NOBELIUM Campaigns and Malware
Tags
Common Information
| Type | Value |
|---|---|
| UUID | 88353320-b7c6-41b1-bae8-f570e810993a |
| Fingerprint | a2e58b316f1adccf |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | June 2, 2021, 11:04 p.m. |
| Added to db | Jan. 16, 2023, 4:55 p.m. |
| Last updated | Nov. 17, 2024, 5:56 p.m. |
| Headline | Cyber Threat Advisory: NOBELIUM Campaigns and Malware |
| Title | NOBELIUM Campaigns and Malware |
| Detected Hints/Tags/Attributes | 75/3/134 |
Source URLs
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 7 | theyardservice.com |
|
| Details | Domain | 7 | worldhomeoutlet.com |
|
| Details | Domain | 2 | 74d6b7b2.app.giftbox4u.com |
|
| Details | Domain | 4 | aimsecurity.net |
|
| Details | Domain | 5 | cityloss.com |
|
| Details | Domain | 3 | content.pcmsar.net |
|
| Details | Domain | 2 | cross-checking.com |
|
| Details | Domain | 3 | giftbox4u.com |
|
| Details | Domain | 5 | hanproud.com |
|
| Details | Domain | 4 | newstepsco.com |
|
| Details | Domain | 4 | stockmarketon.com |
|
| Details | Domain | 3 | stsnews.com |
|
| Details | Domain | 4 | tacomanewspaper.com |
|
| Details | Domain | 4 | trendignews.com |
|
| Details | Domain | 4 | enpport.com |
|
| Details | Domain | 5 | cdn.theyardservice.com |
|
| Details | Domain | 3 | dailydews.com |
|
| Details | Domain | 5 | dataplane.theyardservice.com |
|
| Details | Domain | 5 | doggroomingnews.com |
|
| Details | Domain | 2 | email.theyardservice.com |
|
| Details | Domain | 2 | emergencystreet.com |
|
| Details | Domain | 2 | smtp2.theyardservice.com |
|
| Details | Domain | 5 | static.theyardservice.com |
|
| Details | Domain | 5 | usaid.theyardservice.com |
|
| Details | Domain | 4 | financialmarket.org |
|
| Details | Domain | 2 | pcmsar.net |
|
| Details | Domain | 4 | techiefly.com |
|
| Details | Domain | 3 | theadminforum.com |
|
| Details | Domain | 3 | cdnappservice.firebaseio.com |
|
| Details | Domain | 4 | eventbrite-com-default-rtdb.firebaseio.com |
|
| Details | Domain | 3 | humanitarian-forum-default-rtdb.firebaseio.com |
|
| Details | Domain | 3 | security-updater-default-rtdb.firebaseio.com |
|
| Details | Domain | 3 | supportcdn-default-rtdb.firebaseio.com |
|
| Details | Domain | 3 | cdnappservice.web.app |
|
| Details | Domain | 3 | humanitarian-forum.web.app |
|
| Details | Domain | 3 | logicworkservice.web.app |
|
| Details | Domain | 3 | security-updater.web.app |
|
| Details | Domain | 4 | supportcdn.web.app |
|
| Details | Domain | 2 | scanclientupdate.zip |
|
| Details | Domain | 4 | holescontracting.com |
|
| Details | Domain | 2 | newsplacec.com |
|
| Details | Domain | 4 | blogs.infoblox.com |
|
| Details | Domain | 23 | www.cobaltstrike.com |
|
| Details | Domain | 154 | us-cert.cisa.gov |
|
| Details | Domain | 82 | csrc.nist.gov |
|
| Details | File | 6 | nv.html |
|
| Details | File | 10 | boom.exe |
|
| Details | File | 3 | %appdata%\microsoft\nativecache\nativecachesvc.dll |
|
| Details | File | 10 | blogs.inf |
|
| Details | sha256 | 3 | 0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec |
|
| Details | sha256 | 3 | 8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27 |
|
| Details | sha256 | 3 | cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c |
|
| Details | sha256 | 1 | 0c14a791f8a48d2944a9fa842f45becb7309ad004695e38f48fca69135d327c6 |
|
| Details | sha256 | 3 | 1f5a915e75ad96e560cee3e24861cf6f8de299fdf79e1829453defbfe2013239 |
|
| Details | sha256 | 3 | 292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8 |
|
| Details | sha256 | 2 | 2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e |
|
| Details | sha256 | 3 | 2ebbb99b8dae0c7b0931190fa81add987b44d4435dafcf53a9cde0f19bb91398 |
|
| Details | sha256 | 2 | 776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b |
|
| Details | sha256 | 3 | 88c95954800827cb68e1efdacd99093f7f9646d82613039472b5c90e5978444d |
|
| Details | sha256 | 4 | a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf |
|
| Details | sha256 | 1 | bca5560a9a9dd54be76e4a8d63a66e9cfd731b0bd28524db05cc498bb5b56384 |
|
| Details | sha256 | 2 | c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78 |
|
| Details | sha256 | 3 | f9a74ac540a6584fc3ba7ccc172f948c6b716cceea313ce1d9e7b735fa2a5687 |
|
| Details | sha256 | 1 | 7a3b27cf04b7f8110fc1eee5f9c4830d38ac00467fc856330115af4bffaf35b6 |
|
| Details | sha256 | 2 | 7bf3457087ea91164f86f4bb50ddb46c469c464c300228dba793f7bfe608c83e |
|
| Details | sha256 | 3 | 065e9471fb4425ec0b3a2fd15e1546d66002caca844866b0764cbf837c21a72a |
|
| Details | sha256 | 3 | 279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11 |
|
| Details | sha256 | 2 | 2836e5553e1ae52a1591545b362d1a630e3fef7e6b7e8342a84008fe4a6473a9 |
|
| Details | sha256 | 1 | 6df1d7191f6dd930642cc5c599efb54bfcc964b7a2e77f6007787de472b22a6a |
|
| Details | sha256 | 1 | 9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186 |
|
| Details | sha256 | 3 | 9301e48ea3fa7d39df871f04072ee47b9046d76aa378a1c5697f3b2c14aef1d6 |
|
| Details | sha256 | 3 | ca83d7456a49dc5b8fe71007e5ac590842b146dd5c45c9a65fe57e428a8bd7c6 |
|
| Details | sha256 | 3 | cfb57906cf9c5e9c91bc4aa065f7997b1b32b88ff76f253a73ee7f6cfd8fff2f |
|
| Details | sha256 | 3 | dcf48223af8bb423a0b6d4a366163b9308e9102764f0e188318a53f18d6abd25 |
|
| Details | sha256 | 3 | f5bc4a9ffc2d33d4f915e41090af71544d84b651fb2444ac91f6e56c1f2c70d5 |
|
| Details | sha256 | 3 | f7e8c9d19efd71f5c8217bf12bdd3f6c88d5f56ab65fea02dc2777c5402a18f1 |
|
| Details | sha256 | 3 | 136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d |
|
| Details | sha256 | 2 | 3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4 |
|
| Details | sha256 | 1 | 4fbfeb7a0bb6b9841b92fa4e6b5a7bdb69c2a12ed39691c9495ff88cd6f58836 |
|
| Details | sha256 | 3 | 6d08b767117a0915fb86857096b4219fd58596b42ccf61462b137432abd3920e |
|
| Details | sha256 | 3 | b295c5ad4963bdffa764b93421c3dd512ca6733b79bdff2b99510e7d56a70935 |
|
| Details | sha256 | 5 | ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330 |
|
| Details | sha256 | 2 | 656384c4e5f9fe435d51edf910e7ba28b5c6d183587cf3e8f75fb2d798a01eeb |
|
| Details | sha256 | 3 | 574b7a80d8b9791cb74608bc4a9fcba4e4574fafef8e57bdee340728445ebd16 |
|
| Details | sha256 | 3 | 73ca0485f2c2c8ba95e00188de7f5509304e1c1eb20ed3a238b0aa9674f9104e |
|
| Details | sha256 | 4 | 7d34f25ad8099bd069c5a04799299f17d127a3866b77ee34ffb59cfd36e29673 |
|
| Details | sha256 | 3 | d37347f47bb8c7831ae9bb902ed27a6ce85ddd9ba6dd1e963542fd63047b829c |
|
| Details | sha256 | 6 | 2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252 |
|
| Details | sha256 | 3 | 5f7d08eb2039a9d2e99ebf3d0ef2796b93d0a01e9b8ec403fec8fcdf46448693 |
|
| Details | sha256 | 3 | 60e20576b08a24cdaeaabc4849011885fb7517713226e2663031d9533d2187bc |
|
| Details | sha256 | 5 | 6e2069758228e8d69f8c0a82a88ca7433a0a71076c9b1cb0d4646ba8236edf23 |
|
| Details | sha256 | 4 | 749bf48a22ca161d86b6e36e71a6817b478a99d935cd721e8bf3dba716224c84 |
|
| Details | sha256 | 1 | 7ed1b6753c94250ad3c1c675eb644940c8104ff06a123252173c33cc1be5e434 |
|
| Details | sha256 | 3 | 873717ea2ea01ae6cd2c2dca9d6f832a316a6e0370071bb4ee6ecff3163f8d18 |
|
| Details | sha256 | 2 | 89016b87e97a07b4e0263a18827defdeaa3e150b1523534bbdebe7305beabb64 |
|
| Details | sha256 | 7 | 94786066a64c0eb260a28a2959fcd31d63d175ade8b05ae682d3f6f9b2a5a916 |
|
| Details | sha256 | 3 | 98473e1b8f7bedd5cfa3b83dad611db48eee23faec452e62797fb7752228c759 |
|
| Details | sha256 | 3 | a45a77ad5c138a149aa71fb323a1e2513e7ac416be263d1783a7db380d06d2fc |
|
| Details | sha256 | 3 | d19ff098fe0f5947e08ec23be27d3a3355e14fb20135d8c4145126caa8be4b05 |
|
| Details | sha256 | 3 | e41a7616a3919d883beb1527026281d66e7bcdaff99600e462d36a58f1bdc794 |
|
| Details | sha256 | 3 | f006af714379fdd63923536d908f916f4c55480f3d07adadd53d5807e0c285ee |
|
| Details | sha256 | 3 | 0585ed374f47d823f8fcbb4054ad06980b1fe89f3fa3484558e7d30f7b6e9597 |
|
| Details | sha256 | 3 | 112f92cfecdc4e177458bc1caebcc4420b5879840f137f249fac360ddac64ddd |
|
| Details | sha256 | 3 | 194f4d1823e93905ee346d7e1fffc256e0befd478735f4b961954df52558c618 |
|
| Details | sha256 | 3 | 24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548 |
|
| Details | sha256 | 3 | 3c86859207ac6071220976c52cef99abf18ae37ae702c5d2268948dda370910b |
|
| Details | sha256 | 6 | 48b5fb3fa3ea67c2bc0086c41ec755c39d748a7100d71b81f618e82bf1c479f0 |
|
| Details | sha256 | 3 | 6866041f93141697ec166fe64e35b00c5fcd5d009500ecf58dd0b7e28764b167 |
|
| Details | sha256 | 1 | 69f0d85119123f3c2e4c052a83671732aced07312a05a3abf4ab0360c70f65de |
|
| Details | sha256 | 1 | 74202eed181e2b83dd0ab6f791a34a13bd94e63e86b82395f9443cb5aeddc891 |
|
| Details | sha256 | 3 | b81beb17622d4675a1c6f4efb358cc66903366df75eb5911bca725465160bdb6 |
|
| Details | sha256 | 1 | d7c05bd68e8bde3d13aa7dbd6911461104d06715da15d3ee7f75136fa8330cc2 |
|
| Details | sha256 | 3 | eae312c5ec2028a2602c9654be679ecde099b2c0b148f8d71fca43706efe4c76 |
|
| Details | sha256 | 1 | f88530bc87cf2c133c0a50e434ce0428694901fe7860abb42737097fdea56b30 |
|
| Details | sha256 | 2 | ca66b671a75bbee69a4a4d3000b45d5dc7d3891c7ee5891272ccb2c5aed5746c |
|
| Details | sha256 | 1 | 117317d623003995d639975774edd1bfe38cec7d24b22d3e48d22c91cf8636bb |
|
| Details | sha256 | 1 | 1c17c39af41a5d8f54441ce6b1cf925f6727a2ee9038284a8a7071c984d0460f |
|
| Details | sha256 | 3 | b0bfe6a8aa031f7f5972524473f3e404f85520a7553662aaf886055007a57db5 |
|
| Details | sha256 | 2 | 23e20d630a8fd12600c2811d8f179f0e408dcb3e82600456db74cbf93a66e70f |
|
| Details | IPv4 | 7 | 139.99.167.177 |
|
| Details | IPv4 | 3 | 185.158.250.239 |
|
| Details | IPv4 | 4 | 195.206.181.169 |
|
| Details | IPv4 | 3 | 37.120.247.135 |
|
| Details | IPv4 | 4 | 45.135.167.27 |
|
| Details | IPv4 | 3 | 51.254.241.158 |
|
| Details | IPv4 | 3 | 51.38.85.225 |
|
| Details | Url | 1 | https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory-solarwinds-supply-chain-attack |
|
| Details | Url | 2 | https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium |
|
| Details | Url | 4 | https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset |
|
| Details | Url | 1 | https://blogs.infoblox.com/cyber-threat-intelligence/teardrop-malware |
|
| Details | Url | 1 | https://www.cobaltstrike.com/features |
|
| Details | Url | 1 | https://us-cert.cisa.gov/ncas/analysis-reports/ar21-039b |
|
| Details | Url | 1 | https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final |
|
| Details | Url | 1 | https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-seizure-domain-names-used-furtherance-spear |