TF-MAL-js.scanbox
📛 Threat Title
Malware family: scanbox
Description
ThreatFox malware family `js.scanbox`. Printable name: scanbox.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.scanbox
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.scanbox
IOC database
- Type
- domain
- Value
js.scanbox- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.scanbox
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.scanbox
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (9)
-
web:assets.kpmg.com
Background A Chinese nation-state threat group utilized a reconnaissance malware , ScanBox , to acquire details about its targets during a months-long cyber espionage campaign. The ScanBox exploitation framework was used to target victims who visit a malicious domain masquerading as a news website. Local and federal government agencies, news media outlets, and worldwide heavy industry producers ...
-
web:cyberprivateinvestigations.com
In lieu of malware , attackers can use ScanBox in conjunction with watering hole attacks. Adversaries load the malicious JavaScript onto a compromised website where the ScanBox acts as a keylogger snagging all of a user's typed activity on the infected watering hole website.
-
web:learn.microsoft.com
If your organization is using Defender for Endpoint (or Defender for Business), automated investigation and remediation capabilities can save your security operations team time and effort. As outlined in this blog post, these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the scanbox malware family including references, samples and yara signatures.
-
web:medium.com
Based on the identified capabilities (e.g., anti-analysis techniques, memory manipulation), develop appropriate mitigation strategies and response actions to contain and remediate the malware .
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
Malware attacks, in particular ransomware attacks, can be devastating for organisations because computer systems are no longer available to use, and in some cases data may never be recovered.
-
web:www.pcrisk.com
What is ScanBox ? ScanBox is the name of malware delivered via malicious websites masquerading as legitimate Australian news websites. Cybercriminals behind it target Australian Government agencies, news media organizations, and global energy and manufacturing sectors. Websites used to distribute ScanBox are sent via email. More about ScanBox After opening a malicious URL, victims receive a ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.