386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bdSHA-256 hash
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
2 reports, newest first · the exact sentence from each-
Update to the REF2924 intrusion set and related campaigns“…tion is hard coded which means that the sample is tailored for this exact version of BitDefender’s binary ( 386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd ).”
-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“| 386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd | SHA-256 | 13802 AR.exeBDReinit.exe | vulnerable Bitdefender Crash Handler |”
Indicators reported together
named in the same reports- process[.]pein 1 report
- 79cfdd0e92b120faadd7eb253eb800d0in 1 report
- 5a430ab45c7e142c70018b99fe0d2da3in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.shadowpadin 1 report
- hxxps://www.secureworks[.]com/research/shadowpad-malware-analysisin 1 report
- hxxps://www.secureworks[.]com/research/threat-profiles/bronze-universityin 1 report
- 185.239.70[.]229in 1 report
- 96b226e1dcfb8ea2…c39453e4fe7fin 1 report
- 50c2f1bb99d742d8…0c303ccfef54in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.doormein 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.chinachopperin 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/jsp.godzilla_webshellin 1 report
- hxxps://github[.]com/tennc/webshell/blob/master/Godzilla/123.ashxin 1 report
- 1a87e1b41341ad04…8c7b313c8bdfin 1 report
- 7fc54a287c08cde7…6ee57cc91950in 1 report
- f9b2b3f7ee55014c…a63ad4851094in 1 report
- c283ceb230c6796d…bb4fdf89c3e0in 1 report
- 4b7d244883c762c5…43a5d86a274din 1 report
- 54f969ce5c4be11d…44d4439c39b6in 1 report
- 509628b6d16d2428…82bbbb3234d6in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.