encipheredMalware
aka xoristeFrom MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1010Application Window Discovery
“Technique: Application Window Discovery (T1010)”
- T1027Obfuscated Files or Information
“Technique: Obfuscated Files or Information (T1027)”
- T1027.005Indicator Removal from Tools
“Technique: Obfuscated Files or Information: Indicator Removal from Tools (T1027.005)”
- T1033System Owner/User Discovery
“Technique: System Owner/User Discovery (T1033)”
- T1047Windows Management Instrumentation
“Information are gathered through a set Windows API calls, shell commands and Windows Management Instrumentation (WMI) commands:”
- T1055Process Injection
“Technique: Process Injection (T1055)”
What the reports say
1 report, newest first · the exact sentence from each-
QBOT Malware Analysis“The underlying protocol uses a JSON object encapsulated within an enciphered message which is then base64-encoded:”
Indicators in its reports
named in the reports above- 181.118.183[.]98in 1 report
- 1.161.71[.]109in 1 report
- 186.105.121[.]166in 1 report
- 47.156.191[.]217in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.