Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses?
Threat Actors
Excerpt
Background Recently, the MistEye security monitoring system detected an information-stealing malware targeting macOS. The SlowMist security team immediately launched an investigation. Judging from its collection targets, this malware appears to conduct broad, indiscriminate data harvesting rather than focusing on a specific objective. Its targets include the macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop local data, and the databases of more than a dozen…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://192.253.248.181/web/ledger.zip | High | Score 58/100 | First seen |
| SHA256 | 36f4ae11560ed34f32c927468a09a5370a5fbdcae41660f6e8d9a49330c8d059 | Medium | Score 53/100 | First seen |
| URL | http://192.253.248.181/web/trezor.zip | High | Score 58/100 | First seen |
| URL | http://86.54.25.213/ledger?username=night</li><li>http://86.54.25.213/trezor?username=night</li><li>http://86.54.25.213/log</li></ul><h3>Malicious | High | Score 58/100 | First seen |
| URL | http://192.253.248.181/web/ledgerwallet.zip | High | Score 58/100 | First seen |
| SHA256 | 60f33e7b8c6b84839e28c710c8c5a99a718c0b88135653561be8d45f976b794f | Medium | Score 53/100 | First seen |
| SHA256 | 41d77fef030b8515efb068defed5e15c14fbebd16259253f1f79febd6e12ebcb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…