New Attack, Old Tricks
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Keychain - T1634.001 Keychain - T1555.001 Keychain - T1579 Launch Daemon - T1543.004 Login Hook - T1037.002 Login Items - T1547.015 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Python - T1059.006 Software - T1592.002 Keychain - T1142 Launch Daemon - T1160
Show in Graph
Common Information
Type Value
UUID 57025bee-e2b2-49f7-a029-a783f36aa3fb
Fingerprint 841829191998522e
Analysis status DONE
Considered CTI value 0
Text language
Published June 2, 2017, midnight
Added to db Aug. 30, 2024, 11:30 p.m.
Last updated Nov. 17, 2024, 5:55 p.m.
Headline UNKNOWN
Title New Attack, Old Tricks
Detected Hints/Tags/Attributes 38/2/26
Source URLs
Redirection Url
Details Redirection https://objective-see.com/blog/blog_0x17.html
Details Source https://objective-see.org/blog/blog_0x17.html
URL Provider
Details Provider Source level domain
Details objective-see.com objective-see.com
Details objective-see.org objective-see.org
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 186 ✔ Objective-See's Blog https://objective-see.org/rss.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 5 
ps.stdout.read
Details Domain 54 
re.search
Details Domain 3 
www.securitychecking.org
Details Domain 1 
stagers.py
Details Domain 4 
createhijacker.py
Details Domain 247 
www.virusbulletin.com
Details File 3 
peace.docm
Details File 29 
vbaproject.bin
Details File 58 
document.xml
Details File 14 
theme1.xml
Details File 3 
vbadata.xml
Details File 66 
settings.xml
Details File 2 
styleswitheffects.xml
Details File 21 
styles.xml
Details File 17 
core.xml
Details File 12 
fonttable.xml
Details File 17 
websettings.xml
Details File 16 
app.xml
Details File 35 
index.asp
Details File 1 
stagers.py
Details File 4 
createhijacker.py
Details md5 3 
fff96aed07cb7ea65e7f031bd714607d
Details IPv4 1 
185.22.174.37
Details Url 3 
https://www.securitychecking.org:443/index.asp').read
Details Url 2 
https://www.securitychecking.org:443/index.asp
Details Url 2 
https://www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x