Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
25 IOCs
Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
Excerpt
Background SlowMist’s security team recently received user reports about a GitHub repository named sol-live. Presented as a Solidity interview practice project, its README lists eight questions and claims that each should take 5 to 10 minutes to complete, lowering users' guard. Upon analysis, we found that the project embeds a download-and-execute command unrelated to contract practice in the VS Code workspace settings file .vscode/settings.json. Hundreds of spaces are …
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →25 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 172.86.112.107 | High | Score 58/100 | First seen |
| URL | https://www.tanxilabs.com/settings/linux?flag=3 | High | Score 58/100 | First seen |
| URL | https://www.configs.live/settings/mac?flag=6 | High | Score 58/100 | First seen |
| URL | https://codeprettier.pro/settings/linux?flag=2 | High | Score 58/100 | First seen |
| URL | https://www.enabledomain.app/api/ip-check-encrypted/3aeb34a30 | High | Score 58/100 | First seen |
| URL | https://codeprettier.pro/settings/mac?flag=2 | High | Score 58/100 | First seen |
| URL | https://codeprettier.pro/settings/linux?flag=6 | High | Score 58/100 | First seen |
| URL | http://172.86.112.107:8086/upload | High | Score 58/100 | First seen |
| URL | http://172.86.112.107:8085/upload | High | Score 58/100 | First seen |
| MD5 | bb28e10c8d08cf302f0a51f8e3a2202c | Medium | Score 53/100 | First seen |
| URL | https://www.configs.live/settings/windows?flag=8 | High | Score 58/100 | First seen |
| URL | http://172.86.112.107:8087/api/log | High | Score 58/100 | First seen |
| SHA256 | 79fca3decd09b7c86ffd4d05862e2ae76d0fbb90e705ff3f7ebf36f4c81ddd31 | Medium | Score 53/100 | First seen |
| URL | https://codeprettier.pro/settings/mac?flag=6 | High | Score 58/100 | First seen |
| URL | https://www.tanxilabs.com/settings/mac?flag=3 | High | Score 58/100 | First seen |
| URL | https://www.configs.live/settings/mac?flag=8 | High | Score 58/100 | First seen |
| URL | http://172.86.112.107:8085/api/upload-file | High | Score 58/100 | First seen |
| URL | ws://172.86.112.107:8087 | High | Score 58/100 | First seen |
| URL | https://www.configs.live/settings/linux?flag=6 | High | Score 58/100 | First seen |
| URL | https://www.configs.live/settings/linux?flag=8 | High | Score 58/100 | First seen |
| URL | https://codeprettier.pro/settings/windows?flag=2 | High | Score 58/100 | First seen |
| URL | https://codeprettier.pro/settings/windows?flag=6 | High | Score 58/100 | First seen |
| URL | https://www.enabledomain.app/api/ip-check-encrypted/3aeb34a36 | High | Score 58/100 | First seen |
| SHA256 | 573c5060ec782e3ec43d8db7be5042c2ed384017f90c6392799429d88e964c7d | Medium | Score 53/100 | First seen |
| URL | http://172.86.112.107:8087/api/notify | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…