Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
24 IOCs
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
Threat Actors
Excerpt
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware . Preamble Elastic Security Labs has identified a novel social engineering campaign that abuses the popular note-taking application, Obsidian , as an initial access vector. The campaign, which we track as REF6598, targets individuals in the financial…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →24 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://195.3.222.251/syncobs.exe?q=%23OBSIDIAN | High | Score 58/100 | First seen |
| Domain | trycloudflare.com | High | Score 67/100 | First seen |
| MD5 | dcf5a9b27cbeedb769ccc8635d204af9 | High | Score 64/100 | First seen |
| SHA256 | 70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980 | High | Score 65/100 | First seen |
| Domain | optimism.blockscout.com | High | Score 71/100 | First seen |
| URL | http://195.3.222.251/script1.ps1 | High | Score 58/100 | First seen |
| URL | https://panel.fefea22134.net | High | Score 71/100 | First seen |
| SHA256 | 33dacf9f854f636216e5062ca252df8e5bed652efd78b86512f5b868b11ee70f | High | Score 65/100 | First seen |
| Domain | 0x666.info | High | Score 86/100 | First seen |
| MD5 | f77c8e40dfc17be5e74d8679d5b35341 | High | Score 64/100 | First seen |
| SHA256 | 6a85736b64761a8b2aaeadc1c0087e1897d16cc5a9d49c6a6ea1164233bad206 | High | Score 64/100 | First seen |
| IP | 172.67.146.15 | High | Score 69/100 | First seen |
| URL | https://thoroughly-publisher-troy-clara.trycloudflare.com | High | Score 69/100 | First seen |
| SHA1 | 6c0a1da746438d68f6c4ffbf9a10e873f3cf0499 | High | Score 64/100 | First seen |
| MD5 | 346272f0582541ae5dd08429bb4dc4ff | Medium | Score 53/100 | First seen |
| IP | 188.114.97.1 | High | Score 71/100 | First seen |
| IP | 104.21.79.142 | High | Score 69/100 | First seen |
| Domain | fefea22134.net | High | Score 69/100 | First seen |
| Domain | base.blockscout.com | High | Score 71/100 | First seen |
| MD5 | a6fa4adfc20e8e6b77e2dd631dc8ff18 | High | Score 64/100 | First seen |
| Domain | eth.blockscout.com | High | Score 71/100 | First seen |
| URL | http://195.3.222.251/stuk-phase | High | Score 58/100 | First seen |
| SHA256 | 9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085d | Medium | Score 53/100 | First seen |
| IP | 188.114.96.1 | Medium | Score 65/100 | First seen |
IOC Relationship Graph
Building graph…