FlowerPowerMalware
- bobostealer
Last reported 1 month ago, by SOCRadar1 report
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1016System Network Configuration Discovery
“T1016”
- T1036Masquerading
“These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets.”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1036.007Double File Extension
“T1036.007”
- T1041Exfiltration Over C2 Channel
“T1041”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures“…ture of combining a minimalist client with server-side logic mirrors the design philosophy of related Kimsuky toolsets, including the FlowerPower, GitPower, and BabyShark families, where lightweight loaders execute server-side commands and push results back to remote infrastructu…”
Indicators in its reports
named in the reports above- kovalenko.dothome.co[.]krin 1 report
- dofamini.com[.]uain 1 report
- p1o2i3u4y5t6r7e8w9q0.medianewsonline[.]comin 1 report
- 111.92.246[.]145in 1 report
- dothome.co[.]krin 1 report
- iuh234.medianewsonline[.]comin 1 report
- pg50kb75nh.mywebcommunity[.]orgin 1 report
- wersdfxcv.mygamesonline[.]orgin 1 report
- jaemoolding25863.elementfx[.]comin 1 report
- zvwb1ep7i.onlinewebshop[.]netin 1 report
- 297292d46d4f11fc…a7bb8ea85cadin 1 report
- d398f11c236a59e4…cd0b13b0439ain 1 report
- 0db1e8a3075ffc2f…14a79e317733in 1 report
- ec47a2101de4f1fc…fe9109d05495in 1 report
- ac8df7baf7f1397a…3ee8abc97c1din 1 report
- e162d64d3e69cea8…5de89760eaaain 1 report
- 9f2cc22a74499b0a…ba5a026936acin 1 report
- d3e599af47b110ab…6db7d3ba5937in 1 report
- 467660ef31b8ec24…bdcd7904bd37in 1 report
- c88165d943f59014…380bbe32ccc4in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.