA256 | 5833917bd137804f5a021d2cb37adfe5c4b7b67dbb06d59c3b9c5cf393835e45 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…