Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Sauron Loader: A New Loader Lurking in Underground Forums
Threat Actors
Malware Families
Excerpt
Magic number used in Sauron Loader This blog post provides a technical analysis of a novel malware we have encountered in multiple recent customer engagements. Sold in the underground as “Sauron Loader” , and undocumented as of now, it offers loader-type functionality exclusively to Russian cybercriminals. We detail its inner workings and offer tools and detection content to the cybersecurity community. Key Takeaways Multiple real-world incidents in Germany with novel malware…
Read the original report →Diamond Model
Adversary(5)
Infrastructure(4)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991 | High | Score 65/100 | First seen |
| SHA256 | ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2 | High | Score 85/100 | First seen |
| SHA256 | 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7 | Medium | Score 53/100 | First seen |
| URL | https://api.quinlantours.com | High | Score 58/100 | First seen |
| SHA256 | 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8 | Medium | Score 53/100 | First seen |
| URL | https://api.namsb-show.com | High | Score 58/100 | First seen |
| URL | https://api.lahaina-shores.com | High | Score 58/100 | First seen |
| URL | https://api.virtual-magic.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…