100DaysofYARA - SpectralBlur – GitHub

Excerpt

100DaysofYARA - SpectralBlur | A Clever Blog Name by Greg Lesnewich

A Clever Blog Name by Greg Lesnewich January 3, 2024

100DaysofYARA - SpectralBlur

g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html

Jan 3, 2024

Today will be a quick post on a TA444 (aka Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) Macho family tracked as SpectralBlur we found in August, and how finding it led us to stumble upon an early iteration of KANDYKORN (aka SockRacket). Please read Elastic’s EXCELLENT piece on that family.

Long story short, internet scan data from Censys tipped us a suspicious domain pxaltonet[.]org that we believed had tentative links to the Interception cluster (which we have since merged with TA444 in our dataset). We monitored this domain on VirusTotal (NetIoc rules will m…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.