FileCoderMalware
- findzip
- Patcher
According to heimdal, A new strain of ransomware emerged on Android mobile devices. It targets those who are running the operating system Android 5.1 and higher. This Android ransomware strain has been dubbed by security researchers FileCoder (Android/Filecoder.c) and it spreads via text messages containing a malicious link.From MISP Galaxy
Last reported 7 months ago, by Trend Micro Research1 report
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: DCSync”
- T1003.006DCSync
“T1003.006”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.002SMB/Windows Admin Shares
“T1021.002”
- T1021.006Windows Remote Management
“T1021.006”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack“RDP Patcher/Wrapper”
Indicators in its reports
named in the reports above- litter.catbox[.]moein 1 report
- code.translatevv[.]comin 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- hxxps://litter.catbox[.]moe/zqqxb3.txtin 1 report
- hxxps://files.catbox[.]moe/wzsjlw.dllin 1 report
- hxxps://litter.catbox[.]moe/uaw2gm.txtin 1 report
- hxxp://127.0.0[.]1in 1 report
- 198.13.158[.]193in 1 report
- blnwx[.]comin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.