← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Operation RusticWeb targets Indian Govt: From Rust-based malware to Web-service exfiltration
WHITE feisty-swim1410 2024-01-25 Modified: 2024-01-26
43
IOCs
MEDIUM VOLUME
#rust#oshi#dsop#operation#rusticweb#defence#parichay#powershellindiaawes#ias#operationrusticwebpowershelldecemberdefenceoctoberipr formdepartmentchildrendsopministryrustdecoytargetdownloademotetenumerategolangnim
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Golang Nim
Indicators of Compromise (43)
All URL FileHash-MD5 domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL https://oshi.at — 2024-01-25
FileHash-MD5 04557782d7017f18ec059fc96d7f2dc8 — 2024-01-25
FileHash-MD5 13ee4bd10f05ee0499e18de68b3ea4d5 — 2024-01-25
FileHash-MD5 20b4eb5787faa00474f7d27c0fea1e4b — 2024-01-25
FileHash-MD5 237961bbba6d4aa2e0fae720d4ece439 — 2024-01-25
FileHash-MD5 3ce8dfb3f1bff805cb6b85a9e950b3a2 — 2024-01-25
FileHash-MD5 501a6d48fd8f80a134cf71db3804cf95 — 2024-01-25
FileHash-MD5 56cb95b63162d0dfceb30100ded1131a — 2024-01-25
FileHash-MD5 635864ff270cf8e366a7747fb5996766 — 2024-01-25
FileHash-MD5 6d29fc0a73096433ff9449c4bbc4cccc — 2024-01-25
FileHash-MD5 9f3359ae571c247a8be28c0684678304 — 2024-01-25
FileHash-MD5 a696c50dd5d15ba75c9e7f8d3c64997c — 2024-01-25
FileHash-MD5 a9182c812c7f7d3e505677a57c8a353b — 2024-01-25
FileHash-MD5 b0b6629d35451bcc511c0f2845934c3e — 2024-01-25
FileHash-MD5 c9969ece7bb47efac4b3b04cdc1538e5 — 2024-01-25
FileHash-MD5 d2949a3c4496cb2b4d204b75e24390d9 — 2024-01-25
FileHash-MD5 da745b60b5ef5b4881c6bc4b7a48d784 — 2024-01-25
FileHash-MD5 de30abf093bd4dfe6b660079751951c6 — 2024-01-25
FileHash-MD5 e0102071722a87f119b12434ae651b48 — 2024-01-25
FileHash-MD5 ee8d767069faf558886f1163a92e4009 — 2024-01-25
FileHash-MD5 f14e778f4d22df275c817ac3014873dc — 2024-01-25
FileHash-MD5 f2501e8b57486c427579eeda20b729fd — 2024-01-25
FileHash-MD5 f5d8664cbf4a9e154d4a888e4384cb1d — 2024-01-25
FileHash-MD5 f68b17f1261aaa4460d759d95124fbd4 — 2024-01-25
FileHash-MD5 fc61b985d8c590860f397d943131bfb5 — 2024-01-25
URL https://awesscholarship.in/ppam/Mail_Check.ps1 — 2024-01-25
URL https://awesscholarship.in/ppam/syscheck.zip — 2024-01-25
URL https://awesscholarship.in/upload/1.pdf — 2024-01-25
URL https://awesscholarship.in/upload/DSOP-NOM.zip — 2024-01-25
URL https://awesscholarship.in/upload/Ipr.pdf — 2024-01-25
URL https://awesscholarship.in/upload/abc009.pdf — 2024-01-25
URL https://awesscholarship.in/upload/file.zip — 2024-01-25
URL https://awesscholarship.in/upload/file1.zip — 2024-01-25
URL https://awesscholarship.in/upload/in.ps1 — 2024-01-25
URL https://awesscholarship.in/upload/upload.php — 2024-01-25
URL https://parichay.epar.in/Win/1.pdf — 2024-01-25
URL https://parichay.epar.in/Win/Mail_Check.ps1 — 2024-01-25
domain awesscholarship.in — 2024-01-25
domain oshi.at — 2024-01-25
domain parichay.nic.in — 2024-01-25
hostname parichay.epar.in — 2024-01-25
hostname scholarship.awesindia.com — 2024-01-25
hostname alfa-aeafa-default-rtdb.firebaseio.com — 2024-01-25
References (1)
↗ https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/