Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader — detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd | Medium | Score 53/100 | First seen |
| URL | https://coco2-hram.com/debug/payload.applescript | High | Score 58/100 | First seen |
| URL | https://coco2-hram.com/api/debug/event | High | Score 58/100 | First seen |
| URL | https://ifconfig.me | High | Score 58/100 | First seen |
| URL | https://wallets-gate.io/api/injection | High | Score 58/100 | First seen |
| SHA256 | d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f | Medium | Score 53/100 | First seen |
| SHA256 | 61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…