DummyMalware
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.009Embedded Payloads
“Obfuscated Files or Information: Embedded Payloads”
- T1027.013Encrypted/Encoded File
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“…ssian-speaking threat actors and one English-speaking threat actor had participated in the ErrTraffic thread on Exploit.IN: Ghost_devil, Dummy, mudila, willard, MasonDex, yayo, Jesse_D, Vasyavasilyev, Specta666, mtd, and tope (English-speaking).”
-
Lost in relocation: analysis of a new loader distributing CASTLESTEALER“Dummy CMake-related strings appear to be passed as arguments to a function call, which patches a small decryption stub into memory immediately after the call site.”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“Dummy content (Not malicious, but represents a user who has been exposed by ClickFake Interview)”
Indicators in its reports
named in the reports above- flare[.]ioin 1 report
- chatgpt-web[.]vipin 1 report
- llc-image-ico[.]clickin 1 report
- 96.178.187[.]175in 1 report
- 96.181.156[.]219in 1 report
- 172.59.242[.]93in 1 report
- 68.60.174[.]238in 1 report
- a3f8b2c1d4e5f607…930a1b2c3d4ein 1 report
- be61936de03f3842ee814fd80a10233ain 1 report
- webanalytics-cdn[.]sbsin 1 report
- antigravity[.]studyin 1 report
- defi-xstocks[.]vipin 1 report
- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.