InfoSec Handlers Diary Blog - SANS Internet Storm Center
Tags
attack-pattern: Data Dns - T1071.004 Dns - T1590.002 Powershell - T1059.001 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 9cf17255-fd89-4339-807f-80508c6c2cfa
Fingerprint 1ae3226b297647ed
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 22, 2018, midnight
Added to db Feb. 17, 2023, 10:50 p.m.
Last updated Nov. 14, 2024, 6:59 p.m.
Headline Internet Storm Center
Title InfoSec Handlers Diary Blog - SANS Internet Storm Center
Detected Hints/Tags/Attributes 18/1/36
Source URLs
Redirection Url
Details Source https://isc.sans.edu/diary/Malicious+Powershell+using+a+Decoy+Picture/24234
Details Source https://isc.sans.edu/forums/diary/Malicious+Powershell+using+a+Decoy+Picture/24234/
URL Provider
Details Provider Source level domain
Details sans.edu isc.sans.edu
Attributes
Details Type #Events CTI Value
Details Domain 2 
s3.us-east-2.amazonaws.com
Details Domain 339 
system.net
Details Domain 1 
xzit007.ddns.net
Details File 13 
psversiontable.ps
Details File 9 
'.jpg
Details File 1 
guru.jpg
Details File 29 
autoit3.exe
Details File 1 
'qut.docx
Details File 1 
qut.docx
Details md5 1 
53675A741B726EAC88522D14B9F334E1
Details md5 1 
368080A29D90F5BA0B1D1E0DEAF11686
Details md5 1 
2BADE2A6917E4FD3141FF478399B9C29
Details md5 1 
D7B87DBC9EBFE9B98E86AC402AF30278
Details md5 1 
A4E74B3D571DD28A4BD46AFED2FF9A21
Details md5 1 
B939F5E560A162C57C19FFD63367B64E
Details md5 1 
72C3DED1B4617DC9E36E9F0FA1ECD04B
Details md5 1 
B6D07C74BD5D1C5988597C22A366633F
Details md5 1 
AC23469B485C91685E66323634795BB3
Details md5 1 
A2FCA4C08C8A3F1468D8E746E31AB5CB
Details md5 1 
487AA7ED5C22C2DBED5BE8784863E3CA
Details md5 1 
F23BABECD6E4A8BB507295A70C116B81
Details md5 1 
893529605D2CC4E08C633862AF17D045
Details md5 1 
D55A30AD6906FF18C3F0AD47673624E1
Details md5 1 
D9E2A9D97C7FFBAD9D504886A359FB4A
Details md5 1 
4350DEA878C5E4A2BAB83C4406A8B26B
Details md5 1 
75A2FB145F3605CA0DA3CA48D7B9C281
Details md5 1 
1295974546E6E9CA72B1205FD83C6F10
Details md5 1 
6D8EA853F0F9D4F4725A7B18BA8E68E5
Details md5 1 
989BD8DF7434150DDDCC4E3AF84571E3
Details md5 1 
9355FBBA246C8217C04EE3075C218909
Details md5 1 
39EE801D7E22D21808919DD1A991F950
Details md5 1 
4FE9C92D9445918D1759387A12138EA3
Details sha256 1 
53e954a7d36706d1f4951ca04b151055ded332e681a672e13e6cab634d74783d
Details sha256 1 
0e4c61741e81b3fa08df0622419fee5d350a67687fac76249b57eed89e129707
Details sha256 1 
d5a8cdc7ae6a49233ee021a39f12ef61c630202f68edc3a7d64fd1b616704d8d
Details Url 1 
http://s3.us-east-2.amazonaws.com/qeeqq/guru.jpg