Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
TAMECAT - Analysis of an Iranian PowerShell-Based Backdoor
Threat Actors
Malware Families
Excerpt
💡 Artifacts from our analysis are available on our GitHub . TAMECAT is a PowerShell-based malware that can execute various commands to collect sensitive information. Reporting from the Israel National Digital Agency dives into the modular nature of the TAMECAT and its functionality. The malware is used by APT42 , an Iranian state-sponsored cyber-espionage actor, during its espionage operations. Reporting from Israel indicates that TAMECAT was observed being deployed…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | d7bf138d1aa2b70d6204a2f3c3bc72a7 | Medium | Score 53/100 | First seen |
| SHA1 | 0ef4f7a8d7b1d34e10faa0bca1dcb76a518dd417 | Medium | Score 53/100 | First seen |
| SHA256 | bd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8 | Medium | Score 53/100 | First seen |
| MD5 | 081419a484bbf99f278ce636d445b9d8 | Medium | Score 53/100 | First seen |
| SHA1 | 3fd06c930ddc4b1914151f69454c087a42413a24 | Medium | Score 53/100 | First seen |
| Domain | tebi.io | High | Score 58/100 | First seen |
| SHA256 | 5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422 | Medium | Score 53/100 | First seen |
| URL | https://accurate-sprout-porpoise.glitch.me | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…