hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/URL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 11 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
RONINGLOADER: DragonBreath’s New Path to PPL Abuse“hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/”
-
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite“hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/”
Indicators reported together
named in the same reports- www.safebreach[.]comin 2 reports
- da2c58308e860e57…3c434283d50bin 1 report
- 82794015e2b40cc6…0edaee203724in 1 report
- c65170be2bf4f0bd…959bcaad8ae5in 1 report
- 2515b546125d2001…9a77a32c54f5in 1 report
- 1613a913d0384cbb…563a6f22f2b7in 1 report
- 395f835731d25803…59af32f6258din 1 report
- 1c1528b546aa29be…9f22a4ee37e2in 1 report
- 4d5beb8efd4ade58…35a756ed39e6in 1 report
- 96f401b80d3319f8…39bcfb07cdf0in 1 report
- 33b494eaaa6d7ed7…52c3313e617cin 1 report
- fc63f5dfc93f2358…f6041a0e01bcin 1 report
- fd4dd9904549c665…252001f1d107in 1 report
- 3dd470e85fe77cd8…87ca2fd24e33in 1 report
- qaqkongtiao[.]comin 1 report
- hxxps://nsis.sourceforge[.]io/Main_Pagein 1 report
- hxxps://github[.]com/Jemmy1228/HookSigntoolin 1 report
- hxxps://hijacklibs[.]net/entries/microsoft/built-in/wow64log.htmlin 1 report
- hijacklibs[.]netin 1 report
- hxxps://en.wikipedia[.]org/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_functionin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.