KeyholeMalware
According to Walmart Global Tech, Keyhole is a multi-functional VNC/Backconnect component used extensively by IcedID/Anubis. While the malware contains functionality that has been previously reported on as typical VNC and HDESK capabilities, a general lack of technical information appears to exist around some of the expanded functionality currently present.From MISP Galaxy
Last reported 12 months ago, by The DFIR Report1 report
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.002SMB/Windows Admin Shares
“SMB/Windows Admin Shares - T1021.002”
- T1027.013Encrypted/Encoded File
“Encrypted/Encoded File - T1027.013”
- T1027.016Junk Code Insertion
“Junk Code Insertion - T1027.016”
What the reports say
1 report, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“This command was previously observed in Keyhole, a multi-functional VNC/BackConnect component used by IcedID, and prior cases involving IcedID infection.”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
- techbulldigital[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.