TF-MAL-js.fakeupdates
📛 Threat Title
Malware family: FAKEUPDATES
Description
ThreatFox malware family `js.fakeupdates`. Printable name: FAKEUPDATES. Aliases: FakeUpdate,GhoLoader,SocGholish.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.fakeupdates
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.fakeupdates
IOC database
- Type
- domain
- Value
js.fakeupdates- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.fakeupdates
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.fakeupdates
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates.
-
web:blog.sucuri.net
In June 2022, we shared information about the ongoing NDSW/NDSX malware campaign which has been one of the most common website infections detected and cleaned by our remediation team in the last few years. This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick ...
-
web:hivepro.com
The Water Scylla intrusion set is a multi-stage attack campaign that leverages compromised websites, malicious Keitaro Traffic Distribution System (TDS) instances, and SocGholish malware to facilitate ransomware deployment. SocGholish, also known as FakeUpdates , is a malware -as-a-service (MaaS) framework that primarily spreads through legitimate websites injected with malicious scripts. When ...
-
web:malpedia.caad.fkie.fraunhofer.de
FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them. FAKEUPDATES has led to further compromise via additional malware families that include CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT.
-
web:rewterz.com
A recent cyberattack campaign has been reported, linking SocGholish malware , also known as FakeUpdates , to affiliates of the RansomHub ransomware group. This operation demonstrates how attackers combine initial access malware with targeted backdoor deployments to infiltrate corporate networks.
-
web:thehackernews.com
The threat actors behind a malware family known as RomCom targeted a U.S.-based civil engineering company via a JavaScript loader dubbed SocGholish to deliver the Mythic Agent. "This is the first time that a RomCom payload has been observed being distributed by SocGholish," Arctic Wolf Labs ...
-
web:threatfox.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on indicators of compromise associated with js. fakeupdates .
-
web:www.checkpoint.com
What Is FakeUpdates Malware ? FakeUpdates malware is a type of malware that creates false prompts for users to download a new update to their computer, browser, or computer program.
-
web:www.proofpoint.com
SocGholish malware is a very real threat from a very fake update. Proofpoint breaks down the threat, what it is, how it's delivered, and more.
-
web:www.todyl.com
SocGholish, also known as FakeUpdates , has existed since 2018 and is widely associated with the Russia-based cybercriminal entity Evil Corp. The malware family utilizes drive-by downloads typically disguised as software updates to gain initial access.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.