Pulse Detail — Threat Intelligence

PULSE NAME

Scarabs colon-izing vulnerable servers

WHITE AlienVault 2023-08-23 Modified: 2023-09-22

IOCs

MEDIUM VOLUME

ESET researchers have identified the operators of Spacecolon, a toolset used to deploy variants of the Scarab ransomware, and its operators, in a blogpost published on 22 August 2023.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1003 T1016 T1036 T1041 T1053 T1059 T1070 T1071 T1078 T1082 T1090 T1095 T1110 T1115 T1124 T1132 T1133 T1136 T1140 T1190 T1218 T1485 T1486 T1529 T1543 T1547 T1560 T1561 T1571 T1583 T1587 T1595 T1566 T1106 T1573 T1027 T1562 T1127 T1553 T1105 T1490

MALWARE FAMILIES

Scarab SpaceColon CosmicBeetle

Indicators of Compromise (3 / 31 total)

All BitcoinAddress FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	bc4b9d0dd359b09918b6c1095823a75b	MD5 of 40b8af12ea6f89db6ed635037f468aadee7f4ca6	2023-08-23
FileHash-MD5	cd04b5fcdc9e18243fdd378c25be5057	MD5 of 8f1374d4d6cc2899da1251de0325a7095e719edc	2023-08-23
FileHash-MD5	d3cca15da7805acb813d4f1556e85f58	MD5 of 6700afb03934b01b0b2a9885799322307e3299d5	2023-08-23

References (1)

↗ https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/