HadookenMalware
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“The downloaded file, a shell script named "2.gif," is saved in the /tmp directory, employing a typical masquerading technique to bypass filename based detection.”
- T1110Brute Force
“It then builds up lists to iterate through to attempt SSH brute force.”
- T1543.002Systemd Service
“PwnRig establishes persistence using cron jobs, and also leverages /etc/init.d/ and systemd services for maintaining persistence on infected systems even after reboots.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal“Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal”
Indicators in its reports
named in the reports above- 77.221.151[.]174in 1 report
- hxxp://154.213.192[.]44/Ueordwfkay.pdfin 1 report
- 154.213.192[.]44in 1 report
- hxxp://154.213.192[.]44/plugin3.dllin 1 report
- 51.222.111[.]116in 1 report
- hxxp://sck-dns[.]cc/cin 1 report
- sck-dns[.]ccin 1 report
- c4k-ircd.pwndns[.]pwin 1 report
- pwn.oracleservice[.]topin 1 report
- 80.78.24[.]30in 1 report
- play.sck-dns[.]ccin 1 report
- 77.221.149[.]212in 1 report
- irc.bashgo[.]pwin 1 report
- run.on-demand[.]pwin 1 report
- 198.199.85[.]230in 1 report
- 64.227.170[.]227in 1 report
- 157.230.29[.]135in 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.