Attacks on industrial enterprises using RMS and TeamViewer
Tags
country: Russia
maec-delivery-vectors: Watering Hole
attack-pattern: Data Model Credentials - T1589.001 Email Addresses - T1589.002 Hardware - T1592.001 Hooking - T1617 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Vulnerabilities - T1588.006 Connection Proxy - T1090 Hooking - T1179 Hooking
Show in Graph
Common Information
Type Value
UUID c76671f2-ad7b-494d-a2e7-b0dc9539764b
Fingerprint ad2cb9492837af89
Analysis status DONE
Considered CTI value 0
Text language
Published Aug. 1, 2018, 10 a.m.
Added to db Sept. 26, 2022, 9:33 a.m.
Last updated Nov. 18, 2024, 5:19 p.m.
Headline Attacks on industrial enterprises using RMS and TeamViewer
Title Attacks on industrial enterprises using RMS and TeamViewer
Detected Hints/Tags/Attributes 111/3/9
Source URLs
Redirection Url
Details Source https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/
URL Provider
Details Provider Source level domain
Details securelist.com securelist.com
Attributes
Details Type #Events CTI Value
Details File 20 
winspool.drv
Details File 20 
msimg32.dll
Details File 4 
tvr.cfg
Details File 2130 
cmd.exe
Details File 6 
migwiz.exe
Details File 40 
cryptbase.dll
Details File 48 
trojan.bat
Details File 7 
win32.dll
Details IPv4 198 
1.1.1.1