Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
The Art of Evasion: How Attackers Use VBScript and PowerShell in the Obfuscation Game
Excerpt
Summary As we know, using obfuscated VBScript to execute obfuscated PowerShell is a common technique in malware to evade detection and complicate analysis. This approach leverages the strengths of both scripting languages while making it harder for security tools and analysts to understand the malicious intent. Recently I came across a malware that is very well-designed for these obfuscation techniques to use, which is so interesting and attracted…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://aghayezayeat.ir/529/eiRBgmsetYWnjJJIug45.bin | High | Score 58/100 | First seen |
| IP | 185.159.153.133 | High | Score 58/100 | First seen |
| MD5 | 0e513e80fc18e3db4f0eb6ecb558534b | Medium | Score 53/100 | First seen |
| SHA256 | 7444d08579781b3d7b233e9fd3e7f9b31a85837c29adf2f4ae7965a628078639 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…