FriendlyFerretMalware
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1059.009Cloud API
“api.camdriverhub.cloud api.camdrivers.cloud”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Lazarus ClickFake Interview Campaign: ClickFix Malware“Three variants, FriendlyFerret, FrostyFerret and FlexibleFerret, were deployed during a job interview process on a legitimate website.”
Indicators in its reports
named in the reports above- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- process.parent[.]pidin 1 report
- vid-crypto-assess[.]comin 1 report
- assessiohq[.]comin 1 report
- blockassess[.]comin 1 report
- blockchainjobassessment[.]comin 1 report
- blockchainjobhub[.]comin 1 report
- candidateinsightinfo[.]comin 1 report
- coinbase-walet[.]bizin 1 report
- coinbase-walet[.]mein 1 report
- competency-core[.]comin 1 report
- devchallengehq[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.