Hackers leverage the Polygon blockchain to obscure parts of an ErrTraffic malware operation This article explores hackers leverage polygon. .
Indicators of Compromise (IoCs): Type | Indicator Description ------|--------------------------- HTTP Cookie | Header value associated with websites hosting ErrTraffic URL Pattern | hxxps://
]au, FRAMESAVECLOUDJS[. ]BEER, GROVALSTANDARD[. ]MONSTER, BOOTSTRUP-CDN-NS[. ]BEER, DREFF-NSDNS[.
]BEER, REMOTESHCONTROL[. ]COM, SLNDCDNSCLAUD[. ]BEER, KARENHEIL[. ]MONSTER, KYJPWNW[.
]MONSTER, MOONGLIDE[. ]MONSTER, POHUIIMNE[. ]LOL, TRAVEL-JS-NS[. ]BEER, VERIFICATION-CDN-LOUD[.
]BEER, WEB-SAFE[. ]BEER, ACCORDTRUCKING[. ]MONSTER, ADFLOW[. ]MONSTER, ADTRAFFIC[.
]MONSTER, ADZETA[. ]MONSTER, ANAKONDBOB[. ]CLUB, BCNCDNC-LNS[. ]BEER, BEST-CLAUDNS-JS[.
]BEER, BILLETORS[. ]CFD, COFFEECINCUP[. ]MONSTER, DOGESGROOM[. ]MONSTER, ETOMOIDOMEN[.
]CFD, EXPORTEARTH[. ]MONSTER, GANIBALLEKTOR[. ]CFD, GHDNSSERVERNS[. ]BEER, ISTILE-C-LOUD[.
]BEER, JOGOSDECARROBR[. ]MONSTER, LETSGOMAKEONEYONCAPTCHA[. ]BEER, MERINDASHOP[. ]CYOU, MNEPOHUI[.
]SBS, MNOKSEMP[. ]BEER, MOB.LANJUT.IN, NETWORKSOFTIONSON.SBS, NS-CLADE-JS[. ]BEER, NSSLSCONSLOUD[. ]BEER, ORAXDATA[.
]MONSTER, SSNS-CDN-NS[. ]BEER, TOTALADS[. ]MONSTER, VHYIP[. ]MONSTER, WEB-PROTECTION[.
]BEER, WEBFLARE[. ]BEER, YANGDIE-T[. ]MONSTER, DTC[VICTORRAMARISIMOBILIA][.COM][. ]BR, VIDAR-CMDANDCONTROL-HOST Domain | BigBlower[.
]CLICK, Host contacted by a Vidar-related executable, File name taskcollect.dll (DLL downloaded after connection to bigblower[. ]click), File name protobuff.dll (Malicious DLL sideloaded in the Okobot chain), File name Volume2.zip (Archive downloaded and extracted during Okobot activity), File name Volume2.exe (Executable launched in the Okobot chain), File name tunupd.php (Okobot download endpoint file name), File name took.php (Okobot PowerShell follow-on endpoint file name) Domain | Livewallpapers[. ]CFD, File name bootstrap.js (Malicious script embedded in the Node.js backdoor MSI), File name CoreBridge.dll (DLL launched by the Node.js backdoor), File name sqlite.dll (Malicious DLL sideloaded by acrobroker.exe), File name acrobroker.exe (Legitimate executable abused for DLL sideloading), File name active_desktop_render_x64.dll (Malicious DLL associated with the ClipBanker variant), File name Adobe.dll (DLL containing ClipBanker-related behavior) IP Address | hxxp://158[.]94[.]208[.]104/x7GkP2mQ9zL4/my_s[. ]bin, File name my_s.bin (BabaDedaLoader-related payload file), Note: IP addresses and domains are intentionally defanged to prevent accidental resolution or hyperlinking.
