← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Threat Campaign Spreads Winos4.0 Through Game Application | FortiGuard Labs
WHITE CyberHunter_NL 2024-11-08 Modified: 2024-12-08
41
IOCs
MEDIUM VOLUME
FortiGuard Labs has identified Winos4.0, an advanced malicious framework that has been deployed across a range of platforms, including Microsoft Windows, and other operating systems, as well as online gaming-related applications.
cara linfortiguard labs threat researchfortinetduoyicobalt strikesliverthreatfortigatefortimailforticlientfortiedrfortiguard webserviceteam
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Cobalt Strike
Indicators of Compromise (41)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 1c0ae08a08e207e1a229112f80f8f7e3 MD5 of 3fae0495fd0acc7722c2482c0ef3c6ab9ee41acbcaac46a8933c7b36b8896378 2024-11-08
FileHash-MD5 83450778fd9684632c9a34a2573aabcf MD5 of dcdbc3b246233befa25b67909a01b835f1875f4047875ef13f1b801cd2da6fcd 2024-11-08
FileHash-MD5 8f6f306ba501a7e435db720bb97cb1e4 MD5 of c9817d415d34ea3ae07094dae818ffe8e3fb1d5bcb13eb0e65fd361b7859eda7 2024-11-08
FileHash-MD5 a4aa2ded688283c108bafad58c20edaa MD5 of 284cf31ebb4e7dc827374934ad0726f72e7aaef49cadc6aa59d2a2ff672d3fe8 2024-11-08
FileHash-MD5 cee32aa8ec585825f036dc118e324376 MD5 of 80b1d6411e29e51e54f20f46856d31b28e087e9244693e65d022b680c4ba00ce 2024-11-08
FileHash-MD5 d33f351a4aeea5e608853d1a56661059 — 2024-11-08
FileHash-MD5 e054e331caed0e50fc56f6b548fd10c5 MD5 of b2a3aaf4eb4deb85462e1ee39c84caf2830091c1bff8014ad13147897b25e24c 2024-11-08
FileHash-SHA1 1673d5b476ccacaabf23dfdc34eacbe04fb062b1 SHA1 of dcdbc3b246233befa25b67909a01b835f1875f4047875ef13f1b801cd2da6fcd 2024-11-08
FileHash-SHA1 19bc713a9ecc4d948567037f092fc7f3f6534281 SHA1 of 3fae0495fd0acc7722c2482c0ef3c6ab9ee41acbcaac46a8933c7b36b8896378 2024-11-08
FileHash-SHA1 55e89041763e74cb9c6ec83134ef5290dcef622c SHA1 of 284cf31ebb4e7dc827374934ad0726f72e7aaef49cadc6aa59d2a2ff672d3fe8 2024-11-08
FileHash-SHA1 66de656287a3bff5a7bf89f9a0972d679e3afe3f SHA1 of c9817d415d34ea3ae07094dae818ffe8e3fb1d5bcb13eb0e65fd361b7859eda7 2024-11-08
FileHash-SHA1 940eef78b30ad8e67719046149f40e44018e0d64 SHA1 of 80b1d6411e29e51e54f20f46856d31b28e087e9244693e65d022b680c4ba00ce 2024-11-08
FileHash-SHA1 a56178e3a84e48f7ab6482db08b52d05837dec59 SHA1 of b2a3aaf4eb4deb85462e1ee39c84caf2830091c1bff8014ad13147897b25e24c 2024-11-08
FileHash-SHA256 033965f3063bc2a45e5bd3a57ffce098b9308668d70b9b3063f066df5f3e55dd — 2024-11-08
FileHash-SHA256 04edb6585118d09205ee693a54249ed68ebbf68b3fc3d711d2aa0c815b7b3a23 — 2024-11-08
FileHash-SHA256 1354796b44239eef177431584848029161c232401a9580481dbfb5196465250e — 2024-11-08
FileHash-SHA256 1a48347f5fc7c63cc03f30810f961133bd3912caf16ac403e11bc3491117181d — 2024-11-08
FileHash-SHA256 284cf31ebb4e7dc827374934ad0726f72e7aaef49cadc6aa59d2a2ff672d3fe8 — 2024-11-08
FileHash-SHA256 37104f3b3646f5ffc8c78778ec5fdc924ebb5e5756cb162c0e409d24bedf406d — 2024-11-08
FileHash-SHA256 3fae0495fd0acc7722c2482c0ef3c6ab9ee41acbcaac46a8933c7b36b8896378 — 2024-11-08
FileHash-SHA256 51c7f320b95a64bcff050da86c7884bb4f89a5d00073d747f0da7345c8a4501f — 2024-11-08
FileHash-SHA256 80b1d6411e29e51e54f20f46856d31b28e087e9244693e65d022b680c4ba00ce — 2024-11-08
FileHash-SHA256 8748bb7512f16f8122779171686abe0fa0060f1126298290e240457dc90d0aa7 — 2024-11-08
FileHash-SHA256 8f0079a41a262536f502b4b57473effd6ab7955bc2d6e99e0910df18e990a9f6 — 2024-11-08
FileHash-SHA256 922512203c7b9fa67e8db2f588ff4945f63e20c4bc0aafccdba749a442808ace — 2024-11-08
FileHash-SHA256 a27dc6e5aea0c3168117cfde2adb01f73f20881fc6485b768915216c46115064 — 2024-11-08
FileHash-SHA256 a30b68ed39c1517d10b747c2fcd7a72cb12dc8f434203243e7c50df0e56d17d0 — 2024-11-08
FileHash-SHA256 b2a3aaf4eb4deb85462e1ee39c84caf2830091c1bff8014ad13147897b25e24c — 2024-11-08
FileHash-SHA256 b763d77b7aaa83d6c4a9e749cd3c7638127e755d3dc843b15b6c4afce1f468b5 — 2024-11-08
FileHash-SHA256 bef32532923903b12f04b54dd06ec81661f706c3b1397bc77c45492db3919248 — 2024-11-08
FileHash-SHA256 c9817d415d34ea3ae07094dae818ffe8e3fb1d5bcb13eb0e65fd361b7859eda7 — 2024-11-08
FileHash-SHA256 dcdbc3b246233befa25b67909a01b835f1875f4047875ef13f1b801cd2da6fcd — 2024-11-08
FileHash-SHA256 f41236ab5ceffc5379fcf444de358cbc6f67beb31d0e0fd3f7ed0f501eb740ff — 2024-11-08
FileHash-SHA256 ff0c28c81cd0afd78f78c79863c9f4c8afd9d3877a213dfc2dbb55360b7d93ab — 2024-11-08
URL http://ad59t82g.com/1/d.bmp — 2024-11-08
URL http://ad59t82g.com/1/h.bmp — 2024-11-08
URL http://ad59t82g.com/1/h.bmp.xn--ivg — 2024-11-08
URL http://ad59t82g.com/1/lon2.bmp — 2024-11-08
URL http://ad59t82g.com/1/t2.bmp — 2024-11-08
URL http://ad59t82g.com/1/text.bmp — 2024-11-08
domain ad59t82g.com — 2024-11-08
References (1)
↗ https://www.fortinet.com/blog/threat-research/threat-campaign-spreads-winos4-through-game-application