OderoorMalware
- anubis loader
- bobax
- Kraken
- pepega
Spam bot that was active around 2007 and after, one of the first malware families to use a domain generation algorithm.From MISP Galaxy
Last reported 23 days ago, by Malwarebytes Labs6 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1021.001Remote Desktop Protocol
“At around midnight CET on December 17th (a Friday), a user named Administrator executed a command line on a server with an open Remote Desktop Protocol (RDP) port.”
- T1059.009Cloud API
“api.camdriverhub.cloud api.camdrivers.cloud”
- T1110Brute Force
“This can be viewed as a bounded brute-force search.”
- T1564.003Hidden Window
“winpty-agent.exe – an agent for a hidden Windows console (open source)”
- T1684Social Engineering
“AI for social engineering, exploitation, and evasion”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Fake xStocks, Pendle, and other sites bait crypto users with rewards votes“The brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.”
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode“For example, Kraken is one of the targeted services.”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“Coinbase, KuCoin, Kraken, Circle, Securitize, BlockFi, Tether, Bybit and Robinhood are part of these CeFi companies.”
-
AI: Friend or Faux in Cybersecurity? Huntress Tradecraft Tuesday“Many different companies, including cryptocurrency exchange Kraken, have been targeted by this type of attack.”
-
The untold story of incident response: A Christmas Miracle“Release the Kraken!””
-
IcedID: new malware version“At this stage, as all preparations have been completed and the Trojan is ready to operate, it’s time to release the Kraken launch three main program flows (hereinafter referred to as the “modules”): Alive, Hooker, and BC.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/hasherezade/jsc_deobfuscatorin 1 report
- e27ae65977287bdfb7b0e15fd3603f85in 1 report
- 03f4e47b9c2283c32bb8f8f042ce6e41in 1 report
- hxxps://accounts.google[.]com/o/android/auth?return_user_id=truein 1 report
- cursor[.]clickin 1 report
- console[.]infoin 1 report
- resources.live.ledger[.]appin 1 report
- 0d1fce0cb2b9dec26a10f0822aeffb19in 1 report
- 13.6.233[.]10in 1 report
- 581e2e2265d0c1509b3799c5a9039374in 1 report
- de10c6b3dc4619f59bc9c80a0aa15e6ain 1 report
- de213ebc44c614d0…2ee00e24e7b6in 1 report
- c77b3b7a507162bf…6a3c967b8d45in 1 report
- 0b8015cbb1ffdc6efe6a306ff5b1115fin 1 report
- 4757f3d26bc7110e…9b9b24e0b668in 1 report
- b90e3aaae14e7787…4f605860d2b8in 1 report
- 1026743185dfa10e9ddc21b5a4c578d5in 1 report
- 212d21ed1c4b5bd9…1891d584dca0in 1 report
- 55ee2359b12fbce9…3d6517b44437in 1 report
- 201f28b5e62e52e269757930f941c774in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.