{
  "name": "Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity",
  "slug": "malicious-inauthentic-falcon-crash-reporter-installer-distributed-to-german-entity",
  "description": "On July 24, 2024, CrowdStrike Intelligence identified an unattributed spearphishing attempt delivering an inauthentic installer impersonating CrowdStrike's Crash Reporter through a website targeting a German entity. The site utilized JavaScript obfuscation to deliver the malicious installer, which contained CrowdStrike branding, German localization, and a password requirement. The actor employed anti-forensic techniques like subdomain registration and timestomping, indicating targeted, operational security-conscious behavior.",
  "published": "2024-07-31T08:47:19+00:00",
  "created_at": "2024-07-31T08:47:19+00:00",
  "modified_at": "2024-07-31T08:59:47+00:00",
  "created_at_opencti": "2024-07-31T08:47:19+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-31",
    "impersonation",
    "installer",
    "obfuscation",
    "spearphishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "a7516a15e1857996373191795c79244c8f5c8deb1f17ba5dbadeac28e18ec1c7"
      },
      {
        "id": "",
        "name": "99bb0f05fd135218a5c4b8cac42e58274086b543d001d7227c8f6a2b7722f425"
      },
      {
        "id": "",
        "name": "80304da1e333ed581378797ad8b0b8d81a8ac5928b83423702f0de30f1616225"
      },
      {
        "id": "",
        "name": "82ef869e8f7accde731f8c289f19436347a30af1d53c8f61bde5bac8bc91ad1a"
      },
      {
        "id": "",
        "name": "41143b2e4bbb9279ba0bbb375748530cc4887cc965967e5c0cc9a39dc44937d6"
      }
    ],
    "attack_patterns": [
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Germany"
      }
    ]
  },
  "external_refs": [
    "https://www.crowdstrike.com/blog/malicious-inauthentic-falcon-crash-reporter-installer-spearphishing/",
    "https://otx.alienvault.com/pulse/66aa163799038ab1caf293da"
  ]
}