9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747SHA-256 hash
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
The DPRK strikes using a new variant of RUSTBUCKET“In Stage 3, the malware (9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747) is a FAT macOS binary that supports both ARM and Intel architectures written in Rust.”
Indicators reported together
named in the same reports- 7887638bcafd57e2…dca3ce8d25b8in 1 report
- hxxps://webhostwatto.work[.]gdin 1 report
- webhostwatto.work[.]gdin 1 report
- 104.168.167[.]88in 1 report
- 1031871a8bb92003…aecdf8203ce6in 1 report
- companydeck[.]onlinein 1 report
- companydesk[.]onlinein 1 report
- 64.44.141[.]15in 1 report
- crypto.hondchain[.]comin 1 report
- starbucls[.]xyzin 1 report
- jaicvc[.]comin 1 report
- docsend.linkpc[.]netin 1 report
- 788261d948177acf…65acdbbef76ain 1 report
- 7fccc871c889a4f4…86fae6370387in 1 report
- ec8f97d5595d92ec…35c46aa7dc41in 1 report
- de81e5246978775a…fccecc4dd500in 1 report
- 4f49514ab1794177…a3cbc1f99b16in 1 report
- fe8c0e881593cc3d…0a12f097ef69in 1 report
- www.jamf[.]comin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.