PicassoLoaderMalware
Last reported 5 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.009Embedded Payloads
“T1027.009”
- T1036Masquerading
“Masquerading: Match Legitimate Resource Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
FrostyNeighbor intensifica ataques en Ucrania con validación selectiva de víctimas“Los desarrollos clave incluyen el despliegue de múltiples variantes del downloader de payload principal del grupo, denominado PicassoLoader por el CERT-UA.”
-
FrostyNeighbor: Fresh mischief and digital shenanigans“Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA.”
Indicators in its reports
named in the reports above- nkek.gov[.]uain 2 reports
- hxxps://book-happy.needbinding[.]icu/wp-content/uploads/2023/10/1GreenAM.jpgin 2 reports
- book-happy.needbinding[.]icuin 2 reports
- hxxps://nama-belakang.nebao[.]icu/statistics/discover.txtin 2 reports
- nama-belakang.nebao[.]icuin 2 reports
- 776a43e46c36a539…ee96e2392b39in 2 reports
- 8d1f2a6df51c7783…f8d032e5b57fin 2 reports
- b65551d339aece71…2c794c445efcin 2 reports
- e15abee1cfde8be7…50bad6bc0906in 2 reports
- 43e30be82d82b24a…6877e83f88abin 2 reports
- 4f2c1856325372b9…bc1a23bddd14in 2 reports
- d89e5524e49199b1…63c3f0a0c199in 2 reports
- 7e537d8e91668580…caba26d6bdacin 2 reports
- fa6882672ad36548…7c3fbade027ein 2 reports
- 3fa7d1b13542f1a9…9c250af68643in 2 reports
- 4e52c92709a91838…a257ace2780cin 2 reports
- 6fded427a16d5314…20dc84449769in 2 reports
- 27fa11f6a1d65377…4af47f211232in 2 reports
- attachment-storage-asset-static.needbinding[.]icuin 2 reports
- easiestnewsfromourpointofview.algsat[.]icuin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.