Enc1Malware
RansomwareFrom MISP Galaxy
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1001Data Obfuscation
“| | T1001: Data Obfuscation | |”
- T1005Data from Local System
“| | T1005: Data from Local System | |”
- T1007System Service Discovery
“| | T1007: System Service Discovery | |”
- T1027Obfuscated Files or Information
“| | T1027: Obfuscated Files or Information | Software Packing |”
- T1027.002Software Packing
“| | T1027: Obfuscated Files or Information | Software Packing |”
- T1027.008Stripped Payloads
“| | | Stripped Payloads |”
What the reports say
1 report, newest first · the exact sentence from each-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“$enc1 = { 74 73 0A 1C 1A 54 1A 11 54 0C 18 43 59 5B 3A 11 0B 16 14 10 0C 14 5B }”
Indicators in its reports
named in the reports above- auto.c3pool[.]orgin 1 report
- hxxp://61.160.194[.]160:35130in 1 report
- 61.160.194[.]160in 1 report
- hxxp://107.178.101[.]245:5488/l64;chmodin 1 report
- 107.178.101[.]245in 1 report
- hxxp://107.178.101[.]245:5488/l86;chmodin 1 report
- hxxp://107.178.101[.]245:5488in 1 report
- nishabii[.]xyzin 1 report
- c3pool[.]orgin 1 report
- hxxp://91.92.241[.]103:8002/gk.phpin 1 report
- 91.92.241[.]103in 1 report
- hxxp://62.72.22[.]91/apache2in 1 report
- 62.72.22[.]91in 1 report
- hxxp://62.72.22[.]91/apache2v86in 1 report
- hxxp://gcp.pagaelrescate[.]com:8080/ifindyouin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.