TF-MAL-ps1.cashy200
📛 Threat Title
Malware family: CASHY200
Description
ThreatFox malware family `ps1.cashy200`. Printable name: CASHY200.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Tool: CASHY200 ... Last change to this tool card: 24 April 2021 Download this tool card in JSON format
-
web:digital.nhs.uk
CASHY200 Backdoor First observed in early 2018, CASHY200 is a PowerShell-based backdoor associated with the larger xHunt malware campaign.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the CASHY200 malware family including references, samples and yara signatures.
-
web:unit42.paloaltonetworks.com
During our continued analysis of the xHunt campaign, we observed several domains with ties to the pasta58[.]com domain associated with known Sakabota command and control (C2) activity. In June 2019, we observed one of these overlapping domains, specifically, windows64x[.]com, being used as the C2 server for a new PowerShell based backdoor that we've named CASHY200 . This PowerShell backdoor ...
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.cybersecurity-review.com
During our continued analysis of the xHunt campaign, we observed several domains with ties to the pasta58 [.]com domain associated with known Sakabota command and control (C2) activity. In June 2019, we observed one of these overlapping domains, specifically, windows64x [.]com, being used as the C2 server for a new PowerShell based backdoor that we've named CASHY200 . This PowerShell backdoor ...
-
web:www.enigmasoftware.com
CASHY200 is the name given by the researchers to a PowerShell-based backdoor threat. This particular malware was detected due to its Command-and-Control (C2, C&C) infrastructure using a domain - 'windows64x.com,' that was observed to be part of an attack campaign against Kuwait organizations from the transportation and shipping industries previously. The targets' profile also appears to be ...
-
web:www.ic3.gov
Overview Threat actors are deploying ATM jackpotting malware , including the Ploutus family malware , to infect ATMs and force them to dispense cash. Ploutus malware exploits the eXtensions for Financial Services (XFS), the layer of software that instructs an ATM what to physically do. When a legitimate transaction occurs, the ATM application sends instructions through XFS for bank authorization ...
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.