360 ATA Cloud

📦 360沙箱云 / 360 ATA Cloud (with 360 HuntingZero Lab) - advanced threat analysis sandbox, insight into each behaviour of malwares!

[Leeqwind @Leeqwind]

New office vulnerability CVE-2023-33162 (only vuln, no exp & payload) caught by @360sandboxcloud and 360HuntingZeroLab 👉 https://t.co/CWYeSpyLNX 👉 https://t.co/lya9Ms51hS

[360 ATA Cloud @360atacloud]

A new out-of-bounds read vulnerability in winmm.dll of Windows, found by @360sandboxcloud , won't be fixed. https://t.co/wjoEhX4h2W

[360 ATA Cloud @360atacloud]

view report: https://t.co/DBHhHMZIDL

[souiten_4t_FuYingL4b @souiten]

Suspect #APT #maldoc with #QuasarRAT attacking Korea, still active

file:
e0cf0881de0fe35732bb02c1f4df02a3
"협의이혼의사확인신청서"
(Application for Confirmation of Intent to Divorce by Agreement)

[1/N]

[360 ATA Cloud @360atacloud]

view report: https://t.co/T4sp9HjjDi

[Kimberly @StopMalvertisin]

#Kimsuky #APT Remote Template

temp.dotm
d382cc7f10fdaec150184941b68cf39e

Decoy: http://eum-it[.co.kr/gnuboard4/bbs/img/upload/temp.docx
http://eum-it[.co.kr/gnuboard4/bbs/img/upload/list.php?query=1

[360 ATA Cloud @360atacloud]

view the analysis report in #360sandboxcloud 👉 https://t.co/rY2AK0eM1Y

[m4n0w4r @kienbigmummy]

🔥Maldoc sample spreads #LokiBot was submitted to VT from VN!!
📄hash:e1d6c159c4e0b5d404d763846914c1b33b26591fd4100da3235335889f6a9407
IOCs:
👹http://103[.]167.92.45/kung/GG18.exe
���http://171[.]22.30.164/kung/five/fre.php

[360 ATA Cloud @360atacloud]

最新 RTF RCE 漏洞 CVE-2023-21716 分析 👉 #360沙箱云 #360sandboxcloud https://t.co/WHeTJAhoCF
https://t.co/VaDEVaUMSY
https://t.co/LZqhPWptXE

[360 ATA Cloud @360atacloud]

View it in 360 Sandbox Cloud 👉 https://t.co/SvyHTMu0a0

[Kimberly @StopMalvertisin]

#BITTER #APT

Patches updates.rar
dcc7bb850d931e3da18f3868a6a7c092

Patches updates.chm
e8ef56d0f67f44eb433a6aaa57abe991

https://lbhandlesystem[.]com/Axiom/set.php?h=%computername%*%username%

Scheduled Task: "MicrosoftTask"

[360 ATA Cloud @360atacloud]

View it in 360 Sandbox Cloud:
https://t.co/7cDr1jzstH

[m4n0w4r @kienbigmummy]

🔥An email sample related to VN spreads #Lokibot
✉️hash:cb87ec5825659ec1919ac6ffdec4b88e4336c0be420c726ceab1917689fdd161
IOCs:
☠️107[.]175.212.18
🌐http://185[.]246.220.60/shen/five/fre.php

[360 ATA Cloud @360atacloud]

沙箱云网站现已升级 Android 检测功能 | Sandbox cloud website has upgraded Android detection!
https://t.co/V3HwkBEj6Y

[360 ATA Cloud @360atacloud]

360沙箱云新版“威胁追踪”页面已上线，欢迎体验！ | The new "Threat Tracking" page of 360 Sandbox Cloud has arrived. Welcome to experience!
https://t.co/nOcl03FGVx

[360 ATA Cloud @360atacloud]

👉https://t.co/QusmjBG7gP #360sandboxcloud #ata

[360 ATA Cloud @360atacloud]

360 沙箱云 2.0 版本升级 https://t.co/KsC4qBv6SM

[360 ATA Cloud @360atacloud]

360沙箱云 2.0 版已发布！ | 360 Sandbox Cloud v2.0 has arrived!
https://t.co/QusmjBG7gP

[360 ATA Cloud @360atacloud]

The detection from 360 Sandbox Cloud: https://t.co/U75rTxfkvV

[zhixiang hao @HaoZhixiang]

The Kimsuky APT group used malicious 법제처국가법령정보센터.docx to attack South Korea
vba->powershell->IOC
md5 1b690440b54c2a830958fe54ad34e3c7
IOC
yundy+mypressonline+com/[dy]/yu[.]txt no longer accessible
@MalwareTechBlog @malwrhunterteam @DynamicAnalysis @mstoned7

[360 ATA Cloud @360atacloud]

There is no prompt for the attack message sent by another email address involved.

[360 ATA Cloud @360atacloud]

The attack email involved in the worm mentioned in the last article has been warned tagged by a mail platform⚠️. But at present it seems that the sender's email should only be added to the alarm list, not based on the body of the email, attachments and other characteristics.

[360 ATA Cloud @360atacloud]

上次文章里提到的那个蠕虫病毒涉及到的攻击邮件已经被某邮箱平台添加了警告标记⚠️。不过目前看来应该只是把发件人邮箱地址加入了告警列表，而不是根据邮件正文、附件之类的特征来识别。因为涉及的另一个邮箱地址发的攻击邮件还没有任何提示。

[360 ATA Cloud @360atacloud]

记一起通过邮件传播的恶意程序攻击 | A malware attack spread by mail
https://t.co/6CU1uR2DJd

[360 ATA Cloud @360atacloud]

The new version is coming soon... #360sandboxcloud

[360 ATA Cloud @360atacloud]

The new version is coming soon... #360sandboxcloud