CrazyHunterMalware
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1014Rootkit
“…e the leak of ValleyRAT builder in 2023, the intrusion set continued to use it, exploiting zero-day driver plugin and using kernel-mode rootkit likely for intelligence collection.”
- T1199Trusted Relationship
“These campaigns notably rely on trusted relationships with partners or the administration to entice the targeted entity to download or click on a link in order to deploy the malicious payload.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Silver Fox: The only Tax Audit Where Fine Print Installs Malware“At the same time, cybercrime operators have targeted Taiwanese entities to make profit, such as CrazyHunter ransomware operators or Silver Fox.”
Indicators in its reports
named in the reports above- e2b75baeb7ed21fb…167bd24ba6dcin 1 report
- hxxps://6-1321729461.cos.ap-guangzhou.myqcloud[.]com/lnstaller.msiin 1 report
- hxxps://00-1321729461.cos.ap-guangzhou.myqcloud[.]com/2024.7zin 1 report
- 9010.360sdgg[.]comin 1 report
- googlevip[.]icuin 1 report
- oytdwzz[.]shopin 1 report
- andyvxyngw[.]cnin 1 report
- f9eaab0f05bd38a2…86ca7ceddce8in 1 report
- 154.201.87[.]75in 1 report
- 154.201.87[.]124in 1 report
- hxxps://xqwmwru[.]top/upload_large.phpin 1 report
- xqwmwru[.]topin 1 report
- hxxps://xqwmwru[.]top/upload_status.phpin 1 report
- 115.187.17[.]212in 1 report
- 112.121.183[.]102in 1 report
- 156.251.18[.]45in 1 report
- 206.238.178[.]116in 1 report
- 112.213.120[.]164in 1 report
- 47.85.99[.]19in 1 report
- 216.250.104[.]166in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.