← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Threat Actor TA505 Targets Financial Enterprises Using LOLBINS and a new backdoor malware
In this research, Cybereason introduce a meticulously planned, malicious operation against a financial institution in April of 2019. This advanced operation combines a targeted phishing attack with advanced tools that gather intel on the environment. The operation chooses whether or not to create persistence and installs a sophisticated backdoor called ServHelper used to take over the network.
Indicators of Compromise (9)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| URL | http://aasdkkkdsa3442.icu/ | — | 2019-04-25 | |
| URL | http://aasdkkkdsa3442.icu/jquery/jquery.php | — | 2019-04-25 | |
| domain | joisf333.icu | — | 2019-04-25 | |
| domain | zxskjkkjsk3232.pw | — | 2019-04-25 | |
| domain | aasdkkkdsa3442.icu | — | 2019-04-25 | |
| FileHash-SHA1 | 06f232210e507f09f01155e7d0cb5389b8a31042 | — | 2019-04-25 | |
| FileHash-SHA1 | ad35fa0b3799562931b4bfa3abd057214b8721ff | — | 2019-04-25 | |
| FileHash-SHA1 | 880b383532534e32f3fa49692d676d9488aabac1 | — | 2019-04-25 | |
| FileHash-SHA1 | 63aeb16b5d001cbd94b636e9f557fe97b8467c8d | — | 2019-04-25 |