{"id":120,"date":"2018-09-04T18:22:31","date_gmt":"2018-09-04T16:22:31","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=120"},"modified":"2018-09-04T18:22:31","modified_gmt":"2018-09-04T16:22:31","slug":"indicatori-di-compromissione-4-settembre-2018","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/cyber-security-news\/indicatori-di-compromissione-4-settembre-2018\/","title":{"rendered":"Indicatori di Compromissione – 4 Settembre 2018"},"content":{"rendered":"

Indicatori di compromissione relativi ad infezioni da malware bancari (Emotet e TrickBot<\/strong>) utilizzati durante campagne malware nei confronti di infrastrutture italiane.<\/p>\n

Le compromissioni sono relative ad attivit\u00e0 svolte nel periodo Agosto-Settembre 2018.<\/p>\n

Campagne di questa tipologia risultano colpire costantemente sistemi e infrastrutture informatiche. In alcuni periodi si rilevano fino a 4 diverse campagne malware con l’utilizzo dello stesso malware nel periodo di 30 giorni.<\/p>\n

Malware Emotet\/TrickBot (HASH SHA256):<\/strong><\/p>\n\n\n\n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n<\/div>\n<\/td>\n
\n
\n
(<\/span>1st<\/span> <\/span>Stage<\/span>)<\/span><\/strong><\/div>\n
6EF5C474B7706E547257B65711D44C5D8183420ACF6D1D673A445FC30D3E2ACD<\/span><\/div>\n
483375f638c20330ccdc6425483a59d84dfc7e4da81f2a26363b7ee16a5a3cd9<\/span> <\/span><\/div>\n
1c1e2db21c30fe50d3dcb4b4f756bc154d319cf1365afb3962631941b9513859<\/span><\/div>\n
14b8461975d56583ef0a575e6b3edee10da4583d4d9d2959ea5abd99996fe68a<\/span><\/div>\n
<\/div>\n
http<\/span>:<\/span>\/\/fluorescent[.]cc\/IkSd44UwZs<\/span><\/div>\n
http<\/span>:<\/span>\/\/www.inancspor[.]com\/1ymVXSaT7J<\/span><\/div>\n
http<\/span>:<\/span>\/\/mainlis[.]pt\/0f9WStspZ<\/span><\/div>\n
http<\/span>:<\/span>\/\/thexda[.]com\/ZptEBCytV<\/span><\/div>\n
http<\/span>:<\/span>\/\/samarthdparikh[.]com\/mConYIy<\/span><\/div>\n
http<\/span>:<\/span>\/\/imrenocakbasi<span>[.]com\/pNDq<\/span><\/div>\n
http<\/span>:<\/span>\/\/opaljeans<span>[.]com\/T<\/span><\/div>\n
http<\/span>:<\/span>\/\/atoliyeh<span>[.]com\/fhlb<\/span><\/div>\n
http<\/span>:<\/span>\/\/linkbio<span>[.]net\/mYKl<\/span><\/div>\n
http<\/span>:<\/span>\/\/proinnovation2013[.]com\/0k6vpL79<\/span><\/div>\n
http<\/span>:<\/span>\/\/rtnbd24[.]com\/JLbh1WGtMu<\/span><\/div>\n
http<\/span>:<\/span>\/\/goldsellingsuccess[.]com\/pXo3156n2G<\/span><\/div>\n
http<\/span>:<\/span>\/\/cuentocontigo[.]net\/eS663S6XX2<\/span><\/div>\n
http<\/span>:<\/span>\/\/manatour[.]cl\/6Vo9r2CAU<\/span><\/div>\n
http<\/span>:<\/span>\/\/omlinux[.]com\/SGNChoG&gt;<\/span><\/div>\n
<\/div>\n
(<\/span>2nd<\/span> <\/span>Stage<\/span>)<\/span><\/strong><\/div>\n
02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290<\/span><\/div>\n
“C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\searchatsd.exe”<\/span><\/div>\n
“HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run”<\/span> <\/span>(<\/span>Key<\/span>:<\/span>searchatsd<\/span>)<\/span><\/strong><\/div>\n
<\/div>\n
(Command<\/span> <\/span>&<\/span>\u00a0<\/span>Control<\/span>)<\/span><\/strong><\/div>\n
81<\/span>[<\/span>.<\/span>]<\/span>21<\/span>[<\/span>.<\/span>]<\/span>85<\/span>[<\/span>.<\/span>]<\/span>89<\/span>:<\/span>7080<\/span><\/div>\n
213<\/span>[<\/span>.<\/span>]<\/span>12<\/span>[<\/span>.<\/span>]<\/span>.<\/span>182<\/span>[<\/span>.<\/span>]<\/span>53<\/span>:<\/span>7080<\/span><\/div>\n
136<\/span>[<\/span>.<\/span>]<\/span>56<\/span>[<\/span>.<\/span>]<\/span>30<\/span>[<\/span>.<\/span>]<\/span>168<\/span><\/div>\n
128<\/span>[<\/span>.<\/span>]<\/span>2<\/span>[<\/span>.<\/span>]<\/span>97<\/span>[<\/span>.<\/span>]<\/span>187<\/span>:<\/span>8443<\/span><\/div>\n
76<\/span>[<\/span>.<\/span>]<\/span>120<\/span>[<\/span>.<\/span>]<\/span>104<\/span>[<\/span>.<\/span>]<\/span>107<\/span>:<\/span>443<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

Indicatori di compromissione relativi ad infezioni da malware bancari (Emotet e TrickBot) utilizzati durante campagne malware nei confronti di infrastrutture italiane. Le compromissioni sono relative ad attivit\u00e0 svolte nel periodo Agosto-Settembre 2018. Campagne di questa tipologia risultano colpire costantemente sistemi e infrastrutture informatiche. In alcuni periodi si rilevano fino a 4 diverse campagne malware con […]<\/p>\n","protected":false},"author":1,"featured_media":126,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[125,185,337,361],"class_list":["post-120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-news","tag-emotet","tag-ioc","tag-statistics","tag-trickbot"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=120"}],"version-history":[{"count":0,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/120\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}