obscuraMalware
Last reported 13 months ago, by Huntress1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…runs the command cmd.exe /C netsh firewall set service type = remotedesktop mode = enable > \Windows\Temp\SJYfXB 2>&1 to enable Remote Desktop Protocol access through the Windows firewall.”
- T1053.005Scheduled Task
“A scheduled task named SystemUpdate was created on multiple hosts throughout the network, including the domain controller, to execute the ransomware binary from the NETLOGON share.”
- T1546.016Installer Packages
“.msi - Microsoft Installer packages”
What the reports say
1 report, newest first · the exact sentence from each-
Obscura, an Obscure New Ransomware Variant“.obscura - encrypted files with ransomware extension”
Indicators in its reports
named in the reports above- c00a2d757349bfff…3d20dc7aac23in 1 report
Copy this indicator · defanged
Thanks — we review every report.