Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
70 IOCs
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Excerpt
Executive Summary This chain leverages a Powershell loader to deliver a payload in a fake MP4 (video file). The fake MP4 contains 6.5 MB of encrypted NetSupport client data (both executable and configuration) in an ISO Base Media File Format (uuid) extension box. Basic file-type checks identify the file as MP4 file type, but it is not a playable video. The same Cloudflare-fronted host serves both the initial PowerShell stage and the fake MP4 carrier file. Introduction…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →70 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | eb819bf728b64b98a1c7e91e7da428addb8108a1ccd9500023952084e5a036ca | Medium | Score 53/100 | First seen |
| SHA256 | 6c7fc234ac22ff244dfd220abdf1de3e987a4e785f65dd5a0bff1c639521a10b | Medium | Score 53/100 | First seen |
| SHA256 | e09980d1b1c508eb29d2931ac92f8d0a7e49ca5fe6ab6277fabf097a0b033b63 | Medium | Score 53/100 | First seen |
| SHA256 | 512651fc5770932be61f513294fb738216d3ba923bda47bfcd5b328e2fc5636c | Medium | Score 53/100 | First seen |
| IP | 85.239.144.68 | High | Score 58/100 | First seen |
| IP | 176.65.144.164 | High | Score 58/100 | First seen |
| IP | 2.27.160.137 | High | Score 58/100 | First seen |
| IP | 91.92.240.175 | High | Score 88/100 | First seen |
| SHA256 | aa4fc4eb78d08de797220a8b9c1db3f8a584ffcb85dda47b71a11eb306280395 | Medium | Score 53/100 | First seen |
| SHA256 | 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5 | Medium | Score 53/100 | First seen |
| URL | http://binance-idexchange.com/333.mp4 | High | Score 63/100 | First seen |
| SHA256 | bf3da65748ada560e893f4952c6bafab53ebf1b888a535092d2815f0f93ec781 | Medium | Score 53/100 | First seen |
| SHA256 | dadc9e33f8a1063c7cbd696e7527b45169075c708870b1b00f0cccddede1f1fb | Medium | Score 53/100 | First seen |
| IP | 31.76.103.182 | High | Score 58/100 | First seen |
| SHA256 | c32d53280bca6e28060c44c43bd688a7d36e315909bb36ddaebb4d6517debeae | Medium | Score 53/100 | First seen |
| SHA256 | da7c33e5770216c550cc6dd67a1fc3194a10102e6f064df11f6241fe24c999c5 | Medium | Score 53/100 | First seen |
| SHA256 | 1e9e7cdedcd4d20eb846a0268bccdb6aa817662516fb7cf62be930031c2c1885 | Medium | Score 53/100 | First seen |
| IP | 2.26.252.95 | High | Score 58/100 | First seen |
| SHA256 | b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2 | Medium | Score 53/100 | First seen |
| SHA256 | 84ad46c293d749dbacc68a3bcf4a6a964343aa444a3b12e103cfe8f962f24762 | Medium | Score 53/100 | First seen |
| SHA256 | 9862075e68c565d5ad78b8a0dcf6c193092103c9607899c72eefa482b9c8f008 | Medium | Score 53/100 | First seen |
| SHA256 | e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d | Medium | Score 53/100 | First seen |
| URL | http://karlenagida.com/123.mp4 | High | Score 58/100 | First seen |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 | High | Score 85/100 | First seen |
| URL | http://fdn4apex.com/fdn4apex.mp4 | High | Score 58/100 | First seen |
| SHA256 | ee2c978c13fb248005b9c5d82b231fc7b38f9a3281ff1f73132b0ec0363b0b18 | Medium | Score 53/100 | First seen |
| URL | http://tidalcoastapparel.com/s.mp4 | High | Score 58/100 | First seen |
| SHA256 | c36b5c170d1e59a957fc67f17df28605e275ec6e01f3d4c03531f6fd251c5189 | Medium | Score 53/100 | First seen |
| SHA256 | 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9 | Medium | Score 53/100 | First seen |
| SHA256 | 13fc18e817241856dcef3989d6986a2dd428f3f4e31a4815723ea9510999a61c | Medium | Score 53/100 | First seen |
| SHA256 | e6b595c19b931960c18d562fe16bd4fa05d724b812d10945c2f965bf836783a8 | Medium | Score 53/100 | First seen |
| URL | https://hurmadll.com/twenty.mp4 | High | Score 58/100 | First seen |
| URL | http://approvalrequest-api.com/55555555.mp4 | High | Score 58/100 | First seen |
| IP | 2.26.252.75 | High | Score 58/100 | First seen |
| SHA256 | 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269 | Medium | Score 53/100 | First seen |
| SHA256 | 2c24d7a819f8d15a1104875e20b7831be9a02580c01a349f6e39f3790b41b81c | Medium | Score 53/100 | First seen |
| SHA256 | 2edf10f0af08c32b7721becc063297d09362e76e1f5a18f0d81837752363b578 | Medium | Score 53/100 | First seen |
| SHA256 | 533428a3cf69e6fbf7a0b34f8915f8b9f6ba2e012ab8c9172e636f76b0f1d565 | Medium | Score 53/100 | First seen |
| Domain | gojirotomiodid.com | High | Score 58/100 | First seen |
| SHA256 | b0199da4b67416f24f3d235b4d6d64d2b9cff96f3e38141e3920b90b5bf633e6 | Medium | Score 53/100 | First seen |
| URL | http://x2664.com/x2664.mp4 | High | Score 58/100 | First seen |
| SHA256 | 07887055939e238184514110da990226b02e804e2371cb309487f7159171a3e7 | Medium | Score 53/100 | First seen |
| SHA256 | 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689 | Medium | Score 53/100 | First seen |
| SHA256 | b0935a6e5a81f3bed34367ebb87a96543a5a2a2b2fe4596e96e655b7715a3e28 | Medium | Score 53/100 | First seen |
| URL | http://approvalrequest-api.com/333.mp4 | High | Score 58/100 | First seen |
| IP | 144.31.106.164 | High | Score 58/100 | First seen |
| SHA256 | b59c9d532b2593cb0331f2f97f68896702bb5e8e868e2f07913542e4cbf7e195 | Medium | Score 53/100 | First seen |
| IP | 178.16.52.165 | High | Score 58/100 | First seen |
| SHA256 | edb68fc8857d9c789c7cac806ccf988008a898bf5e8fe61908f558666eceefed | Medium | Score 53/100 | First seen |
| SHA256 | b13da09f347597ea72d3ab075265bb37ae86c24f8c8cc6545e5255c9703dee1d | Medium | Score 53/100 | First seen |
| SHA256 | d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368 | Medium | Score 53/100 | First seen |
| URL | http://web02message.com/web02message.mp4 | High | Score 58/100 | First seen |
| URL | http://89.34.90.111/tzast.mp4 | High | Score 58/100 | First seen |
| IP | 67.217.228.22 | High | Score 58/100 | First seen |
| SHA256 | e0a40fb1573c73316920c296574b90cc52072e337b5c3e5b16355dfc3e306c44 | Medium | Score 53/100 | First seen |
| SHA256 | 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b | Medium | Score 53/100 | First seen |
| SHA256 | ce61f3c40a71659843ad0defa40e226ba7d51b594ce09af4e496c661c6b7a09f | Medium | Score 53/100 | First seen |
| SHA256 | 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422 | Medium | Score 53/100 | First seen |
| URL | http://karlenagida.com/player.mp4 | High | Score 58/100 | First seen |
| URL | https://brmconfig.com/video.mp4 | High | Score 58/100 | First seen |
| SHA256 | 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299 | Medium | Score 53/100 | First seen |
| SHA256 | 2d7285c93866597e28c4686194456e9a6eb22fe80287461990da13dab1a9e0b5 | Medium | Score 53/100 | First seen |
| SHA256 | 98cdd6ef9f5e6c06154423ab221550b683f2a4c9018d88ffcce085f92be88b6d | Medium | Score 53/100 | First seen |
| URL | http://google.2oauth.com/go.mp4 | High | Score 58/100 | First seen |
| Domain | mmm-vps.online | High | Score 58/100 | First seen |
| Domain | ceelorn.com | High | Score 58/100 | First seen |
| SHA256 | 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8 | Medium | Score 53/100 | First seen |
| IP | 91.92.34.109 | High | Score 58/100 | First seen |
| URL | http://usersecuritycheck.com/12.mp4 | High | Score 58/100 | First seen |
| SHA256 | 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…