Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
ESET Research white papers CeranaKeeper: A relentless, shape-shifting group targeting Thailand 2 October, 2024 1 CeranaKeeper: A relentless, shape-shifting group targeting Thailand TABLE OF CONTENTS EXECUTIVE SUMMARY ................................................................................................................................................ 2 TURNING A COMPROMISED MACHINE INTO AN UPDATE SERVER…
Read the original report →Diamond Model
Adversary(9)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →29 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | www.dl6yfsl.com | High | Score 68/100 | First seen |
| SHA256 | dafad19900fff383c2790e017c958a1e92e84f7bb159a2a7136923b715a4c94f | High | Score 67/100 | First seen |
| URL | python.readthedocs.io/en/latest/api/dropbox.html#dropbox.dropbox_client.Dropbox.files_upload | High | Score 67/100 | First seen |
| SHA256 | b25c79ba507a256c9ca12a9bd34def6a33f9c087578c03d083d7863c708eca21 | High | Score 67/100 | First seen |
| SHA256 | 3f81d1e70d9ee39c83b582ac3bcc1cdfe038f5da31331cdbcd4ff1a2d15bb7c8 | High | Score 67/100 | First seen |
| URL | https://pixeldrain.com/api | High | Score 67/100 | First seen |
| SHA256 | e7b6164b6ec7b7552c93713403507b531f625a8c64d36b60d660d66e82646696 | High | Score 67/100 | First seen |
| IP | 172.67.165.197 | High | Score 68/100 | First seen |
| IP | 103.245.165.23 | High | Score 68/100 | First seen |
| URL | https://www.sangfor.com/farsight-labs-threat- | High | Score 67/100 | First seen |
| SHA256 | e6ab24b826c034a6d9e152673b91159201577a3a9d626776f95222f01b7c21db | High | Score 67/100 | First seen |
| IP | 98.142.251.29 | High | Score 68/100 | First seen |
| Domain | dljmp2p.com | High | Score 68/100 | First seen |
| Domain | inly5sf.com | High | Score 68/100 | First seen |
| URL | https://pyinstaller.org/en/stable/operating-mode.html | High | Score 67/100 | First seen |
| URL | https://www.ired.team/offensive-security/credential-access-and- | High | Score 67/100 | First seen |
| Domain | www.toptipvideo.com | High | Score 68/100 | First seen |
| Domain | www.uvfr4ep.com | High | Score 68/100 | First seen |
| SHA256 | 451ee465675e674cebe3c42ed41356ae2c972703e1dc7800a187426a6b34efdc | High | Score 67/100 | First seen |
| IP | 103.27.202.185 | High | Score 68/100 | First seen |
| URL | https://ipv4.myip.wtf/text | High | Score 67/100 | First seen |
| SHA256 | 6655c5686b9b0292cf5121fc6346341bb888704b421a85a15011456a9a2c192a | High | Score 67/100 | First seen |
| Domain | tmpfiles.org | High | Score 68/100 | First seen |
| IP | 103.245.165.237 | High | Score 68/100 | First seen |
| URL | https://pastebin.com/raw/5yympk1Q | High | Score 67/100 | First seen |
| SHA256 | b15ba83681c4d2c2716602615288b7e64a1d4a9f4805779cebdf5e6c2399afb5 | High | Score 67/100 | First seen |
| SHA256 | 24e12b8b1255df4e6619ed1a6ae1c75b17341eef7418450e661b74b144570017 | High | Score 67/100 | First seen |
| IP | 104.21.81.233 | High | Score 68/100 | First seen |
| URL | https://pastebin.com/raw/9T1qFbsb | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…