HelloKittyMalware
- fivehands
- thieflock
ransomwareFrom MISP Galaxy
Last reported 2 years ago, by Huntress1 report
What the reports say
1 report, newest first · the exact sentence from each-
Critical Vuln: Apache ActiveMQ CVE-2023-46604 Exploited“A partner recently deployed Huntress agents on October 30, 2023, after experiencing a “HelloKitty” ransomware attack on October 27.”
Indicators in its reports
named in the reports above- hxxps://activemq.apache[.]org/components/classic/download/in 1 report
- hxxp://172.245.0[.]16in 1 report
- 172.245.0[.]16in 1 report
- hxxp://172.245.16[.]125/m2.pngin 1 report
- 172.245.16[.]125in 1 report
- hxxp://4.216.93[.]211:5981/RuntimeBroker.msi%E2%80%9Din 1 report
- 4.216.93[.]211in 1 report
- 137.175.17[.]172in 1 report
- hxxp://27.102.128[.]152:8098/bit.icoin 1 report
- 27.102.128[.]152in 1 report
- hxxp://45.32.120[.]181/x86.exein 1 report
- 45.32.120[.]181in 1 report
- dd13cf13c1fbdc76…509a13ae1e15in 1 report
- 4c9fa87e72fe59cf…d5d5b8394910in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.