79cfdd0e92b120faadd7eb253eb800d0MD5 hash
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Update to the REF2924 intrusion set and related campaigns“The malicious IIS module backdoor operates by looking for the string " 79cfdd0e92b120faadd7eb253eb800d0" (the MD5 hash sum of a profane string), in a specific cookie of the incoming HTTP requests, when found it will parse the rest of the request.”
Indicators reported together
named in the same reports- 5a430ab45c7e142c70018b99fe0d2da3in 1 report
- 386eb7aa33c76ce6…58340081e2bdin 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.shadowpadin 1 report
- hxxps://www.secureworks[.]com/research/shadowpad-malware-analysisin 1 report
- hxxps://www.secureworks[.]com/research/threat-profiles/bronze-universityin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.