TF-MAL-ps1.quadagent
📛 Threat Title
Malware family: QUADAGENT
Description
ThreatFox malware family `ps1.quadagent`. Printable name: QUADAGENT.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
ps1.quadagent
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.quadagent
IOC database
- Type
- domain
- Value
ps1.quadagent- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-ps1.quadagent
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.quadagent
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
QUADAGENT is a PowerShell backdoor used by OilRig. [1] ID: S0269
-
web:cyber-kill-chain.ch
The cyber kill chain commentary by cyber-kill-chain.ch offers IT experts, forensic specialists and specialized legal advisors practice-oriented assessments and well-founded know-how.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the QUADAGENT malware family including references, samples and yara signatures.
-
web:unit42.paloaltonetworks.com
Threat Research Center Threat Actor Groups Malware Malware OilRig Targets Technology Service Provider and Government Agency with QUADAGENT 14 min read By: Bryan Lee Robert Falcone Published: July 25, 2018
-
web:www.attackiq.com
The QuadAgent malware then communicates with the command-and-control server to let the actor know they are ready for tasking. The malware leverages fallback channels if it is unable to communicate with the actor's infrastructure. The first attempts are over SSL and if prevented revert to unencrypted HTTP requests.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.ic3.gov
Overview Threat actors are deploying ATM jackpotting malware , including the Ploutus family malware , to infect ATMs and force them to dispense cash. Ploutus malware exploits the eXtensions for Financial Services (XFS), the layer of software that instructs an ATM what to physically do. When a legitimate transaction occurs, the ATM application sends instructions through XFS for bank authorization ...
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.picussecurity.com
Once recipients opened these emails, the embedded malware initiated the deployment of QUADAGENT , granting the attackers remote access and control over infected systems. One of the campaign's standout features was OilRig's use of advanced obfuscation techniques.
-
web:www.securityweek.com
Malware & Threats Iranian Hackers Use QUADAGENT Backdoor in Recent Attacks A series of recent attacks attributed to an Iran-linked cyber-espionage group delivered a PowerShell backdoor onto compromised machines, Palo Alto Networks has discovered.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.