216.73.217.22

Muddled Libra

· Published 21/12/2025 00:53 · Modified 21/12/2025 00:53 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 00:53
Modified
21/12/2025 00:53
Updated at
21/12/2025 00:53
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 34 attack patterns (mitre), 2 malware, 4 sectors, 8 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (34)

  • T1078 uses
    Valid Accounts
  • T1102 uses
    Web Service
  • T1566 uses
    Phishing
  • T1082 uses
    System Information Discovery
  • T1059.001 uses
    PowerShell
  • T1003 uses
    OS Credential Dumping
  • T1021.002 uses
    SMB/Windows Admin Shares
  • T1036 uses
    Masquerading
  • T1087 uses
    Account Discovery
  • T1135 uses
    Network Share Discovery
  • T1518 uses
    Software Discovery
  • T1049 uses
    System Network Connections Discovery
  • T1021.001 uses
    Remote Desktop Protocol
  • T1195 uses
    Supply Chain Compromise
  • T1083 uses
    File and Directory Discovery
  • T1213 uses
    Data from Information Repositories
  • T1069 uses
    Permission Groups Discovery
  • T1133 uses
    External Remote Services
  • T1119 uses
    Automated Collection
  • T1114.001 uses
    Local Email Collection
  • T1562.004 uses
    Disable or Modify System Firewall
  • T1021 uses
    Remote Services
  • T1003.003 uses
    NTDS
  • T1482 uses
    Domain Trust Discovery
  • T1552.001 uses
    Credentials In Files
  • T1016 uses
    System Network Configuration Discovery
  • T1555 uses
    Credentials from Password Stores
  • T1106 uses
    Native API
  • T1012 uses
    Query Registry
  • T1018 uses
    Remote System Discovery
  • T1071.001 uses
    Web Protocols
  • T1204.002 uses
    Malicious File
  • T1105 uses
    Ingress Tool Transfer
  • T1089 uses

Malware (2)

  • Trojan:MSIL/RedLineStealer
  • RedLine Stealer uses
    Family
    Published 14/12/2024 07:04 · Modified 14/12/2024 07:04

Sectors (4)

  • BPO targets
  • Software Automation targets
  • Telecommunications targets
  • Technology targets

Indicators (8)

  • http://138.68.27.0 indicates
  • 996e68f2fe1c8bb091f34e9bf39fd34d95c3e21508def1f54098a1874bfb825e indicates
  • 6784e652f304bf8e43b42c29ad8dd146dd384fa9536b9c6640dfbc370c3e78de indicates
  • sean-referrals-commissions-electricity.trycloudflare.com indicates
  • 6e2c39d0c00a6a8eef33f9670f941a88c957d3c1e9496392beedc98af14269a2 indicates
  • http://159.223.238.0 indicates
  • 088f2aced9ed60c2ce853b065f57691403459e1e0d167891d6849e1b58228173 indicates
  • filebin.io indicates