← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
PyPI Phishing Campaign | JuiceLedger Threat Actor Pivots From Fake Apps to Supply Chain Attacks
WHITE Juiceledger AlienVault 2022-09-02 Modified: 2022-10-02
77
IOCs
HIGH VOLUME
JuiceLedger operators have actively targeted PyPi package contributors in a phishing campaign, successfully poisoning at least two legitimate packages with malware. Several hundred more malicious packages are known to have been typosquatted.
JuiceledgerPythonPhishingTyposquattingISOLNKInfostealerJuicestealer
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Juicestealer
Indicators of Compromise (77)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 1fcb0f4e7b9e531d10493d3946e1dbcb MD5 of 8bbf55a78b6333ddb4c619d615099cc35dfeb4fb 2022-09-02
FileHash-MD5 525dc7a54e5e236c2fb507831a3af24c MD5 of 567e1d5aa3a409a910631e109263d718ebd60506 2022-09-02
FileHash-MD5 690ebaf2725b81b361475ac46a7bc3e9 MD5 of 9fb18a3426efa0034f87dadffe06d490b105bda3 2022-09-02
FileHash-MD5 7921c005f9a31f3c7d8e5056450630a0 MD5 of cbc47435ccc62006310a130abd420c5fb4b278d2 2022-09-02
FileHash-MD5 9bb6d11368fcd7cedd468dc7abd76567 MD5 of 1e697bc7d6a9762bfec958ee278510583039579c 2022-09-02
FileHash-MD5 9f1401724bc05f6e158d609b0dc5a664 MD5 of 55ba11f522532d105f68220db44392887952e57b 2022-09-02
FileHash-MD5 d85fde681deaaebff0f9f06b961aa245 MD5 of 0a6731eba992c490d85d7a464fded2379996d77c 2022-09-02
FileHash-MD5 e0b66e5b78f7ffff3b24b652bbc9d70a MD5 of 56e3421689d65e78ff75703dd6675956b86e09e8 2022-09-02
FileHash-MD5 f9e52c5a7d44abd472c53467fe02817b MD5 of 5703ed6565888f0b06fffcc40030ba679936d29f 2022-09-02
FileHash-SHA1 004c66532c49cb9345fc31520e1132ffc7003258 — 2022-09-02
FileHash-SHA1 0a6731eba992c490d85d7a464fded2379996d77c — 2022-09-02
FileHash-SHA1 13cfdf20dfa846c94358dbac6a3802dc0671eab2 — 2022-09-02
FileHash-SHA1 1a7464489568003173cd048a3bad41ca32dbf94f — 2022-09-02
FileHash-SHA1 1e697bc7d6a9762bfec958ee278510583039579c — 2022-09-02
FileHash-SHA1 225638350f089ee56eae7126d048b297fce27b7d — 2022-09-02
FileHash-SHA1 2fb194bdae05c259102274300060479adf3b222e — 2022-09-02
FileHash-SHA1 463897fa2dd2727a930b8f3397d10a796b6aa0d6 — 2022-09-02
FileHash-SHA1 52b7e42e44297fdcef7a4956079e89810f64e113 — 2022-09-02
FileHash-SHA1 55ba11f522532d105f68220db44392887952e57b — 2022-09-02
FileHash-SHA1 567e1d5aa3a409a910631e109263d718ebd60506 — 2022-09-02
FileHash-SHA1 56e3421689d65e78ff75703dd6675956b86e09e8 — 2022-09-02
FileHash-SHA1 5703ed6565888f0b06fffcc40030ba679936d29f — 2022-09-02
FileHash-SHA1 5eb92c45e0700d80dc24d3ad07a7e2d5b030c933 — 2022-09-02
FileHash-SHA1 666e5554ccdafcb37a41f0623bb9acc53851d84f — 2022-09-02
FileHash-SHA1 6f3c5a06d1a53fac45182e76897e7eab90d4a186 — 2022-09-02
FileHash-SHA1 6fe5f25205679e148b7b93f1ae80a659d99c7715 — 2022-09-02
FileHash-SHA1 71c849fc30c1abdb49c35786c86499acbb875eb5 — 2022-09-02
FileHash-SHA1 8bbf55a78b6333ddb4c619d615099cc35dfeb4fb — 2022-09-02
FileHash-SHA1 90b7da4c4a51c631bd0cbe8709635b73de7f7290 — 2022-09-02
FileHash-SHA1 964e29e877c65ff97070b7c06980112462cd7461 — 2022-09-02
FileHash-SHA1 97c541c6915ccbbc8c2b0bc243127db9b43d4b34 — 2022-09-02
FileHash-SHA1 9e9c6af67962b041d2a87f2abec7a068327fa53a — 2022-09-02
FileHash-SHA1 9fb18a3426efa0034f87dadffe06d490b105bda3 — 2022-09-02
FileHash-SHA1 a30df748d43fbb0b656b6898dd6957c686e50a66 — 2022-09-02
FileHash-SHA1 a6348aea65ad01ee4c7dd70b0492f308915774a3 — 2022-09-02
FileHash-SHA1 a78dd3cd9569bd418d5db6f6ebf5c0c5e362919b — 2022-09-02
FileHash-SHA1 aa8c4dffeeacc1f7317b2b3537d2962e8165faa2 — 2022-09-02
FileHash-SHA1 b305c16cb2bc6d88b5f6fe0ee889aaf8674d686e — 2022-09-02
FileHash-SHA1 bac2d08c542f82d8c8720a67c4717d2e70ad4cd9 — 2022-09-02
FileHash-SHA1 bd7eb97b3dc47e72392738d64007df5fc29de565 — 2022-09-02
FileHash-SHA1 c0e3c2436e225f7d99991a880bf37d32ff09c5bd — 2022-09-02
FileHash-SHA1 cbc47435ccc62006310a130abd420c5fb4b278d2 — 2022-09-02
FileHash-SHA1 cd0b8746487d7ede0ec07645fd4ec655789c675b — 2022-09-02
FileHash-SHA1 d249f19db3fe6ea4439f095bfe7aafd5a0a5d4d2 — 2022-09-02
FileHash-SHA1 d3ed1c7c0496311bb7d1695331dc8d3934fbc8ec — 2022-09-02
FileHash-SHA1 dd569ccfe61921ab60323a550cc7c8edf8fb51d8 — 2022-09-02
FileHash-SHA1 de4596669f540b8bd34aa7cbf50e977f04f3bba3 — 2022-09-02
FileHash-SHA1 e2e239f40fdb2e5bf9d37b9607b152f173db285c — 2022-09-02
FileHash-SHA1 e5286353dec9a7fc0c6db378b407e0293b711e9b — 2022-09-02
FileHash-SHA1 ea14f11e0bd36c2d036244e0242704f3cf721456 — 2022-09-02
FileHash-SHA1 ed9a4ce2d68d8cc9182bb36a46d35a9a8d0510cb — 2022-09-02
FileHash-SHA1 f07954ba3932afd8ad7520c99a7f9263aa513197 — 2022-09-02
FileHash-SHA1 f10006f7b13e4746c2293a609badd2d4e5794922 — 2022-09-02
FileHash-SHA1 f29a339e904c6a83dbacd8393f57126b67bdd3dd — 2022-09-02
FileHash-SHA256 3fc3dc88beff8ef77d2d48527ffa3d818eee885e9016a3ddf9affafa2f1e59c1 SHA256 of 8bbf55a78b6333ddb4c619d615099cc35dfeb4fb 2022-09-02
FileHash-SHA256 5e15f1e74512d51f5d51e8f4b16f60bbd349722eb689db3c8ab08ba04cc95b2e SHA256 of 55ba11f522532d105f68220db44392887952e57b 2022-09-02
FileHash-SHA256 60434af3ebe924efabc96558e6c8d8176bf4eb06dd6cc47b4c491da9964be874 SHA256 of 1e697bc7d6a9762bfec958ee278510583039579c 2022-09-02
FileHash-SHA256 643cc91bf12fc24d9d5995195060416273646c36c0bdf84a89f5e3867fde0afc SHA256 of cbc47435ccc62006310a130abd420c5fb4b278d2 2022-09-02
FileHash-SHA256 6b312c397001f666d725c9ae7dcbdb0712361e52304fddeb83f61ef03650baca SHA256 of 56e3421689d65e78ff75703dd6675956b86e09e8 2022-09-02
FileHash-SHA256 7586330732eec92214f594c5e6782cbb6f964f9c7db251e6c3b785a06c9d88bb SHA256 of 9fb18a3426efa0034f87dadffe06d490b105bda3 2022-09-02
FileHash-SHA256 8e97c6883e7af5cc1f88ac03197d62298906ac4a35a789d94cc9fde45ee7ea13 SHA256 of 5703ed6565888f0b06fffcc40030ba679936d29f 2022-09-02
FileHash-SHA256 a50bcbf0ef744f6b7780685cfd2f41a13be4c921d4b401384efd85c6109d7c00 SHA256 of 0a6731eba992c490d85d7a464fded2379996d77c 2022-09-02
FileHash-SHA256 c60ee99f05967085d47864208ca3e174275a01ebf0d5e3ea781e7216b41207d0 SHA256 of 567e1d5aa3a409a910631e109263d718ebd60506 2022-09-02
domain axiesinfintity.com — 2022-09-02
domain barkbackbakery.com — 2022-09-02
domain campus-art.com — 2022-09-02
domain capritagworld.com — 2022-09-02
domain hitwars.com — 2022-09-02
domain ideasdays.com — 2022-09-02
domain ledge-pc.com — 2022-09-02
domain ledgrestartings.com — 2022-09-02
domain linkedopports.com — 2022-09-02
domain python-release.com — 2022-09-02
domain rblxdem.com — 2022-09-02
domain teslatradingbot.com — 2022-09-02
domain thefutzibag.com — 2022-09-02
domain trezsetup.com — 2022-09-02
References (1)
↗ https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/