FINALDRAFT (ELF)Malware
Last reported 20 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1055Process Injection
“FINALDRAFT is a 64-bit malware written in C++ that focuses on data exfiltration and process injection.”
- T1055.002Portable Executable Injection
“Process Injection: Portable Executable Injection”
- T1543.003Windows Service
“Suspicious Execution via Windows Service”
- T1550Use Alternate Authentication Material
“Use Alternate Authentication Material: Pass the Hash”
- T1550.002Pass the Hash
“Pass-the-Hash toolkit (pnt.x64.dll)”
What the reports say
1 report, newest first · the exact sentence from each-
You've Got Malware: FINALDRAFT Hides in Your Drafts“FINALDRAFT ELF variant”
Indicators in its reports
named in the reports above- hxxps://ipinfo[.]io/jsonin 1 report
- hxxps://poster.checkponit[.]com/nzoMeFYgvjyXK3P;https://support.fortineat.com:443/nzoMeFYgvjyXK3P;*in 1 report
- poster.checkponit[.]comin 1 report
- support.fortineat[.]comin 1 report
- hxxp://poster.checkponit[.]com/nzoMeFYgvjyXK3Pin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/tokenin 1 report
- hxxps://ip-api[.]io/jsonin 1 report
- ip-api[.]ioin 1 report
- hxxps://myexternalip[.]com/rawin 1 report
- hxxps://ipapi[.]co/json/in 1 report
- hxxps://jsonip[.]com/in 1 report
- jsonip[.]comin 1 report
- support.vmphere[.]comin 1 report
- update.hobiter[.]comin 1 report
- checkponit[.]comin 1 report
- fortineat[.]comin 1 report
- 9a11d6fcf76583f7…f6f959853bcfin 1 report
- 39e85de1b1121dc3…0c833e059530in 1 report
- 83406905710e52f6…1fdb2d28cc8cin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.