Bryd infektionskæden: På sporet af den malware, der fører til ransomware-angreb

Målrettede ransomware-angreb sker ofte efter en indledende kompromittering. Hackerne forsøger at ramme offeret med en type malware, der giver hackerne mulighed for at få adgang til organisationens it-netværk. Når hackerne har adgang til netværket, kan malwaren bruges til at installere ransomware.

Kriminelle, der udfører målrettede angreb, samarbejder ofte med andre kriminelle. For eksempel kriminelle, der rammer tusindvis af ofre verden over gennem især phishing. Den indledende kompromittering af organisationens it-systemer sker derfor ofte med brug af malware, der bliver spredt gennem phishing-angreb.

Hackerne installerer ofte også yderligere malware og værktøjer i tiden fra den indledende kompromittering gennem phishing frem til installationen af ransomware. Denne trinvise installation af malware og værktøjer kaldes også for en infektionskæde.

CFCS udgiver derfor en liste med information til it-sikkerhedsansvarlige om ti malware-typer og værktøjer, der typisk bliver brugt i infektionskæden i målrettede ransomware-angreb. Et solidt kendskab til de malware vil gøre det muligt at opdage og standse angrebet tidligt i infektionskæden, inden systemerne bliver krypteret af ransomware.

Hvis organisationen konstaterer, at nogle af de nedenstående malware eller værktøjer findes på it-systemerne, anbefaler CFCS, at virksomheden tager kontakt til et professionelt it-sikkerhedsfirma. Et sikkerhedsfirma kan bistå med udrensning af netværk og efterfølgende sikre en styrket beskyttelse mod ransomware-angreb.

Malware og værktøj	Kan føre til ransomware-angreb med:
Gozi	REvil, Ryuk og Conti
Cobalt Strike	(Flere typer ransomware)
Emotet	Ryuk, Conti, Bitpaymer, Doppelpaymer (WastedLocker)
Trickbot	Ryuk og Conti
Bazar	Ryuk og Conti
Dridex	Bitpaymer, Doppelpaymer
Doppeldridex	Doppelpaymer
Silent Night (Zloader)	Bitpaymer (WastedLocker)
QBot	Egregor, Doppelpaymer, Megacortex, Prolock
SmokeBot	REvil

Indicators of Compromise tilhørende Gozi

CFCS har vedhæftet en liste over såkaldte Indicators of Compromise (IoC) for malwaren Gozi til denne nyhed fra samples af nyere dato. Listen er ikke udtømmende, men IoC’erne kan hjælpe myndigheder og virksomheder med at opdage visse typer af Gozi-infektioner i deres it-system. Der er tale om SHA256 hashes.

Bemærk, at de nævnte domæner er brugt af cyberkriminelle, og CFCS anbefaler derfor, at man ikke besøger disse uden tilstrækkelige it-sikkerhedsforanstaltninger.

Gozi malwaren var oprindeligt en simpel banktrojaner, men den har udviklet sig til en avanceret malware platform, der bruges af forskellige grupper af cyberkriminelle.

Kildekoden til malware er lækket mindst to gange, hvilket betyder, at der eksisterer flere varianter af malwaren.

Domains

Gozi

ystatistics[.]com
107.174.86[.]134
107.175.127[.]22

Downloader 1

saygoodbauy[.]cyou
lastsallways[.]cyou
foreversuccess[.]cyou
budnisjopper[.]cyou

Downloader 2

http://neectuded[.]com/8/forum.php
http://exieverhiltur[.]ru/8/forum.php
http://infludeplike[.]ru/8/forum.php

Hashes (SHA256)

Gozi

e11f77d43706c347eaaa19896b5f3edc2b02bf253394d74782dbe109ffc08540 042578bb308c5fdbf02d801323b885fc3ac0cdc8028f6a0f418bda0a850a7774 b065d0a1bb8357c6ee9ca1593370032a8fc888097c27d0d2920c9fbd109ef02c ba8592e7cded29ba1a01ce5508b4067555fda065b34b3e4658d398c89b84a6c5 801cda55b89fe25d00cf54094ecac1df9477c5f36bf5c33a7be6b0f8c8ab3545 4d9bc9bab30b2ba50347fafd58966cf706cc43539bca44a8a64c75941f90f955 ccdfa5aaaa045cecf5af64a6ac5deb8944eed5593826d4e081e7e7dc6ad33529 d5deb3459064a7c4145aa1bbb4b6b745bb068db3818d7351d4927868cbfc225a f6ed08a32ae7a72d5ca90236ab94e5645634647a9e29c35be78dd01465239082 9c9d01018c2f1398564fc9f2ceffb863b3af4d21a33e30b29e05e05195e7efb4 3f0b7b2da4d491a83fb164e5bc494bf47766af7a6b9de41fc739983cb031ad8a 7c000ad70a4652688d34ab0bb5e5b316f793336d04502f2d457a734d32c436de a913dca9f48d667e678140f3187797a93822d6befa63526e7d667e23eb081891 5db915f9649bded527be8f6f03eee6af9a7da4249868c01c588b5646715a15f3 e75984da903cb85acb1b61ecb0e23531b83eb3e1922e3b948081feb19c4d2275 f4940a930623df2a4bea13fab17f83f5272ec1bef6b0e0767da6e10eb8fab9c5 1b62238ad5ef85298f2b885bce010e45f2102e334b95b3d032cd4329abec8058 c5f21ad6b45b6504edec22829137d95509b0abe268de1f623842580dd8db20b9 7e03103872132c602cfbccad75ff1763a1071bc4e701523ecceab9b30757677c 866d32d0e109a1e182ca811eb0b9c0809155bfe0ce100e70ff21bb4afcd84dcf 046a4d124792edf245908a96d333ef7e3d65007b713d858fb8e83a3ff1d5124f ebe5809807299cf0ecfc45c66f4747175b37aef2db8fcd9ac42cc7dc74d9df17 48475f7808d704dce4bd07245a6ba2a82fe2d20b5cdcdd2839caaf0577bbc4f3 889d7d803f67bcb240a1a97f524ed472fc939659f7257b7c2b9fe20a28dfb6c7 ae291e3e2a966bd1d2197e4611ed5c9711933bb2f56b9b7a3036c88a3e0d2304 1d6c81a91f1e21accf7a418ab6e5a6efa79fc2502a01b2d84aaf8e781ebc1858 4670dfb824f28453234d455e11956dc1a1dc373ce7e927469de569f24c9d0bc4 142970b81f41ebb26a9c95582922a5f3850bdeb2cf86031175b9d09a8f0d0428 ef2614b1f2ef3fd61b6834a0ea202e1285690aec418cc57c52bda20849e412ba 34db8820671e20b0bd56e1f3a6f1a6591104fd259ad7024d531c0db2ec56fc9a 99ad59a13bb697aff8dbd747af36b614bad4a5f0d13636ef03a554d3c27f0fca 00c41ea3e22c768b1f9e04139107ace5fc3bb99dae8c697663b81c71a3842773 96981f079543aa38b6544ca7330126639011f1f4adcc3ccf7a9fc0cc6aedcedf 00a3b30cca5353ac8f88aaa93655225287e1ab1aedfc318dd52cf9c28c0e7283 ac926a0b63cdc6d28ef706842bed3a046430cac19726b499d55678cb146cabe4 c3e1f2321bc432f17beacfb35c689b70a02dfe0ab3e12bf1ff96ae24efd833ad cc48ea2ee287d37b169c682ecb27d7e6b9d797e802ac8e4649dcf45796d40471 9eef9993f32ad30c03ff2f09afcc92607fe08bafe73d39a131684e78ab31345b 52972c4635db76f8f04b53c57eeb61af3a6898604e6ca9d453a33af1063b1720 e1e6ab6536e82d330d61d51cd2a4589f2ffdb81b690e45ae59684622308f7383 12b7a4d2845a85a9677d5d689eaf20c700e256d957f72b96695b6cb547f2d89d 3b3fd5e0e3885a2dec528a445ff7e1076fa99ee2b061190abbec5efa213b5f9f 665cfc1bff585d2a499faaca8a8658c23df8f88161371d3708e016ebf4df4e8c bcc2c6ef7c7018c49a98d928f2b4e13e6316a3f1d235b4be44575bc3ad8dc9cc 7672c390ee5e0fc35368fe229dc40a50062dc63b8b955dfe3051adcd321d0c07 9ce7745db95f6e6fe29f8111fa710083e639b44bce99719480d170b0efc46901 32d33b5ac3bea112a01771bb0b71cf2432d4f39a81c663e6cc15e881151602fb 2eb885d38871654e44bb56f75244cc3c546c45587e141044c789492adf262eb7 43d9afc5871ea9819bbf6580a82cec0a3b6aaeb8e9ee814f9dbdd3503b505d72 6e4656366d12caf8273f0b690319cdb2f0ad962762989324bbac333821a560cf 92637ae7b78bcc59068b746353567401262dda0dd0261743a9655880c61bebbf a71000db11705cd1249686d04131eee3b8ea9a846548d0d6e1a217b637a94c32 c734430fd90072b0d0656cd8f4f46179e23467d5c4f9aafd29e9f4a2120fd89a aab289f67e0c4859048c0f28c38d18adcfd8a7e7cbd4968d450df49119aed714 8dbdfdac04500c1ac12890d3574ad5e811201781aeb715eb8d0845b729daef35 e6db76cc3615b9b73954f282ae1f8fce8beae092ba07e570c0606ac59735ddba 8b9915ec664699ce7db56430a4a01799b03901021361d85a7bbd99c4026d03d5 8e1a8eb3b12e5aadc1d4b2040a78deb8fb7f505386f0e76c7818d852702f4462 85293fa08fef0d6e74e20d6ee1c29dbe445764e181cd4ff9ff9567030dde2f18 66d71360d68a76290a9e5ad7e4001245a5c05d147ba5f8a84fb613b411de471e ba927c642e82386617e40db17981dc421bbb3a5a016b9590d81ed1e0a47dc1e2 7e7500c83f50c66dcc54a2884344aa26cc48082f1516757b3688b40196d98b07 382d673263873ce3e3105b3e33b6feb8fd918bcbe62d3c352995bb6a5cb06270 de5fb7918e61082333844bc38ff65f1a294bda80a710d679b5466493500f66d4 aaf547a6d3854d8e89dd46fca095c8c27d5c847764c459d428bae86d93ddc687 10a752211fa20e1a7664049e9d13cc00a41292396597c4eb93e7832cea095342 b6db2517a9646cba5c0cce611f13018c0f8aa007dc3c6ea0a6129a373a1d5b1d 948e12ce7574b4c45ef188da87791f99cc16b510dc7d561126706a259321732e 8462758541fc97abfb97de6ba3471ef047347251678c37fdfa8a12eefa005bf0 3b4cdd0f3d7fd83d1bff870009e48138838f5e6b609f6e6f16ab9462583f1b74 de3850b33fa77351ef95e15380caee6bf7bf924169778f2cf0d60d299f12cfcf e612096e2d1d3995dc66a6d85d0c0134cf146f966402c63ab141b12586e99857 831ade2dd9aa59b5ba2a8f1f7ec41afc5605b2971fba9ceab6b1115b9a842a74 eeb57dceabc1b35edb9d6f2fed19baf557fd966ef3ffa749e6730a2e1c426310 328fa2376e4a957a45e9375f745c839fb702b729350652c3920fac148d202033 15e2961ab63f403d8baa2d12d8c0574f0d006a9faf6b977b9af7757d9b02b5e2 feab9aac1ec65375011f1b959166ea7e21ee8bd0b1dfb1ef5d127077603d3720 8e897f53f1623a1530b74638d39c3d3ccadf01589cc32adebf8a717dcf9a56a9 25e4d42169de9094ce8f5b975b5b83cd4c759f73359fe803addb3ead810481d6 2eaf59862f6adb14791c2f55da1a7dd452933c12508b72922d738e72494a77e3 9813c39713dc83b01d29e79a137bde4fe647da8513bc19343417e756e843bbb7 53c227e95e25171069e365dd53b3b51732387216087fa4357015fa36af76445f 06471bf1934b886c2791703a81917c719e49e2644a5ca631375d731c07e4c325 5efb16eaceb7b564e6d7a53cc2e9106577a06dbee3a1bada6f5e51b78a3e8a79 ad8c39dd653efe7b18b41472d7f95fe9f707a430179c6e5eb9af197cc3235b03 953812080a9034a74a2697b31c36bfc19e1f423121e7abc1f5d37b676bb34e9a c70e8622be15c0b05316a2b78b4d7a50506cef23bc50b2d145918daf07552c0a a1dc06e6b2561eaa968c720385f9c44f46b13c27bb9a3440ff2faa0a2affa209 81ba1b9a77848cbbbd35bb4f7324ef896cda76e7654ea49d8f8faa05390029e5 571cdb9261d5b7b1697a4d92514297f19e5149549c45762dad4f2118f51eeb67 e80948f77c7aba6369dfc1516a3daa2424f7bdc36d3548bb5c2cf945559c48a3 aa8d8aae170026695bcdc5913320a2bf5029e49f58fa1955dfc45e1c1c6f80fb af4936e44459a0a89547faa4ec350fd72db838a876a9d9e0d08d916aee93c76e e06acd3a139d5aee1737775e83f28baf0927a84d9fb7962e7d2733d63531ef3a f74b9c58170bbb1717b77d315b853d0f1f225b1a796a940cdc6f4242062ee07c 6123086d99f09e7d9d9dbeaf244b0455f07b45e20ebd410dcc439d905a63eb9d b5dd9de6e7bd9d942cc637c1d8a6d165de7f09690747ecb0b230c1924f8944d0 2cc1c3bd97262adacd9db09f5f42c0e7203a64f5dc9701bef0affaa75c444bd1 d40994e618014f647e61dec2f0c2047fdc8f3cf44c658cabcc6e7b4143d220be ee7f17f0f5c89fcd2f15b8b82f548099082a7eb58b20506f01f1160888a5390a 7721248f6c524da20b6f51b54e486e5d58766b29dfc5664a3e7a692dd2eb6655 31ace401668e11cf7874612cc2ce412dcb2ea96428e14f55364cde9214826023 d22194b4cf2b034bf60e7dfd51f82abca51c9c337f6035fa60c2d5a9756f0126 c317c52e7b95e14ae974df6fe99df3e5c976b2186897f19fbef68add5dcc28ea 2e6b81e89bc2cf2c12cea241d62ae3c1329345cadcba78570ff8b1992711d58f 0ba820d8f87cdd69d3ca75759f0f62e21cd5384811dc96a9b3c88deb4ec3db42 95e6ec9c0f97bb20a82ee2aa3de751a16dc13991ac3ec0df33efcc4e1a782fb1 8e783e41ede5ecaa9dc6e71ba585aa63006f536d1da47591c5d537d8dab9bded 9d37bb153b724b87384b53704a4b26c0fda8493b70720e06324c8e0432c955ec 09d98ab0715befd3f124986335887f3dca3c4a9511e9b8a5e2a891bb2ec45ec2 9322d0a70ed91053be7b4b14afd75cf7acb2efc86a4dc5dc5676e58bdf8990b0 14910a8fd27c6aa33a9dbfad6d40b02f48b7b3ce9c600b3e98be55fe110972fc 7c1b70b148f745bcd3905fcb50711440feddf1966fd183cb75caeffb239970a9 aa89687db020ba5d8813ac58c1bcf7214b3fb7982fc58b0ba2888487ab67f7cd b85b235421aa1d65887e31cd1b66a575fa96468a5bb640833cdfd5c5bd622ac1 8fe52dc8ee4da86b1a968f47a810b0943275d693a5a54b28bf1407a06e047eb7 4b31c41e74c6fe57104e293d817bf7fc95881d7070fbed7c33c66c096d58f031 3858f2b9817b133e2c01a6de7d06a7d5315f141da2663e90a422622e57d2aaa6 1552ade0150c974d610051f578649733eddae030d7f35ef130da0017dcc435f0 c2bc32ffa9d91475563998a01461096b695971f5f1815e9905fcf72df558a009 99becad16c9410da32dd4456ed597dff6e3fc625e7606c8bfcc589091df3731d 81c936ab842e0b34f7146e50d259376059c76bdecf479b6ad1f87f30e777ce0a 8cdcb23c8a93cb9035c9dbcac47e45c1bacd3b1022fd6007a57152b9af2c7258 6a7e2b10fa4e94ce4b87f402c4b89c76955f98f588e3fdbe845f379a27db7a6d 50f460b0bd2e590ea34afcdc28062a43b95a32019cbea4f8e62e8db015703890 d42f5be36543f51a8f3e0198550f641d928e2787609265988df2dc69a52618be 04b88ef4a6a4d4bededf096c2eb3b9ff35fca3de78611c6169fbc1aedeb71df5 429cc71ebd7fe905f0998472ab60c4d77d681950bd3d58f00289d4baa5b69212 1f8cbcd1b0f8d26f9ef51cd7dd1868847c9bcd60b7bae964a14d290e7e9c60b1 d4cbf478ed760fdd34d8506d61b78897d618489eacddcc5c8a1d9cdc5f6cbb19 af01b8ece8f568f76bee77c812b47a4c46c7a969a76c3b69b3ffdc86d58654f7 ab05f4d3b5763124f787750b8bdef06160f3149661257fbdedb48e9eb6126e26 e873ed73bf066c6e71e247966761288796f4abd1af970541314f69a719cbd429 da0c9b673076a35e3997a5d2df20418fcac39766a288ce0de46cdee6ad50f02c 48e17979fe9d845779b8eab8a39e34368e4e47de08b4ea774598f945d0b984c4 e7d03b1b9bb92afa02881a9a75bea0f8b31e6026de0527bc1be7720f6480a997 f58ec20a0ea4a58d4fcbbdbada91f033e79d8bac7b98d261603f040426ae6f55 d9ed50086919e3881d7fa52f877e4850186f1dd42555712a61ef56b749e46130 e162e2cf36445a0f67b67926a0ba66656a26fdb125cc70c5b9b1b27882a2adf2 e3be30a42e44abb24280a35b3389376eeb1670f0f779a980c982429afa7f1f23 dfb87d5dc2593352f60fd68d62c10ea531a2ea9c3c41dae697943d44fa565704 b49deef4e458091a67d624f2142371b5af51c97abd4e6962103ebf8c14944b21 f5ec3960f4588e77e184624210ac2fb8f640f26484b56e59afaea399aefd8d52 bdb0b44f20ecd9f0d433c9e9129c45872501946d3fabdb24436b65163052444d 93c9584c577607dea18d668ff3c3333272783bf306d4c69a971be8e1ef47dab0 e691b1d064649ffe6a2ca755c0ca6f4e758037cdecfdc4d1a16c1eeb87c2a77b 45c7db889143d074bc4ec4b5306863dae4f7c0eeab67e8af7b8ff9cf978bebbe 868100e89185635478b58ffaac21bccb4093dae155478a82c0106440e46b5009 f48a670715ca9665571aadfcd2be21511ac2bf7d622bda27c2f00d7e96e2f45c 13d5ade420b7fca40d527afb3d0cfefb3aa5f4d2d03e8b4ed3478e52844c18ec 358f432043875b44215d528c9fa23387deac526a853dd5066dea61218cc87455 b462be0cbeb85f0bd411240deada18d804f8c03e8038aa81cc866aa134946561 98646998d0555e3af6d27770d29414c67ab7e527fba46630f339665c9b53e111 f0fc365aff36b8fba4d77e3b36d000fccfe4026df30af51de9ab4bd621c2dd34 697bd035b3383053a814ed17ede94d9b4f99dfed14075e4fbea8f7f891cf5711 f9a8948e3935780b5eb64658442f5cd8daf7d8e34eecabdb2f200266ab6a0dd1 a2901096c852324ee687a49a16779b4cc328ec8b972ec3b1f54bc9d2bef6e8b5 125e763b9240e1f24c955ed515c86912621018f6f8181807413c5d4438cdba84 50654f2bcf7fe027caee7de1dd355dc8ef1c66ec5cccc9228032df6bc46aa9cd 9525d0e5e753711b906c15bf71937693fa1264559323ff77f28d3d675b2a0176 6cbb5c1ea5b1c4379edc644db681cfb9a07cfb432b663a192d60bf161d597d8d 4f3ea10ebf1644f17229d22aabec619965675905660c1c20270c5dddec915a7d 4aa9f1601d63066e314e3f840ebeef04ba170946875fcdcfc3b4abf3b705450a 8b42f338d8b6f225ec102805f09d125553ce1f1cd59ac7197bec3c934067f36c 6965c8ff1fb5039b2d55667ab99885683e7c89d22bd87edb1815663e99d2c7a5 9d62ad928975de4f48ac150aef4f6e84a1905f656a928ae7631b779f9477b627 2ce8840531ea71103e97d48c164ab1d62ba44daf61f9d0df9b1e31caa8a224e3 05d34e27785f260f80ffdad2aa37f9c7f6d36cf30555cdf4f695af7624084edd 37a363d76726223816c59a008660a2f33f3fc7e727878df6bdb9fbcc0164855c 35d857ca8ca006384efd847d5a9dc09a33a0d06f3524166e871d1ae61a5695d5 ae4501aaa015351095aa2777d75263751d7752eae17a7836e3d936a418021c0c eab700c0052e068e26654d1dcbb0f50cfa8e12349e1c1a859775004f6e3d1b17 403f3599083d1eefb9ab4470cafe1d2d9850ae04444fa39c583a37ef510bcfc0 3980e576d3afa5be70e8f42d25049243485eb2dfa173455a87ec0ee3935cbac6 37a25293ab997705a2b79697ef2634fc7eeceffe4faaea37a897ccea7b0b5c26 067109ae9b1a2492f9bcc92761ffb2da4fabcf3513630d514ebe467c5cf7bb6b 4e400c537d598af1d20f01dab9ad5011ccb5bc2edc1731366f275ac2eb505195 cf2670916da0f375c63425c00ccf7238aa53898a1c453c42d3aa02c55c072cc8 f69aea13fa5b7a6e3db28440e005849886991c87c9d85f050886cecc695397df 733bfe970de47e6d41e63ccccbc94990fbeeb63ab2e1c23aaac49642ebb29550 ba08560328cb51bf17e0830464f609acbfee35918cddb6d6bcaaa301b4f33c44 03a549d73c6b0e8f595f6f4da97a3e7aa4eeae8643a08a2f7d89fd3abc3d017a 5eb8551fff94dbcd7821d7bc8761e9714f7bbe9d3c4f4369339096208b444eec fd0a4ef2d045bbfda30cb41886f0d26a9cd501da26d7fdc3f0fe2aa6b77ea42d aba43789f6557cdd0011224d122707eaed9c606a1bfe952bb50b9412572707a2 22c1b047c4ba7d922b031616d065fc0a836e13d09f6e5cf4ee7eec713adb129f 672b159d27a4a6386117989888f0977d526c05f9760a9f8763bdc2d535ab570e 9f812500dbcde5b14c77f4cb303e4c1ee05583bf51d9eabe7f0d6ed076e0762e 42832c58bc639667c2f9f47b3a380a9e4aa768d01cd763c6d8c318b2669d24f1 70c358e5a8a640fae483953b7d1c134d0429e50cd7eb8bcd466265911d6469ee 6eabc2fb5fc095270b11093557b573cc73c5cf579762fb863500fc6eafe00d7d 26eabcb9851e1e3837767b65c7d795df47f45ebee920d44273f0685e9569788f 3bb7fb86671680974892e8785accfe5dc393c28473e74dd93bcc1b6a522db86f a06d8d1cfe1dea9a70fb89721c0097ee3da964ba7f62d4161bfc7bb80abf23ff c3c54bcd34e7233040075ef8bd10c984a94ec505243d3be90ca3e70bc9f317ce 1b7cf685524b1e9e88bbc4e6d87a294878860d81b4b7aa711cb37f230158cfad 1ddbfb0bea1eaa49c24e17f6ccaff8861897671f2049971be278bd4e2b21d7a1 7c6f80c608efbbbc8dbe5c549bdb42f8296d7b140d6e7a02cbe8dadec880f435 e11c9777c0e61634abd095563f7274f5db4136024f403db6e5d5c02a640c985b 534b2f9444535f447f615af0cdaad3c35df43d83d07487cdc187f06dbd0d2327 af3b60c9ee37e7e82c3a1cde3b5e7d3e5a7b63f122cf91d8c27003567f9d045d b1ed0fcf18b1cd88692a8fd4a2a99a8d914d59fcca327bda4846d31ce3d2be10 878874af7d5b0b087874e4dbcb599ae59cf92eafb04116d0ea26d06fd3221449 69035916284a980474dccdb4a446843fd7a1962da502ee12064f87de49348be0 c11989e2581f45c9ef7c32c333fa62d27a120a9a9cd950c4cd84a1b8c5802d61 9d282a36a77eedb2f63b850d016921d9fdd3486cf93555a6f143f8b742e5fd52 abc86f27316e7990fd09815411ec18103a4eb0bdd8da3cbbeb351f6020380bc5 c84df0836747312644a895a3fb2a26f592ae5fc469db31b096719cc1548f4f5b 6ea26187dc7205eef69996a5bd2f307925f089c0e976dcb74e7771b12439940e 62f7284c93a5cfc4eb9715cddf93f5079ac6d1cb4071a197a1fcfb2877789f3b c59099c550072f1beee17694dfcc316d7840e31766c9b227f382cad1bc2c8348 dd892e260e46b710ed329d5874f32446c542be2c9fcb88ad48052c755dc58104 cc2a8d8f64669dbb796e6abc326521f6df3c7244b5062553df674466285b5d63 ca36f224dfb844cae2da815d4b3f9ff79162035a61db8a95361d78b953eb221d 9676f77e354e4e6a9578224a461b70c63dae0a8f7b7d75425c7f956b42d1202a 81bc2e383d35080c1cbee411596de2e750ed80eba5090d0ea0a4d78c2dea4e6b e0a6dee2aa897b2d9481e9e78605bbc81ed5a11dfc515d3bc167ac2f65cdc535 0ab30d22474e83bf48f08af22c9ceced3d0c84e27176ffda59fbea8f83b07695 d376ee8f010eb164347de9287d0ead19460009534dca610a814321d1ede741db b6cb9522d2d561ef058d90ffbcc0c1c82331f22e61f2c005a43b404dc537b54a df8ae69746a9759e56e4c28df5414c881fd3abb785def92bc40a44cbd3f38c98 55d342323c0a1cf7d08cb49e350525b9779d43b6c989fbb45c8b69bdce6b63c8 3462fef894d88e0c1c36af1a99a85db8341eaa6c03de054a4c72d6ca3f86b0a8 bef46a3fb14e8d21c020468f558a4c2eb62fa1d0dd24a0f0a94c95efe2ef45df 278d8de6b6c83df11faae6ea3070f1c6403de4c53d5f0bd9fa3b303309538294 468170c483cffa638d493e184e166ba353d64748fabf2fe22a35833a82b00448 1dfffd73dd4932c8bfe6e69a0427d92f2b712eefe821835f2f43c5ecfa0f531a d579128336a0a27b5f80edd7078457707d2f5f36c52903240a5010b956459a35 0a980f1b918f3d04554618418930eff4a1a8a96384ac9f9a6b4f0780ae5d640e 4ad1407ff8626b8321fceaf1c3837224fb7e457ca3cd9ff4619df51eafc7775c 8c8abd3c6c58980eec24aed53b6fa6900b64e65cecca52f8bfbb2ea4c867ebae ba42ac391a44045a234461d18de66845cc711980fea9ca11e711e261eb909c17 88a46d2a8b0e22ce2459941cea629d787b91d5bfe01abdb6ab224061eafd69f8 997393e4eeee8a73b482c63644c47114bd8a1d5268b80618bc4f567b5d891591 309ed4bbdbb5fb129cf04bb3b40748c938c65562061547719d0c4bd6a3c9f685 d942b1d9555e5fcff3d3cef50413329e34de6caf27373f36807a85ab72804346 ac92f42fdfca236ac99656e54368df406b033738b20a73b6e7a843fda33c2bb4 d7c737d1886450f186aa4baf7b9091235c69b5f154f9b8045357ed4f3d9e3624 0c2df70335fb61e1f41ed1be31dbc9529effa99ced1d82373ba744474386ea61 f6b58a827113a20ea6b18685d3feb0cf71bb8081044c2f5c88d03100b4a95075 5bfa9da29594238c0d91aa3ee03ff8091eaef9e83be31be43dc3bf9916ca9849 56f61dee70a8013b2761c6b0eca1c949ac087885e938b2753f80d0c3de255f38 d7c432911725e13f394e4699edae9cb1477dff291d519a36dfcc31d021920d57 5537fedf498a86b899c8799ac80795a05c31ef0eec3fdaf5ad7ee53f518ae514 93277514be2ecbfcb8407dba9b086c356f6c1281e5e6d71ad77ff861c61ef7c3 9af17d755c260b9e00396d88ab96b9e470fadd9851eaaf37515ab6fb18a4f29c 341905f797fec6ef3b6e5a0cdf678bb57b954d958b68cf4b4aecbc88e369a1ce a58e89fc3e2be9fe9c752bb772cb81601c12c75f690507b5948461360975102a ba575b08df55c22486c35f4a8a54f501a40c182a9a42db1645d3099bc8d86aef adf22a36a882f2c0ff5fbd0d3d3e292b061e1991c986dc5cb05da5fdfbcd4b6c 79e92660a65b7a5b843532b98d959d2fab933109fb3a6e409bce10c8a4df448c e8f9105c4d18af5ee731dfe3b04c7c8726b4e4f846da886163fe64060e9ba37b d9fbdcaccbe8288faa1a434d26208d45c0adc48eb55396ac4530c6dcb97bf0e9 4964e783ee35a48567d752b4795c1d037f1b8db52a01650503f20a28f07737dd 5029b8c5fc603ba93f8bed6c9d6e5fbd8f5d94d079e1077facb0de2e26087702 a021cf62ff6beca4cab761e9e2975485d361613f49953b48786d536576f78af8 0e6016f920fdf4f47c92b80c6a1445075a38e240dc0cbe919d090ec7549883fd 25c09d7ebbb7fd5fbdbfc0104753cdcdaabfc2daba6e0758c0f495db21841196 158df96a34ea72a6fe0ed2130ee1fbd999596f48063b3ed1c7752d817f5aa2ef 1208e1ab8751946148f07cb2ddd9ee81cdb537dbcd899984a74d9f1ab60c7e02 c2fd93c16a9b96f8b4bbb168a80c09efc293e97e485ebdb2deda44eacc0f4d01 ee5d6c4a141d7ee5b261b1b3e38fb20e16336f7bc34eaac8810896824a3320f9 90f4f1ba31ad6c889a1ccbd37dec8f76d533255672a5744cbfd0e3d20de6a9a2 075e8cbb368d96b2676740114387fae2863d223200d0fb758195404e439e187f dfdbd0653ff0677f19dc51e70a454fc474865cc41a49e78128aca06b0affe70a 00a57a02e1d3356f0e818b5dc0b35a32c21f1384d7ea1ca88b5fcf8f9a54a0cd 8e90ddd4554e4d45ffac3bbf01383c0cb09b6d918ecc4ef9959a822704d8cc46 866a66642ebdd3e2714daf05d784bf25901a6f1fbc033279ce4bd642d6992d78 8b9fef41beccfa1153c66d7e93781f298bdddee3db2aabc691dfcf7416f28116 fc465b33b50b4fb001781d1eba943385d539334e5e614e1a8c95e43b1cd2591e 38c551f14b39cb8119d961561e807671cc774feed3fd8c4d55aad17c5b9ada7f 9c14ddf24c341c2ea8f1d06de3ed6aa46082df0aff8e6fbddf751d4987ec055c dea43d5f6ce27f5364b1911206f42d8ed2b2af51259cb8029d4ccbe3becfd9a6 7cf50eaac16559cb2b40a38330ad791a1779ea2da0578a6fd2ef7adef1475378 4c0a248d99c8f5af622873f9d056b69531b7c68cb090e2ca491a7c2e414b4e18 df8326ba6dcdf04377d8470f78734365b23fbbd5bcd82521448de7c590642858 90fa22d01a401565826210c964031917a56c5aa2cdfb4c498bb64b9c0784e2ff 2464aa7b4f9b03603d46c6bf4cc225bbc238592e7a12c52594c1d5d8a1ef3e39 8ae27ce3c343a5dc4f5f42a6c0abea420aba110d66235e56814d03e992c6134e 8e7b6ffa64cd7b22346a1a1ebe7b72de960aa38180047f07f8b6ed491e2bbeeb 0737bff1c88e2c67e98a55994b9f855aeaa9a0ba72d5aef047b2250afcb6e567 2d9042e9844cfad13945bfd8480aefd9afbcca828998e6f65181b77cf93d7e33 7ca733ebb2fc1c0fc99bb61736c8c5a2b619110ef0ce8119207157247ecee478 89c0ff2a9bcbc1e2f6054bfbc9f9325e3b02ee2547ed71fc5803d1889f0f642b 57567429d77435fdf8fa720a3258933b850da2a23237e8f33b0c8676f2d73f8b

Downloader 1

638e6172e2e7deafc7698629aa30bb9b829802d0e58a0cac006525b9a0b45ab7 a18729b17111e128587b432212d7b50e9694071cc8838fe95bfd48d7811cce66 3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963

Downloader 2

be2e214e37d5e54cbc7ec3e806083112abaaeb5b223714489c237cca53ef1361 1fcb7c8ea060bfddfc52e544cb842d7b733018840a2584c9005f47faa7f47185 db3983af19882c22ae3e5b8afaab09ff5e459abf6e6bc0435a7f4fefde992b80 293d8e49687debac46ec1a4102b0d84df1ecb837ebe1e131e0362238c4063ff8

Pressekontakt

FE presse

Adresse

Kastellet 30
2100 København Ø.
E-mail

FEkommunikation@fe-ddis.dk
Pressevagt

+45 2016 0593

Cybertruslen 2023

Cyberforsvar der virker

Cybertruslen 2023

Cyberforsvar der virker

Bryd infektionskæden: På sporet af den malware, der fører til ransomware-angreb

Indicators of Compromise tilhørende Gozi

Domains

Hashes (SHA256)

Pressekontakt

Adresse

E-mail

Pressevagt

Styrelser og myndigheder under Forsvarsministeriet

Cybertruslen 2023

Cyberforsvar der virker

Cybertruslen 2023

Cyberforsvar der virker

Bryd infektionskæden: På sporet af den malware, der fører til ransomware-angreb

Indicators of Compromise tilhørende Gozi

Domains

Hashes (SHA256)

Pressekontakt

Adresse

E-mail

Pressevagt

Anatomien af målrettede ransomware-angreb

Trusselsvurdering: Digitale gidseltagere på storvildtjagt

Drømmer cyberkriminelle om tillidsfulde relationer?

Styrelser og myndigheder under Forsvarsministeriet

Nødvendige

Intern statistik

Tredjeparts