Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
21 IOCs
Oyster Malware Delivery via Teams Fake App
Malware Families
Excerpt
Table of Contents TL;DR Tactical Pause Intro Initial Lead Delivery Execution Beacon Summary Indicators Pivots Detections References TL;DR Oyster malware delivery via MS Teams Fake App. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT REFLECT THOSE OF MY EMPLOYER OR ANY AFFILIATED ORGANIZATIONS. ALL RESEARCH, ANALYSIS, AND WRITING ARE CONDUCTED ON MY PERSONAL TIME AND USING MY OWN PERSONALLY-ACQUIRED RESOURCES. ANY REFERENCES,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →21 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | witherspoon-law.com | High | Score 58/100 | First seen |
| IP | 85.239.53.66 | High | Score 58/100 | First seen |
| Domain | teams-install.icu | High | Score 58/100 | First seen |
| Domain | teams-install.run | High | Score 58/100 | First seen |
| Domain | teams-download.top | High | Score 58/100 | First seen |
| IP | 51.222.96.108 | High | Score 58/100 | First seen |
| Domain | daringdatadaredevils.com | High | Score 58/100 | First seen |
| IP | 185.28.119.228 | High | Score 58/100 | First seen |
| Domain | techwisenetwork.com | High | Score 58/100 | First seen |
| SHA256 | 291973f004fcaa78e053a33a99b2bb0b09cb80d9e972aa26d0b5715c75eef64a | Medium | Score 53/100 | First seen |
| Domain | eastridge-infotech.com | High | Score 58/100 | First seen |
| IP | 135.125.241.45 | High | Score 58/100 | First seen |
| Domain | nickbush24.com | High | Score 58/100 | First seen |
| SHA256 | e59b6d89b90dd6dbbe3aa3ac163eea3d659e952bac6a6bf65b99e40157cb95f5 | Medium | Score 53/100 | First seen |
| IP | 51.222.96.69 | High | Score 58/100 | First seen |
| Domain | funkyfirmware.com | High | Score 58/100 | First seen |
| Domain | datadrivendreamers.com | High | Score 58/100 | First seen |
| Domain | teams-download.buzz | High | Score 64/100 | First seen |
| Domain | cybersavvynetwork.com | High | Score 58/100 | First seen |
| Domain | teams-install.top | High | Score 58/100 | First seen |
| Domain | teams-download.icu | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…