← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
UNC3890 IOCs
WHITE brazen.fox.thirteen 2022-08-17 Modified: 2022-09-16
50
IOCs
MEDIUM VOLUME
Malware/Tools Hosting, Watering Hole C2, Fake Login Pages, and ReverseShell are all part of the same malicious software, which can be used to spread malware and spread malicious code.
fake domainsugarush md5c2 serversugardump smtpdomainsugardumpsugardump httpnorthstar c2domain domaintype value
Indicators of Compromise (23 / 50 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 6dbd612bbc7986cf8beb9984b473330a — 2022-08-17
FileHash-MD5 084ad50044d6650f9ed314e99351a608 — 2022-08-17
FileHash-MD5 08dc5c2af21ecee6f2b25ebdd02a9079 — 2022-08-17
FileHash-MD5 2a09c5d85667334d9accbd0e06ae9418 — 2022-08-17
FileHash-MD5 2fe42c52826787e24ea81c17303484f9 — 2022-08-17
FileHash-MD5 37bdb9ea33b2fe621587c887f6fb2989 — 2022-08-17
FileHash-MD5 3b2a719ffb12a291acbfe9056daf52a7 — 2022-08-17
FileHash-MD5 3f045ebb014d859a4e7d15a4cf827957 — 2022-08-17
FileHash-MD5 532f5c8a85b706ccc317b9d4158014bf — 2022-08-17
FileHash-MD5 639f83fa4265ddbb43e85b763fe3dbac — 2022-08-17
FileHash-MD5 9c8788e7ae87ae4f46bfe5ba7b7aa938 — 2022-08-17
FileHash-MD5 a7a2d6a533b913bc50d14e91bcf6c716 — 2022-08-17
FileHash-MD5 ae0a16b6feddd53d1d52ff50d85a42d5 — 2022-08-17
FileHash-MD5 c5116a9818dcd48b8e9fb1ddf022df29 — 2022-08-17
FileHash-MD5 d47bbec805c00a549ab364d20a884519 — 2022-08-17
FileHash-MD5 d528e96271e791fab5818c01d4bc139f — 2022-08-17
FileHash-MD5 d5671df2af6478ac108e92ba596d5557 — 2022-08-17
FileHash-MD5 d8fb3b6f5681cf5eec2b89be9b632b05 — 2022-08-17
FileHash-MD5 e125ed072fc4529687d98cf4c62e283e — 2022-08-17
FileHash-MD5 f362a2d9194a09eaca7d2fa04d89e1e5 — 2022-08-17
FileHash-MD5 f538cb2e584116a586a50d607d517cfd — 2022-08-17
FileHash-MD5 f97c0f19e84c79e9423b4420531f5a25 — 2022-08-17
FileHash-MD5 fcc09a4262b9ca899ba08150e287caa9 — 2022-08-17
References (1)
↗ https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping