DataExfiltratorMalware
- FileSender
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1110Brute Force
“The 11288 port is the Socks5 proxy port, mostly password protected, and this proxy is used to relay M365 accounts brute force attacks.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Quad7 Operators' Next Moves And Associated Botnets“Includes noteworthy symbols such as fsy::CommandExecutor and fsy::FileSender”
Indicators in its reports
named in the reports above- 158.247.194[.]125in 1 report
- 45.77.44[.]119in 1 report
- 151.236.20[.]30in 1 report
- 103.140.239[.]63in 1 report
- 103.57.248[.]202in 1 report
- 408152285671bbd0e6e63bd71d6abaafin 1 report
- 5efc7d824851be9ec90a97d889a40d23in 1 report
- f42849076e24b7827218f7a25bc11cccin 1 report
- 92093dd7ba6ae8fe34a215c4c4bd1cd4in 1 report
- e6f6a6de285d7c2361c32b1f29a6c3f6in 1 report
- b3b09819f820a4ecd31f82f369000af2in 1 report
- 3c4b3d1480952d6ddfe434fef07054f7in 1 report
- cdb37db4543dde5ca2bd98a43699828fin 1 report
- 22633ef920f0093e3d720e7bbeb9fec8in 1 report
- d617f43163cb0f355dbf63058aa82d1din 1 report
- 150d444848a02be230ed9fbf3692d226in 1 report
- 43ea387b8294cc4d0baaef6d26ff7c72in 1 report
- 4d9067e7cf517158337123a30a9bd0e3in 1 report
- 8542a3cbe232fe78baa0882736c61926in 1 report
- 777d6f907da38365924a0c2a12e973c5in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.