Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
Excerpt
Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg). In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a brute-force search for the embedded OLE file, or you can follow a pointer inside the header of the DWG file. I wrote a small Python script ( autocad.py ) for this second case. It looks at a 32-bit pointer at position 0x24 inside the DWG file. This points to a 16-byte long header,…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 | High | Score 56/100 | First seen |
| SHA256 | 461ed52aeb75384133a8238b2eb481ae5d505d4961effa622673d65a889c8218 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…