DoorMeMalware
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1003OS Credential Dumping
“OS credential dumping: NTDS”
- T1003.002Security Account Manager
“OS credential dumping: Security Account Manager”
- T1003.006DCSync
“Potential Credential Access via DCSync”
- T1007System Service Discovery
“System service discovery”
- T1021.002SMB/Windows Admin Shares
“Remote services: SMB/Windows admin shares”
- T1033System Owner/User Discovery
“System owner/user discovery”
What the reports say
1 report, newest first · the exact sentence from each-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“A modified version of an IIS backdoor called DoorMe was leveraged with new functionality to allocate shellcode and load additional implants.”
Indicators in its reports
named in the reports above- process[.]pein 1 report
- 386eb7aa33c76ce6…58340081e2bdin 1 report
- 185.239.70[.]229in 1 report
- 96b226e1dcfb8ea2…c39453e4fe7fin 1 report
- 50c2f1bb99d742d8…0c303ccfef54in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.doormein 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.chinachopperin 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/jsp.godzilla_webshellin 1 report
- hxxps://github[.]com/tennc/webshell/blob/master/Godzilla/123.ashxin 1 report
- 1a87e1b41341ad04…8c7b313c8bdfin 1 report
- 7fc54a287c08cde7…6ee57cc91950in 1 report
- f9b2b3f7ee55014c…a63ad4851094in 1 report
- c283ceb230c6796d…bb4fdf89c3e0in 1 report
- 4b7d244883c762c5…43a5d86a274din 1 report
- 54f969ce5c4be11d…44d4439c39b6in 1 report
- 509628b6d16d2428…82bbbb3234d6in 1 report
- 452b08d6d2aa673f…1479e7b39c05in 1 report
- 5be0045a2c86c387…8b263ff696dcin 1 report
- 3f5377590689bd19…188b44cc9ab7in 1 report
- f2a9ee6dd4d1ceb4…55cf38fe5653in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.