ctrlINT What the industry said about every indicator, with the quote

CHERRYSPYMalware

According to CERT-UA, this is a PyArmor-protected backdoor capable of execution dynamically downloaded Python code.From MISP Galaxy

Last reported 4 months ago, by Sekoia.io1 report

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “HATVIBE runs from a scheduled task via mshta.exe and pulls further modules, reportedly leading to the CHERRYSPY backdoor.”

    Sekoia.ioVendor
  2. T1684Social Engineering

    “The use of shapes is a quite common social engineering technique as it pushes the target to activate the macro in order to see the document’s content.”

    Sekoia.ioVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “HATVIBE runs from a scheduled task via mshta.exe and pulls further modules, reportedly leading to the CHERRYSPY backdoor.”

    Sekoia.ioVendor
    Double-Tap: APT28-Linked Espionage on Kazakhstan

Indicators in its reports

named in the reports above
Copy these 18 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with CHERRYSPY here?
No account needed. We do not store your IP address.