Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Targeted Attack on Government Entities in the Middle East | Part 2
Malware Families
Excerpt
IntroductionThis is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Building upon our initial findings, Part 2 dives into a detailed technical analysis of BINDCLOAK, a new modular stage 3 backdoor uncovered during our…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 7a14a99d70d42d3f7bf72f843185fc07 | Medium | Score 37/100 | First seen |
| IP | 107.175.172.40 | Medium | Score 40/100 | First seen |
| MD5 | 59fe1ef7707fe497d89f34505222862f | Medium | Score 53/100 | First seen |
| Domain | ftabnews.com | High | Score 58/100 | First seen |
| Domain | cert.hypersnet.com | High | Score 73/100 | First seen |
| Domain | domaincert.hypersnet.com | High | Score 64/100 | First seen |
| Domain | about.blsouqs.com | High | Score 62/100 | First seen |
| Domain | ssl.blsouqs.com | High | Score 66/100 | First seen |
IOC Relationship Graph
Building graph…