{
  "name": "Warning Against Phishing Emails Prompting Execution of Commands via Paste",
  "slug": "warning-against-phishing-emails-prompting-execution-of-commands-via-paste",
  "description": "This report details a phishing campaign distributing malicious HTML files through emails. The files prompt users to paste and run malicious PowerShell commands that initiate a multi-stage infection process. The campaign ultimately delivers the DarkGate malware, highlighting the importance of exercising caution with files from unknown sources.",
  "published": "2024-06-06T05:18:04+00:00",
  "created_at": "2024-06-06T05:18:04+00:00",
  "modified_at": "2024-06-06T06:05:00+00:00",
  "created_at_opencti": "2024-06-06T05:18:04+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-06",
    "commands",
    "darkgate",
    "emails",
    "malicious",
    "phishing",
    "powershell"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.rockcreekdds.com"
      },
      {
        "id": "",
        "name": "https://linktoxic34.com/wp-content/themes/twentytwentytwo/dark.hta"
      },
      {
        "id": "",
        "name": "https://www.rockcreekdds.com/wp-content/1.hta"
      },
      {
        "id": "",
        "name": "https://jenniferwelsh.com/header.png"
      },
      {
        "id": "",
        "name": "http://mylittlecabbage.net/xcdttafq"
      },
      {
        "id": "",
        "name": "http://mylittlecabbage.net/qhsddxna"
      },
      {
        "id": "",
        "name": "http://flexiblemaria.com/umkglnks"
      },
      {
        "id": "",
        "name": "http://flexiblemaria.com/iinkqrwu"
      },
      {
        "id": "",
        "name": "http://dogmupdate.com/yoomzhda"
      },
      {
        "id": "",
        "name": "http://dogmupdate.com/rdyjyany"
      },
      {
        "id": "",
        "name": "mylittlecabbage.net"
      },
      {
        "id": "",
        "name": "linktoxic34.com"
      },
      {
        "id": "",
        "name": "jenniferwelsh.com"
      },
      {
        "id": "",
        "name": "flexiblemaria.com"
      },
      {
        "id": "",
        "name": "dogmupdate.com"
      }
    ],
    "malware": [
      {
        "id": "9859dba4-182b-4ce5-aa4d-c0768b9b15a7",
        "name": "DarkGate",
        "slug": "darkgate"
      }
    ],
    "attack_patterns": [
      {
        "id": "566a4023-1f45-4988-a451-e1564d7dfef4",
        "name": "T1136.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "45c400ce-708d-4ac2-8ea7-57c971a83ce5",
        "name": "T1027.005"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ]
  },
  "external_refs": [
    "https://asec.ahnlab.com/en/66300/",
    "https://otx.alienvault.com/pulse/666162acc519496e8fdc8a0b"
  ]
}