EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
← Back to intelligence
Ransomware

#StopRansomware: Blacksuit (Royal) Ransomware

Official source
EudorIA operational summary

What it means

Priority 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Blacksuit (Royal). La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Why it matters

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Recommended actions

  1. Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
  2. Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
  3. Confermare che backup offline e immutabili siano separati e ripristinabili.
  4. Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Potential operational benefits

  • Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
  • Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
  • Validazione documentata della capacita di ripristino
Indications to confirm against the customer's technical and organisational perimeter.
Relevant controlsVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response
AudienceITSOCCISOManagement
Information centre

Translation in progress

CISA

The official content is available in the original language. The Italian version will be published once automated checks are complete.

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Blacksuit (Royal) Ransomware Last Revised August 27, 2024 Alert Code AA23-061A Related topics: Cyber Threats and Response , Incident Response , Malware, Phishing, and Ransomware Actions for Organizations to Take Today to Mitigate Cyber Threats Related to BlackSuit Ransomware Activity Prioritize remediating known exploited vulnerabilities. Train users to recognize and report phishing attempts. Enable and enforce multifactor authentication. Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. Note: This advisory, originally published March 2, 2023, has been updated four times: November 13, 2023: The advisory was updated to share new Royal TTPs and IOCs. August 7, 2024: The advisory was updated to notify network defenders of the rebrand of “Royal” ransomware actors to “BlackSuit.” The update includes new TTPs, IOCs, and detection methods related to BlackSuit ransomware. “Royal” was updated to “BlackSuit” throughout unless referring to legacy Royal activity. Updates and new content are noted. August 14, 2024: The STIX files from the previous update (08/07/2024) were refreshed. August 27, 2024: The STIX files from the (08/19/2024) update were refreshed. (New August 7, 2024) The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastruc

Indicatori CISA verificabili

238 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 2 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T07:35:45.304363+00:00

Scarica STIX 2.1

Questo allegato contiene 2 indicatori incompleti o non interpretabili, conservati nell'originale ma esclusi dall'export operativo. I valori mancanti non sono stati dedotti.

TipoIndicatore (non cliccabile)File
MD5cdcf4f24dc07d5da5be076793983a308
SHA-10488348645ebb39ee7a51a09f2705c87d89d27f1
SHA-2560a9a342cf4b9ccba811922b32c55498a3448b198702e2ec17269653c161bbda3
domain-nameparkerpublic[.]com
ipv4-addr47[.]87[.]229[.]39
ipv4-addr5[.]181[.]234[.]58
ipv4-addr45[.]61[.]136[.]47
ipv4-addr193[.]235[.]146[.]104
ipv4-addr193[.]149[.]176[.]157
ipv4-addr185[.]7[.]214[.]218
ipv4-addr152[.]89[.]247[.]50
ipv4-addr147[.]135[.]11[.]223
ipv4-addr147[.]135[.]36[.]162
ipv4-addr140[.]82[.]48[.]158
SHA-25674d81ef0be02899a177d7ff6374d699b634c70275b3292dbc67e577b5f6a3f3c
SHA-25682f1f72f4b1bfd7cc8afbe6d170686b1066049bc7e5863b51aa15ccc5c841f58
MD5527c71c523d275c8367b67bbebf48e9f
SHA-17902b08fb184cfb9580d0ad950baf048a795f7c1
SHA-2568a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451
domain-nameciborkumari[.]xyz
MD50191d87b91f1545e13b3af4a442ae949kl.bat
SHA-165dc04f3f75deb3b287cca3138d9d0ec36b8bea0kl.bat
SHA-256a83a5810ea7a4f02d4623c509dd9b88ad4e432177143e9e9b2b30f9b2943a1b0kl.bat
SHA-1c96154690f60a8e1f2271242e458029014ffe30a8.bat
SHA-1a84ed0f3c46b01d66510ccc9b1fc1e07af005c604.bat
SHA-141a79f83f8b00ac7a9dd06e1e225d64d95d29b1d3.bat
SHA-1585b05b290d241a249af93b1896a9474128da9692.bat
MD55cb9d80f82f674b065c3d80816a370c4runanddelete.bat
SHA-1dd37973be7e6ede23c131a48919a4f6e1fb49328runanddelete.bat
SHA-256342b398647073159dfa8a7d36510171f731b760089a546e96fbb8a292791efeerunanddelete.bat
MD592283d4d0e7e730c3f4f5485bfa48cb6
SHA-13288f6f98bc2445f4ad688b562fe12414893c1ac
SHA-256216047c048bf1dcbf031cf24bd5e0f263994a5df60b23089e393033d17257cb5
SHA-256d47d4b52e75e8cf3b11ea171163a66c06d1792227c1cf7ca49d7df60804a1681
MD557bd8fba4aa26033fa080f390b31ed0e
SHA-11206bd44744d61f6c31aba2234c34d3e35b5bac7
SHA-2564cd00234b18e04dcd745cc81bb928c8451f6601affb5fa45f20bb11bfb5383ce
SHA-256b8c4aec31c134adbdbe8aad65d2bcb21cfe62d299696a23add9aa1de082c6e20
SHA-256be030e685536eb38ba1fec1c90e90a4165f6641c8dc39291db1d23f4ee9fa0b1
SHA-2568a983042278bc5897dbcdd54d1d7e3143f8b7ead553b5a4713e30deffda16375
domain-namemyappearinc[.]com
domain-nametumbleproperty[.]com
MD550cc3a3bca96d7096c8118e838d9bc16
SHA-1b286b58ed32b6df4ecdb5df86d7d7d177bb7bfaf
SHA-256f8cff7082a936912baf2124d42ed82403c75c87cb160553a7df862f8d81809ee
domain-namealtocloudzone[.]live
ipv4-addr77[.]73[.]133[.]84
ipv4-addr179[.]43[.]167[.]10
ipv4-addr5[.]44[.]42[.]20
domain-namegororama[.]com
domain-namesofteruplive[.]com
ipv4-addr94[.]232[.]41[.]105
ipv4-addr209[.]141[.]36[.]116
domain-namesombrat[.]com
ipv4-addr105[.]69[.]155[.]85
ipv4-addr98[.]143[.]70[.]147
ipv4-addr82[.]12[.]196[.]197
ipv4-addr81[.]184[.]181[.]215
ipv4-addr68[.]83[.]169[.]91
ipv4-addr61[.]166[.]221[.]46
ipv4-addr45[.]227[.]251[.]167
ipv4-addr42[.]189[.]12[.]36
ipv4-addr41[.]97[.]65[.]51
ipv4-addr41[.]251[.]121[.]35
ipv4-addr41[.]109[.]11[.]80
ipv4-addr41[.]107[.]77[.]67
ipv4-addr41[.]100[.]55[.]97
ipv4-addr197[.]94[.]67[.]207
ipv4-addr197[.]207[.]218[.]27
ipv4-addr197[.]207[.]181[.]147
ipv4-addr197[.]204[.]247[.]7
ipv4-addr197[.]158[.]89[.]85
ipv4-addr197[.]11[.]134[.]255
ipv4-addr196[.]70[.]77[.]11
ipv4-addr190[.]193[.]180[.]228
ipv4-addr186[.]64[.]67[.]6
ipv4-addr181[.]164[.]194[.]228
ipv4-addr181[.]141[.]3[.]126
ipv4-addr163[.]182[.]177[.]80
ipv4-addr148[.]213[.]109[.]165
ipv4-addr139[.]195[.]43[.]166
ipv4-addr134[.]35[.]9[.]209
ipv4-addr113[.]169[.]187[.]159
ipv4-addr105[.]158[.]118[.]241
ipv4-addr102[.]157[.]44[.]105
ipv4-addr186[.]86[.]212[.]138
ipv4-addr139[.]60[.]161[.]213
ipv4-addr45[.]8[.]158[.]104
MD5cb8a14388e1da3956849d638af50fe9d
SHA-1a0ee0761602470e24bcea5f403e8d1e8bfa29832
SHA-25608c6e20b1785d4ec4e3f9956931d992377963580b4b2c6579fd9930e08882b1c
ipv4-addr23[.]111[.]114[.]52
MD5bd1c7369830ebd781ed5eade64f8f9e4AnyDesk.exe; AnyDesk.exe
SHA-14f65118960bd8bcc744d62e6f464f8bc82c85a9eAnyDesk.exe; AnyDesk.exe
SHA-2564a9dde3979c2343c024c6eeeddff7639be301826dd637c006074e04a1e4e9fe7AnyDesk.exe; AnyDesk.exe
MD55cae01aea8ed390ce9bec17b6c1237e4NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-13a80a49efaac5d839400e4fb8f803243fb39a513NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-25619896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
ipv4-addr185[.]143[.]223[.]69
ipv4-addr5[.]188[.]86[.]195
ipv4-addr89[.]108[.]65[.]136

Provenance

Allegato ufficiale CISA · 2023-03-09T22:43:25Z

SHA-512: 20c2f330cf4e8bbf40b41800da0f33dc279d4f424625c98027866478b7a0a2a8f258625ee883553fd91124510c63404fb6ecfb343eaa60bab8ae296396821ddd

Questo allegato contiene 2 indicatori incompleti o non interpretabili, conservati nell'originale ma esclusi dall'export operativo. I valori mancanti non sono stati dedotti.

TipoIndicatore (non cliccabile)File
SHA-256b987f738a1e185f71e358b02cafa5fe56a4e3457df3b587d6b40e9c9de1da410
SHA-256f0197bd7ccd568c523df9c7d9afcbac222f14d344312322c04c92e7968859726ll.exe
SHA-256fb638dba20e5fec72f5501d7e0627b302834ec5eaf331dd999763ee925cbc0f9defw10.bat
SHA-2565654f32a4f0f2e900a35761e8caf7ef0c50ee7800e0a3b19354b571bc6876f61f827.exe
SHA-2563e6e2e0de75896033d91dfd07550c478590ca4cd4598004d9e19246e8a09cb97InstallerV8.1.ms
SHA-25634a98f2b54ebab999f218b0990665485eb2bb74babdf7e714cc10a306616b00c%USERPROFILE%Downloadssr.bat
SHA-256e0dbe3a2d07ee10731b68a142c65db077cfb88e5ec5c8415e548d3ede40e7ffc%USERPROFILE%Downloadssc.bat
SHA-25684e1efbed6bb7720caea6720a8bff7cd93b5d42fb1d71ef8031bfd3897ed4435%USERPROFILE%Downloadsrun4.bat
SHA-2562b93206d7a36cccdf7d7596b90ead301b2ff7e9a96359f39b6ba31bb13d11f45%USERPROFILE%Downloadsrun3.bat
SHA-25613c25164791d3436cf2efbc410caec6b6dd6978d7e83c4766917630e24e1af10%USERPROFILE%Downloadsrun2.bat
SHA-256bc609cf53dde126b766d35b5bcf0a530c24d91fe23633dad6c2c59fd1843f781%USERPROFILE%Downloadsrun1.bat
SHA-2565b08c02c141eab94a40b56240a26cab7ff07e9a6e760dfde8b8b053a3526f0e6%PROGRAMDATA%wine.exe
SHA-25685087f28a84205e344d7e8e06979e6622fab0cfe1759fd24e38cd0390bca5fa6windows_encryptor.exe
ipv4-addr149[.]28[.]73[.]161
SHA-1a4ef01d55e55cebdd37ba71c28b0c448a9c833c0
SHA-19a92b147cad814bfbd4632b6034b8abf8d84b1a5
SHA-19e19afc15c5781e8a89a75607578760aabad8e65
SHA-1d93f1ef533e6b8c95330ba0962e3670eaf94a026
SHA-1a51b1f1f0636bff199c0f87e2bb300d42e06698b
SHA-256c429719a45ca14f52513fe55320ebc49433c729a0d2223479d9d43597eab39fa
MD5be7b13aee7b510b052d023dd936dc32f
SHA-16715b888a280d54de9a8482e40444087fd4d5fe8
SHA-256b9ef2e948a9b49a6930fc190b22cbdb3571579d37a4de56564e41a2ef736767b
SSDEEP98304:01tipsAxrXEMzM4HGic2lNvRhRVTyTNYtLYL3KpYS8WZL+n2Vs0wpA6ReQHb8rx:03ipbEIGiMulkb6
MD59656cd12e3a85b869ad90a0528ca026e1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SHA-1861793c4e0d4a92844994b640cc6bc3e20944a731c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SHA-2561c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SSDEEP49152:bNyuNSG50kEZGvKe0xeyjL8ZdLE1vgqRj2lwKGBIU6ijCV/89FL/5gNpR1aPj:bVQG50kEPe0xeyjQf4vgqROwKX+qm2NS1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
MD5748de52961d2f182d47e88d736f6c835
SHA-130cc7724be4a09d5bcd9254197af05e9fab76455
SHA-25690ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c
SSDEEP49152:CtNUaQsh3Ss/flyXP8BnzoVPgfpQO21F8k:CtNUA3vlyXPE0qR
domain-nameparkerpublic[.]com
ipv4-addr47[.]87[.]229[.]39
ipv4-addr5[.]181[.]234[.]58
ipv4-addr45[.]61[.]136[.]47
ipv4-addr193[.]235[.]146[.]104
ipv4-addr193[.]149[.]176[.]157
ipv4-addr185[.]7[.]214[.]218
ipv4-addr152[.]89[.]247[.]50
ipv4-addr147[.]135[.]11[.]223
ipv4-addr147[.]135[.]36[.]162
ipv4-addr140[.]82[.]48[.]158
SHA-25674d81ef0be02899a177d7ff6374d699b634c70275b3292dbc67e577b5f6a3f3cr.bat
SHA-25682f1f72f4b1bfd7cc8afbe6d170686b1066049bc7e5863b51aa15ccc5c841f58gp.bat
MD5527c71c523d275c8367b67bbebf48e9f
SHA-17902b08fb184cfb9580d0ad950baf048a795f7c1
SHA-2568a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451
SSDEEP98304:/KRt9trenMQWMZ7+fD25GGF5LgNGzl3WVxE:qD/QBy25GGFxgA3WVS
domain-nameciborkumari[.]xyz
MD50191d87b91f1545e13b3af4a442ae949kl.bat
SHA-165dc04f3f75deb3b287cca3138d9d0ec36b8bea0kl.bat
SHA-256a83a5810ea7a4f02d4623c509dd9b88ad4e432177143e9e9b2b30f9b2943a1b0kl.bat
SHA-1c96154690f60a8e1f2271242e458029014ffe30a8.bat
SHA-1a84ed0f3c46b01d66510ccc9b1fc1e07af005c604.bat
SHA-141a79f83f8b00ac7a9dd06e1e225d64d95d29b1d3.bat
SHA-1585b05b290d241a249af93b1896a9474128da9692.bat
MD55cb9d80f82f674b065c3d80816a370c4runanddelete.bat
SHA-1dd37973be7e6ede23c131a48919a4f6e1fb49328runanddelete.bat
SHA-256342b398647073159dfa8a7d36510171f731b760089a546e96fbb8a292791efeerunanddelete.bat
MD592283d4d0e7e730c3f4f5485bfa48cb6
SHA-13288f6f98bc2445f4ad688b562fe12414893c1ac
SHA-256216047c048bf1dcbf031cf24bd5e0f263994a5df60b23089e393033d17257cb5
SHA-256d47d4b52e75e8cf3b11ea171163a66c06d1792227c1cf7ca49d7df60804a1681wstart.exe
MD557bd8fba4aa26033fa080f390b31ed0escripttodo.ps1
SHA-11206bd44744d61f6c31aba2234c34d3e35b5bac7scripttodo.ps1
SHA-2564cd00234b18e04dcd745cc81bb928c8451f6601affb5fa45f20bb11bfb5383cescripttodo.ps1
SHA-256b8c4aec31c134adbdbe8aad65d2bcb21cfe62d299696a23add9aa1de082c6e20
SHA-256be030e685536eb38ba1fec1c90e90a4165f6641c8dc39291db1d23f4ee9fa0b1d2ef5.exe
SHA-2568a983042278bc5897dbcdd54d1d7e3143f8b7ead553b5a4713e30deffda16375shutdowni.bat
domain-namemyappearinc[.]com
SHA-25691605641a4c7e859b7071a9841d1cd154b9027e6a58c20ec4cadafeaf47c9055f24dc8ea.msi
domain-nametumbleproperty[.]com
MD550cc3a3bca96d7096c8118e838d9bc16dontsleep.exe
SHA-1b286b58ed32b6df4ecdb5df86d7d7d177bb7bfafdontsleep.exe
SHA-256f8cff7082a936912baf2124d42ed82403c75c87cb160553a7df862f8d81809eedontsleep.exe
domain-namealtocloudzone[.]live
ipv4-addr77[.]73[.]133[.]84
ipv4-addr179[.]43[.]167[.]10
ipv4-addr5[.]44[.]42[.]20
domain-namegororama[.]com
domain-namesofteruplive[.]com
ipv4-addr94[.]232[.]41[.]105
ipv4-addr209[.]141[.]36[.]116
domain-namesombrat[.]com
ipv4-addr105[.]69[.]155[.]85
ipv4-addr98[.]143[.]70[.]147
ipv4-addr82[.]12[.]196[.]197
ipv4-addr81[.]184[.]181[.]215
ipv4-addr68[.]83[.]169[.]91
ipv4-addr61[.]166[.]221[.]46
ipv4-addr45[.]227[.]251[.]167
ipv4-addr42[.]189[.]12[.]36
ipv4-addr41[.]97[.]65[.]51
ipv4-addr41[.]251[.]121[.]35
ipv4-addr41[.]109[.]11[.]80
ipv4-addr41[.]107[.]77[.]67
ipv4-addr41[.]100[.]55[.]97
ipv4-addr197[.]94[.]67[.]207
ipv4-addr197[.]207[.]218[.]27
ipv4-addr197[.]207[.]181[.]147
ipv4-addr197[.]204[.]247[.]7
ipv4-addr197[.]158[.]89[.]85
ipv4-addr197[.]11[.]134[.]255
ipv4-addr196[.]70[.]77[.]11
ipv4-addr190[.]193[.]180[.]228
ipv4-addr186[.]64[.]67[.]6
ipv4-addr181[.]164[.]194[.]228
ipv4-addr181[.]141[.]3[.]126
ipv4-addr163[.]182[.]177[.]80
ipv4-addr148[.]213[.]109[.]165
ipv4-addr139[.]195[.]43[.]166
ipv4-addr134[.]35[.]9[.]209
ipv4-addr113[.]169[.]187[.]159
ipv4-addr105[.]158[.]118[.]241
ipv4-addr102[.]157[.]44[.]105
ipv4-addr186[.]86[.]212[.]138
ipv4-addr139[.]60[.]161[.]213
ipv4-addr45[.]8[.]158[.]104
MD5cb8a14388e1da3956849d638af50fe9d
SHA-1a0ee0761602470e24bcea5f403e8d1e8bfa29832
SHA-25608c6e20b1785d4ec4e3f9956931d992377963580b4b2c6579fd9930e08882b1c
ipv4-addr23[.]111[.]114[.]52
MD5bd1c7369830ebd781ed5eade64f8f9e4AnyDesk.exe; AnyDesk.exe; file
SHA-14f65118960bd8bcc744d62e6f464f8bc82c85a9eAnyDesk.exe; AnyDesk.exe; file
SHA-2564a9dde3979c2343c024c6eeeddff7639be301826dd637c006074e04a1e4e9fe7AnyDesk.exe; AnyDesk.exe; file
MD55cae01aea8ed390ce9bec17b6c1237e4SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-13a80a49efaac5d839400e4fb8f803243fb39a513SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-25619896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
ipv4-addr185[.]143[.]223[.]69
ipv4-addr5[.]188[.]86[.]195
ipv4-addr89[.]108[.]65[.]136

Provenance

Allegato ufficiale CISA · 2023-11-09T18:54:29Z

SHA-512: e845e2fc0e00855dc98e4b1349d9c2606fa0bc51e7457c52f179d679e3cb095beff4facd3343e6fc33ca0515e102206ba427552e4f978c72974b9a01448282b3

Questo allegato contiene 2 indicatori incompleti o non interpretabili, conservati nell'originale ma esclusi dall'export operativo. I valori mancanti non sono stati dedotti.

TipoIndicatore (non cliccabile)File
SHA-256f805dafb3c0b7e18aa7d8c96db8e8d4e9301ff619622d1aecc8080e0ecd9ebbe
SHA-256e87512ea12288acec611cf8e995c4ced3971d9e35c0c5dcfd9ee17c9e3ed913d
SHA-256b028eaa0ec452c6844881dc34be813834813a40591b89ea9a57dd4fb4084e477
SHA-256f02af8ffc37d1874b971307fdec80e33e583b56d9ebabda78a4b8ad038bc3bf0
SHA-2561743494f803bbcbd11150a4a8b7a2c5faba1223da607f67d24b18ca2d95d5ba3readme.blacksuit.txt
ipv4-addr5[.]181[.]157[.]8
SHA-2568f87a1542ee790623896bbaab933d1883484de02a7b3d65d6c791d50173a923d_EXEC .bat
SHA-2563041dfc13f356c2f0133a9c11a258f87cb7de1e17bc435e9b623d74bc5e1c6be2.bat
SHA-2566332f189cc71df646ff0f1b9b02a005c9ebda3fe7b9712976660746913b030deMwntv.sys
SHA-256338228a3e79f3993abc102cbac2ff253c84965213d59ac30892538cdd9b0a22bexe.exe
SHA-256bbb7404419f91f82cedfec915931a9339f04165b27d8878d63827c9ee421ed62776-svchost.exe
SHA-25668c57daed0e5899c49b827042bcf3bbeba33b524bd83315a44d889721664dc34372-winlogon.exe
SHA-256ee6ec2810910c6d2a2957f041edd1e39dca4266a1cc8009ae6d7315aba9196f5288-csrss.exe
SHA-2563c8c1b1f53e0767b7291bb1ae605ffa62a93e9c8cc783e4ca47ac84b48320d59qq.exe
SHA-256c798b2690c5f16eb2917a679af3117cfe9c7060fa8bc84ffc3159338ef33508esocss.exe
SHA-256e3d7c012040962acd66f395d1c5c5f73f305aa1058f2111e8e37d9cb213b80c4share$.zip
SHA-25625a6f82936134a6c5c0066f382530b9d6bf2c8da6feafe028f166b1a9d7283cfsocks.ps1
SHA-256e813f8faf3aa2eb20e285596413f5088b2d7fd153fe9f72f3ff45735d0fddced%APPDATA% ZoomAlternative Workplace Strategies.js
SHA-256146335b1be627318ac09476f0c8f8e6e027805e6077673f72d6dce1677a24c78locker_N1uYkmEsfoHmT4lK66trUjBuy5gyAj7n.ex_
SHA-256a0a4a99948e12309f54911264261d96f0e40d5fd695bab82e95fbc1f9024482e
MD54ac7f6cb9119fa684f57edeaa42eef46Wen.exe
SHA-1817a45fcc809d5272a30ea369cd5d67dc7fbbe36Wen.exe
SHA-25601ce9cfebb29596d0ab7c99e8dbadf1a8409750b183e6bf73e0de021b365be13Wen.exe
SSDEEP12288:FYqt+paWS1/sv5TJnG0QADDkqZbWoyK/RoE/U3OC9:FYaDL/svPnGB8oqZbWoyEoEw9Wen.exe
SHA-2568d16a23d5a5630502b09c33fbc571d2261c6c98fecc3a79a1e1129354f930d0aaaa.exe
SHA-256c4a2227cd8d85128eafef8ee2298aa105da892c8b0f37405667c2d1647c35c46aaa.exe
SHA-256af9f95497b8503af1a399bc6f070c3bbeabc5aeecd8c09bca80495831ae71e611.exe
urlhttps://protect-us[.]mimecast[.]com/s/teBrC1wvL8iMNE56tXga0n?domain=147[.]135[.]11[.]223
urlhttps://protect-us[.]mimecast[.]com/s/T3InC2kwM5hpzEOVU9S5zn?domain=147[.]135[.]36[.]162
urlhttps://protect-us[.]mimecast[.]com/s/NwueC5yzP5IZLW4MulfSrc?domain=137[.]220[.]61[.]94
urlhttps://protect-us[.]mimecast[.]com/s/CcsrC4xyO7fBK73ztjNfPl?domain=5[.]181[.]234[.]58
urlhttps://protect-us[.]mimecast[.]com/s/A2PyC31xN5IpzR0XUvzaAj?domain=5[.]181[.]157[.]8
domain-namestore[.]turnovercheck[.]com
domain-namemail[.]turnovercheck[.]com
urlhttps://file[.]io/ScPd1KcJTtxO
domain-namestore[.]abbeymathiass[.]com
domain-namemail[.]abbeymathiass[.]com
domain-nameabbeymathiass[.]com
domain-nameturnovercheck[.]com
urlhttps://stroeck[.]at/xmlrpc[.]php
urlhttps://pikaluna[.]com/xmlrpc[.]php
urlhttps://parencyivf[.]com/xmlrpc[.]php
urlhttps://libertygospeltracts[.]com/xmlrpc[.]php
urlhttps://interpolyaris[.]ru/xmlrpc[.]php
urlhttps://beautyhabits[.]gr/xmlrpc[.]php
urlhttps://avpvuurwerk[.]nl/xmlrpc[.]php
urlhttps://1tvnews[.]af/xmlrpc[.]php
ipv4-addr45[.]76[.]225[.]156
ipv4-addr140[.]82[.]18[.]48
ipv4-addr141[.]98[.]80[.]181
ipv4-addr193[.]37[.]69[.]116
ipv4-addr184[.]166[.]211[.]74
ipv4-addr180[.]131[.]145[.]61
ipv4-addr135[.]148[.]67[.]84
ipv4-addr184[.]174[.]96[.]16
SHA-1790d40cd16fb458bf99e3600bce29eca06d40b56
ipv4-addr89[.]251[.]22[.]32
ipv4-addr180[.]131[.]145[.]85
domain-nameprovincial-gaiters-gw[.]aws-use1[.]cloud-ara[.]tyk[.]io
ipv4-addr138[.]199[.]53[.]226
domain-namemystuff[.]bublup[.]com
domain-namemegupdate[.]com
domain-namezoommanager[.]com
ipv4-addr143[.]244[.]146[.]183
ipv4-addr45[.]141[.]87[.]218
SHA-2569bbc9784ce3c818a127debfe710ec6ce21e7c9dd0daf4e30b8506a6dba533db4svchost.exe
domain-namehourlyprofitstore[.]com
MD5fa40a83774c126982696e8f8e380a49a
SHA-1e4af08758daf4d2dc601a65ec739ad6959aea401
SHA-256ae724dce252c7b05a84bc264993172cf86950d22744b5e3a1b15ba645d9d3733
SSDEEP49152:dSkMZm+rKmzZSn3Tqqa4R6nHFmt0oXkTQ:dP4JXsRhaoXoQ
ipv4-addr137[.]220[.]61[.]94
MD5ed44877077716103973cbbebd531f38esocks32.exe
SHA-1ceb8c699a57193aa3be2a1766b03050cde3c738asocks32.exe
SHA-2569493b512d7d15510ebee5b300c55b67f9f2ff1dda64bddc99ba8ba5024113300socks32.exe
SSDEEP192:FbzvTqUmLLGHaqeAY82mNZZZ1eLPPx9f0LNvFCDkoh:FP2UmXGHaqX22ZZ0LHL0N0kosocks32.exe
urlhttps://oldtimertreffen-rethem[.]de/xmlrpc[.]php
domain-namerecruitment-interview[.]org
SHA-256b987f738a1e185f71e358b02cafa5fe56a4e3457df3b587d6b40e9c9de1da410
SHA-256f0197bd7ccd568c523df9c7d9afcbac222f14d344312322c04c92e7968859726ll.exe
SHA-256fb638dba20e5fec72f5501d7e0627b302834ec5eaf331dd999763ee925cbc0f9defw10.bat
MD5c1d6a5a9a9952583809ccf9ee7e67888f827.exe
SHA-139ef662922463b913e84a338ad4832674219964df827.exe
SHA-2565654f32a4f0f2e900a35761e8caf7ef0c50ee7800e0a3b19354b571bc6876f61f827.exe
SSDEEP98304:aST/lfZzFcaeYZ0kc2Jo2Tb45Tb7Nkf/OCDm9sv+xUrA6Mv3WFKKTj2un60T28Ti:a6Zh1I2JFTb45TPaf/vmOvo5KVBTZsrf827.exe
SHA-2563e6e2e0de75896033d91dfd07550c478590ca4cd4598004d9e19246e8a09cb97InstallerV8.1.ms
SHA-25634a98f2b54ebab999f218b0990665485eb2bb74babdf7e714cc10a306616b00c%USERPROFILE%Downloadssr.bat
SHA-256e0dbe3a2d07ee10731b68a142c65db077cfb88e5ec5c8415e548d3ede40e7ffc%USERPROFILE%Downloadssc.bat
SHA-25684e1efbed6bb7720caea6720a8bff7cd93b5d42fb1d71ef8031bfd3897ed4435%USERPROFILE%Downloadsrun4.bat
SHA-2562b93206d7a36cccdf7d7596b90ead301b2ff7e9a96359f39b6ba31bb13d11f45%USERPROFILE%Downloadsrun3.bat
SHA-25613c25164791d3436cf2efbc410caec6b6dd6978d7e83c4766917630e24e1af10%USERPROFILE%Downloadsrun2.bat
SHA-256bc609cf53dde126b766d35b5bcf0a530c24d91fe23633dad6c2c59fd1843f781%USERPROFILE%Downloadsrun1.bat
SHA-2565b08c02c141eab94a40b56240a26cab7ff07e9a6e760dfde8b8b053a3526f0e6%PROGRAMDATA%wine.exe
SHA-25685087f28a84205e344d7e8e06979e6622fab0cfe1759fd24e38cd0390bca5fa6windows_encryptor.exe
ipv4-addr149[.]28[.]73[.]161
SHA-1a4ef01d55e55cebdd37ba71c28b0c448a9c833c0
SHA-19a92b147cad814bfbd4632b6034b8abf8d84b1a5
MD59495672a47fcaa5ce6f9f1bd86a56b79
SHA-19e19afc15c5781e8a89a75607578760aabad8e65
SHA-25613d12091f39649493eab3cf0e56681e1ff0d8b982b85af65a0b2dd89532003a6
SSDEEP6144:vSv/lsPelSAGFTh7kqM0J33G66a/5PAWvL2dVH/2in0ob:vEQV334KWgI0
SHA-1d93f1ef533e6b8c95330ba0962e3670eaf94a026
SHA-1a51b1f1f0636bff199c0f87e2bb300d42e06698b
MD5772b6bae6862a79bbff035151972cec9
SHA-1c919a3270eb0542fc710ee59144ad7a01d0143dd
SHA-256c429719a45ca14f52513fe55320ebc49433c729a0d2223479d9d43597eab39fa
SSDEEP196608:TgsTXrpSSSbF+alKCpH4pAkuetCqBI7jMz5g0GwSSyjoGcOVJhiyWNmTNOcA8/Qe:rzrVqKbpnkjE5gR2yjoZOVamTMcA8b
ipv4-addr155[.]138[.]150[.]236
ipv4-addr144[.]202[.]120[.]122
MD5be7b13aee7b510b052d023dd936dc32f
SHA-16715b888a280d54de9a8482e40444087fd4d5fe8
SHA-256b9ef2e948a9b49a6930fc190b22cbdb3571579d37a4de56564e41a2ef736767b
SSDEEP98304:01tipsAxrXEMzM4HGic2lNvRhRVTyTNYtLYL3KpYS8WZL+n2Vs0wpA6ReQHb8rx:03ipbEIGiMulkb6
MD59656cd12e3a85b869ad90a0528ca026e1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e.elf; 1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SHA-1861793c4e0d4a92844994b640cc6bc3e20944a731c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e.elf; 1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SHA-2561c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e.elf; 1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
SSDEEP49152:bNyuNSG50kEZGvKe0xeyjL8ZdLE1vgqRj2lwKGBIU6ijCV/89FL/5gNpR1aPj:bVQG50kEPe0xeyjQf4vgqROwKX+qm2NS1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e.elf; 1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
MD5748de52961d2f182d47e88d736f6c835sys32.exe; 205096___17138f01-1387-4dfc-a52c-1a326cc007e3.exe
SHA-130cc7724be4a09d5bcd9254197af05e9fab76455sys32.exe; 205096___17138f01-1387-4dfc-a52c-1a326cc007e3.exe
SHA-25690ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2csys32.exe; 205096___17138f01-1387-4dfc-a52c-1a326cc007e3.exe
SSDEEP49152:CtNUaQsh3Ss/flyXP8BnzoVPgfpQO21F8k:CtNUA3vlyXPE0qRsys32.exe; 205096___17138f01-1387-4dfc-a52c-1a326cc007e3.exe
domain-nameparkerpublic[.]com
ipv4-addr47[.]87[.]229[.]39
ipv4-addr5[.]181[.]234[.]58
ipv4-addr45[.]61[.]136[.]47
ipv4-addr193[.]235[.]146[.]104
ipv4-addr193[.]149[.]176[.]157
ipv4-addr185[.]7[.]214[.]218
ipv4-addr152[.]89[.]247[.]50
ipv4-addr147[.]135[.]11[.]223
ipv4-addr147[.]135[.]36[.]162
ipv4-addr140[.]82[.]48[.]158
SHA-25674d81ef0be02899a177d7ff6374d699b634c70275b3292dbc67e577b5f6a3f3cr.bat
SHA-25682f1f72f4b1bfd7cc8afbe6d170686b1066049bc7e5863b51aa15ccc5c841f58gp.bat
MD5527c71c523d275c8367b67bbebf48e9f
SHA-17902b08fb184cfb9580d0ad950baf048a795f7c1
SHA-2568a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451
SSDEEP98304:/KRt9trenMQWMZ7+fD25GGF5LgNGzl3WVxE:qD/QBy25GGFxgA3WVS
domain-nameciborkumari[.]xyz
MD50191d87b91f1545e13b3af4a442ae949kl.bat
SHA-165dc04f3f75deb3b287cca3138d9d0ec36b8bea0kl.bat
SHA-256a83a5810ea7a4f02d4623c509dd9b88ad4e432177143e9e9b2b30f9b2943a1b0kl.bat
SSDEEP192:vfFuFJjnD0/sX0LkPaDJdTwN3l+702OqERT2J2Rbev1W29mlAtRxopnCG5:FuFJm2aDJdT43l+702OqERT2J2Rbev1ikl.bat
SHA-1c96154690f60a8e1f2271242e458029014ffe30a8.bat
SHA-1a84ed0f3c46b01d66510ccc9b1fc1e07af005c604.bat
SHA-141a79f83f8b00ac7a9dd06e1e225d64d95d29b1d3.bat
SHA-1585b05b290d241a249af93b1896a9474128da9692.bat
MD55cb9d80f82f674b065c3d80816a370c4runanddelete.bat
SHA-1dd37973be7e6ede23c131a48919a4f6e1fb49328runanddelete.bat
SHA-256342b398647073159dfa8a7d36510171f731b760089a546e96fbb8a292791efeerunanddelete.bat
SSDEEP24:VLZmjmpzHOwhoI8BgAfJ0v7b20QLwLFfLoj:3XpRhoI8Bn6OQcjrunanddelete.bat
MD592283d4d0e7e730c3f4f5485bfa48cb6
SHA-13288f6f98bc2445f4ad688b562fe12414893c1ac
SHA-256216047c048bf1dcbf031cf24bd5e0f263994a5df60b23089e393033d17257cb5
SSDEEP1536:FA3cJAgmSRC5DcLxIBLGwUgIW2sV9R2Jml:1OozkV9RW+
SHA-256d47d4b52e75e8cf3b11ea171163a66c06d1792227c1cf7ca49d7df60804a1681wstart.exe
MD557bd8fba4aa26033fa080f390b31ed0escripttodo.ps1
SHA-11206bd44744d61f6c31aba2234c34d3e35b5bac7scripttodo.ps1
SHA-2564cd00234b18e04dcd745cc81bb928c8451f6601affb5fa45f20bb11bfb5383cescripttodo.ps1
SSDEEP192:kWkuX21XGdY4lQas7G4YK+B+3pq3PTuTflTD8FdahHHHXHHHO:3kp4lQaEG4YKa9scripttodo.ps1
SHA-256b8c4aec31c134adbdbe8aad65d2bcb21cfe62d299696a23add9aa1de082c6e20
SHA-256be030e685536eb38ba1fec1c90e90a4165f6641c8dc39291db1d23f4ee9fa0b1d2ef5.exe
SHA-2568a983042278bc5897dbcdd54d1d7e3143f8b7ead553b5a4713e30deffda16375shutdowni.bat
MD543250dd7f3a01c689131849c39f36482f24dc8ea.msi
SHA-13182cc12b54a95a2d0d7f6fb8a0e4662a53bfe81f24dc8ea.msi
SHA-25691605641a4c7e859b7071a9841d1cd154b9027e6a58c20ec4cadafeaf47c9055f24dc8ea.msi
SSDEEP49152:bgF3Cpp6X/c2u3A9xUAtXGufZT5k0P1gR:bG3EgX/cdwX1GqZd1f24dc8ea.msi
domain-namemyappearinc[.]com
domain-nametumbleproperty[.]com
ipv4-addr185[.]190[.]24[.]103
MD550cc3a3bca96d7096c8118e838d9bc16dontsleep.exe
SHA-1b286b58ed32b6df4ecdb5df86d7d7d177bb7bfafdontsleep.exe
SHA-256f8cff7082a936912baf2124d42ed82403c75c87cb160553a7df862f8d81809eedontsleep.exe
SSDEEP3072:CdNxFQ6nlfxOk0HUF6G3sJrDKLSJ/g+n07fJ1yXNvl/wywaixw/zrvxt780nlkgm:Ym6nlf/yE3sJrGYo+07fJ1U5cwrrD83ldontsleep.exe
domain-namealtocloudzone[.]live
ipv4-addr77[.]73[.]133[.]84
ipv4-addr179[.]43[.]167[.]10
ipv4-addr5[.]44[.]42[.]20
domain-namegororama[.]com
domain-namesofteruplive[.]com
ipv4-addr94[.]232[.]41[.]105
ipv4-addr209[.]141[.]36[.]116
domain-namesombrat[.]com
ipv4-addr105[.]69[.]155[.]85
ipv4-addr98[.]143[.]70[.]147
ipv4-addr82[.]12[.]196[.]197
ipv4-addr81[.]184[.]181[.]215
ipv4-addr68[.]83[.]169[.]91
ipv4-addr61[.]166[.]221[.]46
ipv4-addr45[.]227[.]251[.]167
ipv4-addr42[.]189[.]12[.]36
ipv4-addr41[.]97[.]65[.]51
ipv4-addr41[.]251[.]121[.]35
ipv4-addr41[.]109[.]11[.]80
ipv4-addr41[.]107[.]77[.]67
ipv4-addr41[.]100[.]55[.]97
ipv4-addr197[.]94[.]67[.]207
ipv4-addr197[.]207[.]218[.]27
ipv4-addr197[.]207[.]181[.]147
ipv4-addr197[.]204[.]247[.]7
ipv4-addr197[.]158[.]89[.]85
ipv4-addr197[.]11[.]134[.]255
ipv4-addr196[.]70[.]77[.]11
ipv4-addr190[.]193[.]180[.]228
ipv4-addr186[.]64[.]67[.]6
ipv4-addr181[.]164[.]194[.]228
ipv4-addr181[.]141[.]3[.]126
ipv4-addr163[.]182[.]177[.]80
ipv4-addr148[.]213[.]109[.]165
ipv4-addr139[.]195[.]43[.]166
ipv4-addr134[.]35[.]9[.]209
ipv4-addr113[.]169[.]187[.]159
ipv4-addr105[.]158[.]118[.]241
ipv4-addr102[.]157[.]44[.]105
ipv4-addr186[.]86[.]212[.]138
ipv4-addr139[.]60[.]161[.]213
ipv4-addr45[.]8[.]158[.]104
ipv4-addr23[.]111[.]114[.]52
MD55cae01aea8ed390ce9bec17b6c1237e4NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-13a80a49efaac5d839400e4fb8f803243fb39a513NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SHA-25619896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
SSDEEP3072:n3vg+rJrkQVOUPrxLExK08A+MQ20AFHxH32Hdxkq5:n3vg+rOgOyrNEI3AxQUHKNSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023; NSudo.exe; SecuriteInfo.com.PUA.Tool.NSudo.1.21350.21023
ipv4-addr185[.]143[.]223[.]69
MD575b55bb34dac9d02740b9ad6b682036075b55bb34dac9d02740b9ad6b6820360
SHA-1a17c21b909c56d93d978014e63fb06926eaea8e775b55bb34dac9d02740b9ad6b6820360
SHA-256141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b6994475b55bb34dac9d02740b9ad6b6820360
SSDEEP3072:yDlGttzhA9HY4ZUFxPkwlmlGev5Vy16cEZ3:yDlGtEC1xn/O5r375b55bb34dac9d02740b9ad6b6820360
ipv4-addr5[.]188[.]86[.]195
ipv4-addr89[.]108[.]65[.]136

Provenance

Allegato ufficiale CISA · 2024-08-27T13:44:05Z

SHA-512: 5811af65630b0c6137ac9fb9aa7acf01ec6a2ee97a5f22fd96176cae49d1f8bb6ab62c7b109d8233679845faefaf51009906233423af0671ab9d2e776767194a

Source
CISA Cybersecurity Advisories
Publishing entity
CISA
Entity type
National authority
Area
North America · US
Original language
en · translation in preparation
Publication
27/08/2024 14:00
Sharing
TLP:CLEAR
MITRE ATT&CK
T1021, T1021.001, T1059, T1059.001, T1070, T1070.001, T1078, T1078.002, T1105, T1119, T1133, T1190, T1484.001, T1486, T1555.005, T1562, T1562.001, T1566, T1566.001, T1566.002, T1572, T1650
Classification
Critical
Group attributed by the source
Blacksuit (Royal)
Stated country
US

Action indicated by the source

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Official technical references

Open the original source