While investigating REF7707, Elastic Security Labs discovered a new family of previously unknown malware that leverages Outlook as a communication channel via the Microsoft Graph API. This post-exploitation kit includes a loader, a backdoor, and multiple submodules that enable advanced post-exploitation activities. Author: AlienVault
Related Tags:
pe
ntlm hash
elf variant
ref7707
microsoft graph
outlook
pathloader
FINALDRAFT
T1080
Associated Indicators:
83406905710E52F6AF35B4B3C27549A12C28A628C492429D3A411FDB2D28CC8C
39E85DE1B1121DC38A33ECA97C41DBD9210124162C6D669D28480C833E059530
C2E0559907BD721A050A9FEE4448D062F5EDF237
2FDEA656BF50277C8D728E1A005BF1E5157C68D0
D79D5B7742DD848F35424DF325610B2E8A8761EB
764A838236F5DCEB3D199059AD36311E
54C4D47332EBC8BD2505D6E7638717BC
92306905BE5B717654D5B105CD506BDD
http://poster.checkponit.com/nzoMeFYgvjyXK3P