Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
32 IOCs
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Malware Families
Excerpt
Research by: Jaromír Hořejší ( @JaromirHorejsi ) Key points StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Operational security (OPSEC)…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →32 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 712e557373fba45bdd66d52e395b8af7ccf7006e6e82d4e1db0736e738d0d4fb | Medium | Score 53/100 | First seen |
| SHA256 | 8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab4 | Medium | Score 53/100 | First seen |
| SHA256 | 3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8 | Medium | Score 53/100 | First seen |
| SHA256 | 7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c | Medium | Score 53/100 | First seen |
| SHA256 | cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0 | Medium | Score 55/100 | First seen |
| SHA256 | 0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40 | Medium | Score 53/100 | First seen |
| SHA256 | 3ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f9 | Medium | Score 53/100 | First seen |
| SHA256 | 65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143 | High | Score 85/100 | First seen |
| SHA256 | 4dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea504 | Medium | Score 53/100 | First seen |
| Domain | ksr-racingparts.com | High | Score 73/100 | First seen |
| Domain | maximumrock.ro | High | Score 61/100 | First seen |
| SHA256 | 976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa153 | Medium | Score 45/100 | First seen |
| SHA256 | b3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08ad | Medium | Score 53/100 | First seen |
| SHA256 | 9765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527 | Medium | Score 55/100 | First seen |
| SHA256 | 2adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c | Medium | Score 53/100 | First seen |
| SHA256 | 99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b | Medium | Score 55/100 | First seen |
| SHA256 | f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41 | Medium | Score 53/100 | First seen |
| Domain | discherniation.com | High | Score 58/100 | First seen |
| SHA256 | 23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc70 | Medium | Score 55/100 | First seen |
| Domain | v-k.com.ua | High | Score 61/100 | First seen |
| SHA256 | 10babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0 | Medium | Score 53/100 | First seen |
| Domain | norakremer.co.uk | High | Score 58/100 | First seen |
| Domain | pharmart.ae | High | Score 58/100 | First seen |
| SHA256 | 8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac5 | Medium | Score 53/100 | First seen |
| Domain | www.lapellelaser.pl | High | Score 58/100 | First seen |
| SHA256 | cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9 | Medium | Score 53/100 | First seen |
| Domain | www.parsrulman.com | High | Score 58/100 | First seen |
| SHA256 | 38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab9 | Medium | Score 53/100 | First seen |
| SHA256 | b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489 | Medium | Score 55/100 | First seen |
| SHA256 | 11a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e | Medium | Score 53/100 | First seen |
| Domain | platinumcar.ca | High | Score 58/100 | First seen |
| Domain | mectcalcutta.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…