Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup
Malware Families
Excerpt
Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD, a company dedicated to threat intelligence and hunting, Heiner García from NorthScan, a threat intelligence initiative uncovering North Korean IT worker infiltration, and ANY.RUN , the leading company in malware analysis and threat intelligence . The article was written by Mauro and Heiner. Key Takeaways Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives ,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | a3d6938f152c47a411263573bb3af324c25a8eba | Medium | Score 56/100 | First seen |
| IP | 89.187.185.11 | High | Score 62/100 | First seen |
| IP | 62.33.223.165 | High | Score 58/100 | First seen |
| IP | 199.168.112.175 | High | Score 62/100 | First seen |
| IP | 45.77.71.42 | High | Score 68/100 | First seen |
| IP | 192.200.115.226 | High | Score 68/100 | First seen |
| SHA1 | 8953b9661339a48f4e6408aa1b359cd49f3a6cad | Medium | Score 56/100 | First seen |
| SHA1 | b26a7c7ea6d75956ebd8c5d294524903b1cf13d0 | Medium | Score 56/100 | First seen |
| IP | 206.217.134.34 | High | Score 68/100 | First seen |
| IP | 185.152.67.39 | High | Score 68/100 | First seen |
| IP | 107.150.38.250 | High | Score 68/100 | First seen |
| IP | 104.250.148.58 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…