Malware
Truebot
- First Reported
- Feb 8, 2023
- Latest Reported
- Apr 21, 2023
Reported Context (2)
- The ld.txt (SHA256 hash: c0f8aeeb2d11c6e751ee87c40ee609aceb1c1036706a5af0d3d78738b6cc4125) file is more interesting, as recovery and analysis shows this is actually a Windows DLL, specifically a Truebot malware variant. Huntress Details PaperCut Zero-Day Exploitation and Remote Code Execution Chain
- in the second alert for this host. Huntress has previously observed this activity from malware named Truebot, which references the same export. This can be seen in the strings of a different known Truebot DLL: Huntress Investigates GoAnywhere MFT Intrusion and Finds Likely Truebot Malware
CVE (2)
Malware (1)
People (4)
Threat Actors (3)
MITRE ATT&CK (17)
Vendors (2)
Products (5)
Tools (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.