ctrlINT What the industry said about every indicator, with the quote

CLOUDBURSTMalware

  • nickelloader

CLOUDBURST aka NickelLoader is an HTTP(S) downloader. It recognizes a set of four basic commands, all five letters long, like abcde, avdrq, gabnc and dcrqv (alternatively: eknag, eacec, hjmwk, wohnp). The most important functionality is to load a received buffer, either as a DLL via the MemoryModule implementation, or as a shellcode. It uses AES for encryption and decryption of network traffic.From MISP Galaxy

Last reported 3 days ago, by Kaspersky Securelist1 report

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “This variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with CLOUDBURST here?
No account needed. We do not store your IP address.