Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
Executive Summary During routine malware analysis, I discovered a PowerShell-based dropper script being delivered from a malicious C2 domain: URL : https://fancysunshine[.]top/s8dj3bh9w877/Add.ps1 SHA-256 : cb7dee0f26cc30b13e5775877d570fcd4ca2e4f1a89614cc12031d6070b78473 This script disables security controls, fetches 2 payloads(SectopRAT, HiJack Loader), exfiltrates data, and removes all traces of its execution. Full Behavioral Breakdown Step 1: Disables Windows Defender…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://fancysunshine.top/s8dj3bh9w877/Add.ps1 | High | Score 58/100 | First seen |
| URL | https://fancysunshine.top/s8dj3bh9w877/NC.zip | High | Score 58/100 | First seen |
| URL | https://fancysunshine.top/s8dj3bh9w877/upload.php | High | Score 58/100 | First seen |
| SHA256 | cb7dee0f26cc30b13e5775877d570fcd4ca2e4f1a89614cc12031d6070b78473 | Medium | Score 53/100 | First seen |
| URL | https://fancysunshine.top/s8dj3bh9w877/RD.zip | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…