TinyFluffMalware
TinyFluff is a dropper developed by the OldGremlin group. In one of their March '22 campaigns, TinyFluff included a JavaScript RAT with a time-independent DGA.From MISP Galaxy
Last reported 4 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1036Masquerading
“This time they played the sanctions card, masquerading as representatives of a Russian financial organization.”
What the reports say
1 report, newest first · the exact sentence from each-
Old Gremlins, new methods“The archive contained the group’s new tool, which — judging by the PDB string — the developer named TinyFluff.”
Indicators in its reports
named in the reports above- mirfinance[.]orgin 1 report
- hxxps://dl.dropboxusercontent[.]com/s/1956cypkkihawuu/Anketa.docx?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/gjyjs0rbtihy7ue/Doc1.dotmin 1 report
- eccbc8[.]comin 1 report
- ns1.eccbc8[.]comin 1 report
- ns2.eccbc8[.]comin 1 report
- ns3.eccbc8[.]comin 1 report
- ns4.eccbc8[.]comin 1 report
- 46.101.113[.]161in 1 report
- 161.35.41[.]9in 1 report
- a3c65c[.]orgin 1 report
- ns1.a3c65c[.]orgin 1 report
- ns2.a3c65c[.]orgin 1 report
- ns3.a3c65c[.]orgin 1 report
- ns4.a3c65c[.]orgin 1 report
- dda9900cefa8cdc8…a6c4cfdc62b2in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/9kng4v6vuq7mq39/akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/fq8ew6gl3x46rjc/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/lf1w11jxp2z0f6s/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/hy2ub5wnns4c0fi/Akt_sverki.zip?dl=0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.