synapseMalware
Last reported 1 month ago, by Kaspersky Securelist1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1021.006Windows Remote Management
“In this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems.”
- T1218.002Control Panel
“cplsupport (Problem Reports Control Panel)”
- T1543.003Windows Service
“The backdoor can both run within an interactive command-line session and establish persistence as a Windows service, using the --install or install option, depending on the backdoor version.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Angry Birds: Toy Ghouls’ new toys“…the configuration file is deleted immediately after the first run, and the relevant parameters are instead written to the HKLM\Software\synapse\Config\SealedConfig registry key.”
Indicators in its reports
named in the reports above- laboo[.]booin 1 report
- hxxp://ip-api[.]com/jsonin 1 report
- broker.hivemq[.]comin 1 report
- meet.element[.]twin 1 report
- bfadbeee63a4f0bf19ec9deb8fa58f58in 1 report
- 7916c33688385525078bee504c90f359in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.