SiestaGraphMalware
- draftgraph
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1003OS Credential Dumping
“OS credential dumping: NTDS”
- T1003.002Security Account Manager
“OS credential dumping: Security Account Manager”
- T1003.006DCSync
“Potential Credential Access via DCSync”
- T1007System Service Discovery
“System service discovery”
- T1021.002SMB/Windows Admin Shares
“Remote services: SMB/Windows admin shares”
- T1033System Owner/User Discovery
“System owner/user discovery”
What the reports say
1 report, newest first · the exact sentence from each-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“SiestaGraph: New implant uncovered in ASEAN member foreign ministry”
Indicators in its reports
named in the reports above- process[.]pein 1 report
- 386eb7aa33c76ce6…58340081e2bdin 1 report
- 185.239.70[.]229in 1 report
- 96b226e1dcfb8ea2…c39453e4fe7fin 1 report
- 50c2f1bb99d742d8…0c303ccfef54in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.doormein 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.chinachopperin 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/jsp.godzilla_webshellin 1 report
- hxxps://github[.]com/tennc/webshell/blob/master/Godzilla/123.ashxin 1 report
- 1a87e1b41341ad04…8c7b313c8bdfin 1 report
- 7fc54a287c08cde7…6ee57cc91950in 1 report
- f9b2b3f7ee55014c…a63ad4851094in 1 report
- c283ceb230c6796d…bb4fdf89c3e0in 1 report
- 4b7d244883c762c5…43a5d86a274din 1 report
- 54f969ce5c4be11d…44d4439c39b6in 1 report
- 509628b6d16d2428…82bbbb3234d6in 1 report
- 452b08d6d2aa673f…1479e7b39c05in 1 report
- 5be0045a2c86c387…8b263ff696dcin 1 report
- 3f5377590689bd19…188b44cc9ab7in 1 report
- f2a9ee6dd4d1ceb4…55cf38fe5653in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.