Fake system update drops Aurora stealer via Invalid Printer loader
Tags
| country: | Ukraine |
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Credentials - T1589.001 Hardware - T1592.001 Ip Addresses - T1590.005 Malvertising - T1583.008 Malware - T1587.001 Malware - T1588.001 Python - T1059.006 Server - T1583.004 Server - T1584.004 Tool - T1588.002 |
Common Information
| Type | Value |
|---|---|
| UUID | f1813da5-d5de-4a45-b535-bf83e1357396 |
| Fingerprint | 455b9918b3e8737 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | May 9, 2023, midnight |
| Added to db | May 10, 2023, 2:17 a.m. |
| Last updated | Nov. 17, 2024, 12:58 p.m. |
| Headline | Fake system update drops Aurora stealer via Invalid Printer loader |
| Title | Fake system update drops Aurora stealer via Invalid Printer loader |
| Detected Hints/Tags/Attributes | 44/3/36 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 99 | ✔ | Cyware News - Latest Cyber News | https://cyware.com/allnews/feed | 2024-08-30 22:08 |
| Details | 329 | ✔ | Malwarebytes | https://www.malwarebytes.com/blog/feed/index.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | qqtube.ru |
|
| Details | Domain | 1 | activessd.ru |
|
| Details | Domain | 1 | chistauyavoda.ru |
|
| Details | Domain | 1 | xxxxxxxxxxxxxxx.ru |
|
| Details | Domain | 1 | activehdd.ru |
|
| Details | Domain | 1 | oled8kultra.ru |
|
| Details | Domain | 1 | xhamster-18.ru |
|
| Details | Domain | 1 | oled8kultra.site |
|
| Details | Domain | 1 | activessd6.ru |
|
| Details | Domain | 1 | activedebian.ru |
|
| Details | Domain | 1 | shluhapizdec.ru |
|
| Details | Domain | 1 | 04042023.ru |
|
| Details | Domain | 1 | clickaineasdfer.ru |
|
| Details | Domain | 1 | moskovpizda.ru |
|
| Details | Domain | 1 | pochelvpizdy.ru |
|
| Details | Domain | 1 | evatds.ru |
|
| Details | Domain | 1 | click7adilla.ru |
|
| Details | Domain | 1 | grhfgetraeg6yrt.site |
|
| Details | File | 5 | chromeupdate.exe |
|
| Details | File | 1 | сhrоmеuрdаtе.exe |
|
| Details | File | 1 | build1_enc_s.exe |
|
| Details | File | 207 | login.php |
|
| Details | sha256 | 2 | 31c425510fe7f353002b7eb9d101408dde0065b160b089095a2178d1904f3434 |
|
| Details | sha256 | 1 | d29f4ffcc9e2164800dcf5605668bdd4298bcd6e75b58bed9c42196b4225d590 |
|
| Details | sha256 | 1 | 5a07e02aec263f0c3e3a958f2b3c3d65a55240e5da30bbe77c60dba49d953b2c |
|
| Details | sha256 | 1 | 193cec31ea298103fe55164ff6270a2adf70248b3a4d05127414d6981f72cef4 |
|
| Details | sha256 | 1 | dac1bd40799564288bf55874543196c4ef6265d89e3228864be4d475258b9062 |
|
| Details | sha256 | 1 | 40b8acc3560ac0e1825755b3b05ef01c46bdbd184f35a15d0dc84ab44fa99061 |
|
| Details | sha256 | 1 | 398faa3aab8cce7a12e3e3f698bc29514c5b10a4369cc386421913e31f95cfdc |
|
| Details | sha256 | 1 | 93b9199ca9e1ee0afbe7cf6acccedd39f37f2dd603a3b1ea05084ab29ff79df7 |
|
| Details | sha256 | 1 | 4c80bd604ae430864c507d723c6a8c66f4f5e9ba246983c833870d05219bd3e5 |
|
| Details | IPv4 | 1 | 94.142.138.218 |
|
| Details | IPv4 | 2 | 194.58.112.173 |
|
| Details | IPv4 | 1 | 92.53.96.119 |
|
| Details | IPv4 | 1 | 103.195.103.54 |
|
| Details | IPv4 | 2 | 193.233.20.29 |