FaultyServer

Search This Blog

on November 07, 2024

Get link
Facebook
X
Pinterest
Email
Other Apps

Hello World!

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

[Storm-1747] Tycoon Phishing Service Email Analysis

Malware Sample Analysis VirusTotal IOC Collection: View Collection Extracted Phishing IOCs Email Attachment (HTML file): 190374 pdf.Dhudnall....html EML Hash (SHA-256): 558f05937b1afcdce82b106599db2707428541abd040a009293b614293ac6d68 Attachment Hash (SHA-256): b3fe13c613f5c22e5211af8c576694800f8831d7f60d6e9863b40c4b54276320 Malicious URLs: https://bumblebeeclub.net/res444.php?2-68747470733a2f2f717a372e6763637678676d6f752e636f6d2f394d684370472f-leech This URL is obfuscated by the script source, likely to track or uniquely identify the victim and evade detection. https://activationmail-setupmailvalidationonlineaosaiaosuaos.es/#[email protected] Observed Domains: bumblebeeclub.net gccvxgmou.com ijmzazonz.com ntowardr.ru activationmail-setupmailvalidationonlineaosaiaosuaos.es Behavioral Analysis and Observations Phishing Server Response: Attempts to revisit the malicious URL led to a connection refusal, likely due to prior access from the Any.Run sandbox environment. The analysis ...

O365 Phishing Email Analysis

Malware Sample Analysis VirusTotal IOC Collection: View Collection Extracted Phishing IOCs Email Attachment (HTML file): View_receipt_details_U.html EML Hash: 1ea0b4ba1728ceda14a7cab6c79b2a70a5e07e6a514e5003766e7f9a75328e3e Attachment Hash: ecb269c37695c61474ca75ec6a39b5544bebe2bdb617e1bf98935fa310d1ee29 Malicious URLs: https://support-365dabwa46l17kupx.rsko-capital.com:8443/impact? https://sdsdsd.chiliesdigital.co.za/app/stiktk.php Observed Domains: seeklogo.com support-365dabwa46l17kupx.rsko-capital.com sdsdsd.chiliesdigital.co.za rsko-capital.com chiliesdigital.co.za iesm.edu.pe Behavioral Analysis and Observations Suspicious Attachments At first glance the email appears to have 3 attachments. Two image files and an html document. However, if we try to open the image files, we can quickly see they are something else the files are 0kb. Taking a look at the source code of View_receipt_details_U.html we can see that ...

Storm1747 Phishing Threat Actor: Tactics, Targets, and Defense

Discover how Storm1747 – a leading phishing threat actor – uses advanced phishing-as-a-service toolkits to bypass MFA and steal credentials. Learn about their attack methods, targeted platforms like Microsoft 365 and Google Workspace, and effective defense strategies to protect your organization. Table of Contents Overview Tactics, Techniques, and Procedures (TTPs) Recent Campaigns and Notable Incidents Mitigation and Defense Strategies References Overview Storm1747 is a threat actor known for large-scale phishing operations leveraging advanced “phishing-as-a-service” toolkits. First observed in mid-2023, this actor has rapidly become one of the most active phishing groups on record ( Malware Trends Report: Q4, 2024 ). Their campaigns use adversary-in-the-middle (AiTM) techniques to steal login credentials and session cookies—effectively bypassing multifactor authentication (MFA...

Powered by Blogger

Comments

Post a Comment