General

  • Target
    https://atpscan.global.hornetsecurity.com/?d=wYXgXa6yocJH0K5L2Az1GQx6A9eEF27TuhWL3YT-k9IssK4v0Xk1yJCeR6twdT7L&f=Muvr9ze0DnmbTgyw6eW841d_OPbOeTTB_GccUrBaUw8-KY66vtxD41dWqNBgsGeh&i=&k=qKvG&m=92f34Riy75n5ORSqh0F9iGL8sOHmO06ENiXpn0B3bGVX615JBHT49x_LheB72kyjb9n-LE9qg4SEd6_39CS_nAq9PGfmTbHgh2k27dhB513_q0St4se59S19oMxnIoSh&n=vDqlJzoCSGFb3ZcK5gbC39pKR5493lC9rvGyeheqEBuDmi12ely0P7sgcGEg28zap3-ZWyKAOh1oiVz2I8HEPqg-pHP0f2tYxrmIiAUZkk4&r=b13bgEHQMkF6lJP7PEYubZQhYZ_OpKvCSVfnSWxGTe8mI9_jsO0ypPCtkFxL2akW&s=a27a60e556550a292b93e87c518c513597ba4103130303e7d287ab685111bffb&u=https%3A%2F%2Fpsicologamfernandadias.com.br%2Fsales
  • Sample260905-cyrwcavfkb

Malware Config

Targets

    • Target
      https://atpscan.global.hornetsecurity.com/?d=wYXgXa6yocJH0K5L2Az1GQx6A9eEF27TuhWL3YT-k9IssK4v0Xk1yJCeR6twdT7L&f=Muvr9ze0DnmbTgyw6eW841d_OPbOeTTB_GccUrBaUw8-KY66vtxD41dWqNBgsGeh&i=&k=qKvG&m=92f34Riy75n5ORSqh0F9iGL8sOHmO06ENiXpn0B3bGVX615JBHT49x_LheB72kyjb9n-LE9qg4SEd6_39CS_nAq9PGfmTbHgh2k27dhB513_q0St4se59S19oMxnIoSh&n=vDqlJzoCSGFb3ZcK5gbC39pKR5493lC9rvGyeheqEBuDmi12ely0P7sgcGEg28zap3-ZWyKAOh1oiVz2I8HEPqg-pHP0f2tYxrmIiAUZkk4&r=b13bgEHQMkF6lJP7PEYubZQhYZ_OpKvCSVfnSWxGTe8mI9_jsO0ypPCtkFxL2akW&s=a27a60e556550a292b93e87c518c513597ba4103130303e7d287ab685111bffb&u=https%3A%2F%2Fpsicologamfernandadias.com.br%2Fsales
    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Detected potential entity reuse from brand MICROSOFT.

MITRE ATT&CK Enterprise v16

Tasks