{
  "name": "VayGren and Mr.Burns: Strong Ties in Finance",
  "slug": "vaygren-and-mrburns-strong-ties-in-finance",
  "description": "F.A.C.C.T experts analyzed the tools and connections of cybercriminals attacking Russian accountants. An analysis of the infection chain of the VasyGrek attacker, his forum activity and connection with the malware developer Mr.Burns is presented. The history of Mr.Burns, starting in 2010, is given, as well as a description of the current version of the BurnsRAT malware, sold on forums and used in attacks on Russian companies.",
  "published": "2024-07-10T07:49:09+00:00",
  "created_at": "2024-07-10T07:49:09+00:00",
  "modified_at": "2024-07-10T08:18:08+00:00",
  "created_at_opencti": "2024-07-10T07:49:09+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-10",
    "ave maria",
    "burnsrat",
    "metastealer",
    "purecrypter",
    "purelogs",
    "redline stealer",
    "teamviewer",
    "warzonerat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "95.217.100.156"
      },
      {
        "id": "",
        "name": "91.246.41.200"
      },
      {
        "id": "",
        "name": "181.215.235.180"
      },
      {
        "id": "",
        "name": "146.185.195.28"
      },
      {
        "id": "",
        "name": "https://xak.guru/threads/23230/"
      },
      {
        "id": "",
        "name": "https://web-whatsap.online/kopiya_skrinchot_1C.pdf.rar"
      },
      {
        "id": "",
        "name": "https://trianglimsk.ru/optata.rar."
      },
      {
        "id": "",
        "name": "https://trianglimsk.ru/_Release.exe"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Zofrj.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Xzkxso.mp3"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Wllyqo.mp4"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Wfbitmtjlzd.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Vgnaahn.mp3"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Vfqegoe.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Tvmjmv.mp4"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Seancczvbv.wav"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Qydultut.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Oguqs.mp4"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Nsvozql.mp4"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Ljncj.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Fxeiroo.mp3"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Fhzcvdiuu.wav"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Dscxqvi.mp4"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Dzyhmzjdtpz.wav"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Cvevg.mp3"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Xkwjbhibh.dat"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Awdiaz.pdf"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Qzvldxefss.mp4"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Qxudsj.mp4"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Lexhwif.pdf"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Kjpdz.mp4"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Hyfhtwkc.mp3"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Awrxzkoc.mp3"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Asvchn.wav"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/panel/uploads/Ahjhcuubue.mp3"
      },
      {
        "id": "",
        "name": "https://saitraif.ru/22012024BUILD.exe"
      },
      {
        "id": "",
        "name": "https://downlod-bussines.ru/panel/uploads/Yppohxqf.vdf"
      },
      {
        "id": "",
        "name": "https://downlod-bussines.ru/koriya_akt_upd_1C.PDF.rar"
      },
      {
        "id": "",
        "name": "https://doc2024.ru/2024bldrms.exe"
      },
      {
        "id": "",
        "name": "https://doc-1c.fun/panel/uploads/Hnxuy.vdf"
      },
      {
        "id": "",
        "name": "https://bussines-raff.fun/MetaKript.exe"
      },
      {
        "id": "",
        "name": "https://bussines-raff.fun/BLD.exe"
      },
      {
        "id": "",
        "name": "https://bussines-raff.fun/22012024BUILD.exe"
      },
      {
        "id": "",
        "name": "http://vip23newtop.fun/framework/."
      },
      {
        "id": "",
        "name": "http://91.246.41.200:7702"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:58003"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:58002"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:58001"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:56003"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:56002"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:56001"
      },
      {
        "id": "",
        "name": "http://91.246.41.200:5554"
      },
      {
        "id": "",
        "name": "http://360mediashare.com/2/command.php."
      },
      {
        "id": "",
        "name": "http://360mediashare.com/2/command.php"
      },
      {
        "id": "",
        "name": "http://360mediashare.com/1/command.php"
      },
      {
        "id": "",
        "name": "http://vip22gr.ru/framework/"
      },
      {
        "id": "",
        "name": "https://sk-krona.fun/panel/uploads/Etqslnpm.mp4"
      },
      {
        "id": "",
        "name": "oplata.pdf.com"
      },
      {
        "id": "",
        "name": "doc20032024.pdf.com"
      },
      {
        "id": "",
        "name": "2024.pdf.com"
      },
      {
        "id": "",
        "name": "1c.pdf.com"
      },
      {
        "id": "",
        "name": "xaker.name"
      },
      {
        "id": "",
        "name": "windowsactivate.link"
      },
      {
        "id": "",
        "name": "vip23newtop.fun"
      },
      {
        "id": "",
        "name": "vip22gr.ru"
      },
      {
        "id": "",
        "name": "trianglimsk.ru"
      },
      {
        "id": "",
        "name": "sk-krona.fun"
      },
      {
        "id": "",
        "name": "saitraif.ru"
      },
      {
        "id": "",
        "name": "prologic.su"
      },
      {
        "id": "",
        "name": "office360share.com"
      },
      {
        "id": "",
        "name": "office360.icu"
      },
      {
        "id": "",
        "name": "natgeo.pro"
      },
      {
        "id": "",
        "name": "mts2015stm.ru"
      },
      {
        "id": "",
        "name": "msupdate.icu"
      },
      {
        "id": "",
        "name": "liveupdate.online"
      },
      {
        "id": "",
        "name": "downlod-bussines.ru"
      },
      {
        "id": "",
        "name": "doc2024.ru"
      },
      {
        "id": "",
        "name": "doc-1c.fun"
      },
      {
        "id": "",
        "name": "bussines-raff.fun"
      },
      {
        "id": "",
        "name": "98347r483df2grg5tg.com"
      },
      {
        "id": "",
        "name": "360mediashare.com"
      },
      {
        "id": "",
        "name": "047856232.com"
      },
      {
        "id": "",
        "name": "sonofabitch@ua.fm"
      },
      {
        "id": "",
        "name": "mrburns@exploit.im"
      },
      {
        "id": "",
        "name": "ebdce7eae3a77ed05ed6279c46a8be8c560085f82ce0f9e4de0ad8c700c16fc4"
      },
      {
        "id": "",
        "name": "f7878a67c6de2ff26c79ab890e4a60b76c67a7583c6a24bd96cd93a5f4a0e0aa"
      },
      {
        "id": "",
        "name": "e4a91db9e43655931fd3926ec00dbe8a063fbe0d3f0af7d902fd3b9d8281fb3d"
      },
      {
        "id": "",
        "name": "e360674d2abf0bea085d01bc3595e19efb3ac061ab8090a32d0c579c621c46f6"
      },
      {
        "id": "",
        "name": "d79d130aa4f0b207e741909c45be613a1e3720cb82a0578012cc508c28da6bad"
      },
      {
        "id": "",
        "name": "c3b30120feef022d552f85b780d4c988ee82bc07e6b5948db5d32e59d44fa704"
      },
      {
        "id": "",
        "name": "c2f97483f8a5a96fa39e8bd3d3458093ac527a8c8efd662e838d95a9bc2354fb"
      },
      {
        "id": "",
        "name": "bf9fc94905d75ccf3640d35899d533e50c7ba8bdce396443ae2d0507657a9e81"
      },
      {
        "id": "",
        "name": "bbad7c6e8f0d7ae94941257e7ece4d2b144aad56e25760c8876b808f3e8420e6"
      },
      {
        "id": "",
        "name": "ba629f7ee519379f1a5a8a4683ee9a48d1b0996268bfaf1162e4bf0f2b792b77"
      },
      {
        "id": "",
        "name": "b2193cb3f8bd13c8a5769d5ce499a36b9c44e2eb2800bcdf22320525beaf9586"
      },
      {
        "id": "",
        "name": "af8018b310bf030f6feca0f6f23d3e65f8926114d7cd493573badae24f5da0d1"
      },
      {
        "id": "",
        "name": "ae9df2b98a9e5561c749cc96a4e24f9d5bb0451889a3924fd7ed73436466495f"
      },
      {
        "id": "",
        "name": "ab90f80eee37e16cb3c94f524e2fde3fe13669386512ea36b4ad6ac4d9fbf773"
      },
      {
        "id": "",
        "name": "a5eff95e877e7e5e1b8a57e3169cb6f545ae353ed1908840dabb9554ff001500"
      },
      {
        "id": "",
        "name": "950bdf0842e513180c42ab3809e57c0779456c51a53e41ce8e833ed36880230e"
      },
      {
        "id": "",
        "name": "92d65e200d729beac212563a7559fbdc657a4832d462e02dab4d937b5571983c"
      },
      {
        "id": "",
        "name": "90e6c0aed978271769f4fface9a27edbb8d72cd463cfd57b443710aa703a1f98"
      },
      {
        "id": "",
        "name": "8e379068eb7e9f9e5635531526dacdc03bf505e67775dd186edba27b33a93805"
      },
      {
        "id": "",
        "name": "8b7e5a040f0e468eb540211a3ac73dadd6628177dc09eaff06bfbce10c6eeab9"
      },
      {
        "id": "",
        "name": "892a92ce83ed1c9e67c8f7ab0120d1f28e1dfd3a93146da3fde6e9226e22222b"
      },
      {
        "id": "",
        "name": "7da756b08230bd426defeaea35588b899057228ac19f3a21625582038e405c76"
      },
      {
        "id": "",
        "name": "7a79bb8b4c55f11b463efee0c8cbfaf24c85daac04b67f4f4c25f6851dda57df"
      },
      {
        "id": "",
        "name": "7930b4271172eb69e63349282bfe62a111a6e0a8bc8b23ae8729ab6be006ecf5"
      },
      {
        "id": "",
        "name": "702db5ce9f9ce7af433146796263c795dfdf065b10e914bc54fd23af5d33e793"
      },
      {
        "id": "",
        "name": "6e463e3aafb12ec1fd7ff347038b3df15a93b3b2c506c9d670498b0937d6dce7"
      },
      {
        "id": "",
        "name": "6a69e0ebb331aa21614ccc0c4028b5cde242f0710300fe7b441b2017c71a8e16"
      },
      {
        "id": "",
        "name": "5f31759d1ac833df5b990b436dabb88cf3e85ba7495440a62364723bc8490907"
      },
      {
        "id": "",
        "name": "5170542754aaa8a8585e4d7c12f77deb7fc0cb24ec6626d53e3fa9997e303e77"
      },
      {
        "id": "",
        "name": "4c88348d1ef0ff6857f48761ac82d8455661849b34e4f4a6bc07a765818361a3"
      },
      {
        "id": "",
        "name": "3d3cef0a4b5c9d56790dbb8c8ac838d42caac2171f5435495682a51c45160bc3"
      },
      {
        "id": "",
        "name": "3bced24274a35cd08a3698e32623a14a319fbb60f4f9a950d41834710393c32f"
      },
      {
        "id": "",
        "name": "3b8672b2cd5c53f3f4e823ed3873d930b5786a05cc7f2d49b07cb5bda21d933e"
      },
      {
        "id": "",
        "name": "382031a229aad519f8d243923e504e8dedf0106f4ce274ab9640ce55542b962d"
      },
      {
        "id": "",
        "name": "2e4d3cf89636072438deb7e690ea376e8433c5dc59d8befedc0f5b79ea9a6b7d"
      },
      {
        "id": "",
        "name": "2ef38ea449b172cef5e1015bc4b5e37de8ece7d4be087b6bdded5a992493e7aa"
      },
      {
        "id": "",
        "name": "2bcfbb053ec4936bded589848b8429cd37b0a7bf5bf85e5e3ace494f4512bfa9"
      },
      {
        "id": "",
        "name": "2a82f3e9fc83a6e14c8ff13ed5d450580235981958a7bd262c7ea597e1c94078"
      },
      {
        "id": "",
        "name": "20a77d76f250b75309e8ccaf1470d9729dc99b95168085ff30b1e46be6ce2138"
      },
      {
        "id": "",
        "name": "1fd5a9570a894c751610c1b49b2f2f00c0c618d365be14a4980f1266a3772c90"
      },
      {
        "id": "",
        "name": "1dbce4f525f428cfce626726209ca973f2fdb93cd905a94a1bc538f75e0a16ca"
      },
      {
        "id": "",
        "name": "164cabc6b731b2420df8a0fa8e4a2590e45cc027d9cf72ccc74252383ec0f65b"
      },
      {
        "id": "",
        "name": "14f5ef72472f64edee2e852d1c677ad4f61b780c3ac93649835c4cc30f5c5b2f"
      },
      {
        "id": "",
        "name": "1304a1ec426aa4d39c255aef059bc5b2cb9fef096cd6d136c63ddf8a3b936b96"
      },
      {
        "id": "",
        "name": "0576a15f1331d220336163510cc71deb37d1ae0b57ff6ad661c5e547086b57e2"
      },
      {
        "id": "",
        "name": "05406c5e034be68b6514fc3ae1b31f603ec7d1865963fe0716ed48605af0fd98"
      },
      {
        "id": "",
        "name": "03b11a7319a44c8848d239b8ce49ebb43ebe90dfb9927771a2258bbe3d0e655e"
      }
    ],
    "malware": [
      {
        "id": "51a1faad-c44b-4d64-ac3a-0942711c74e5",
        "name": "TeamViewer",
        "slug": "teamviewer"
      },
      {
        "id": "067e2789-aa17-43ca-9067-8e023ee30997",
        "name": "RMS",
        "slug": "rms"
      },
      {
        "id": "cca235b5-c9b5-40bc-9969-5f1253d76c8b",
        "name": "BurnsRAT",
        "slug": "burnsrat"
      },
      {
        "id": "7e585dbc-e7e5-41df-9e41-bac87c124cc4",
        "name": "WarzoneRAT - S0670",
        "slug": "warzonerat-s0670"
      },
      {
        "id": "66d9b9fe-8a88-4b60-a842-6b7e7a453f4f",
        "name": "PureLogs",
        "slug": "purelogs"
      },
      {
        "id": "legacy:malware:e340c5f4877ca85d",
        "name": "Ave Maria",
        "slug": "ave-maria"
      },
      {
        "id": "699bea62-1fca-47aa-ad1d-d96ee3f6a9da",
        "name": "MetaStealer",
        "slug": "metastealer"
      },
      {
        "id": "a2ea65f6-31a0-4662-89a5-d261ebf7e659",
        "name": "RedLine Stealer",
        "slug": "redline-stealer"
      },
      {
        "id": "609c76d4-49ff-421d-a269-340e2b154ef0",
        "name": "PureCrypter",
        "slug": "purecrypter"
      }
    ],
    "intrusion_sets": [
      {
        "id": "c978345f-a25a-444a-9cb0-fa19f516038f",
        "name": "VasyGrek",
        "slug": "vasygrek"
      }
    ],
    "attack_patterns": [
      {
        "id": "d03ba136-5188-4224-876c-26255d8c8a5b",
        "name": "T1217"
      },
      {
        "id": "1eef7f88-3992-4add-899e-a7cc9fcdd5b3",
        "name": "T1569.002"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "0192fd78-09e3-4fe4-a9d3-38a7137e15fa",
        "name": "T1055.002"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "2fca0274-42fc-483e-a1e3-d9c4ba687d2d",
        "name": "T1574.001"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.facct.ru/blog/vasygrek-and-mr-burns/",
    "https://otx.alienvault.com/pulse/668e59166cfc4e877eedb26c"
  ]
}