TF-MAL-elf.whiterabbit
📛 Threat Title
Malware family: WhiteRabbit
Description
ThreatFox malware family `elf.whiterabbit`. Printable name: WhiteRabbit.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.whiterabbit
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.whiterabbit
IOC database
- Type
- domain
- Value
elf.whiterabbit- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.whiterabbit
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.whiterabbit
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:assets.kpmg.com
White Rabbit's binary appears to be uninteresting at first, with its small size of around 100 KB and lack of remarkable strings or activity, although the inclusion of strings for logging gives away its malicious nature but without the correct password, the fundamental ransomware behavior is difficult to unearth. The ransomware is believed to utilize Cobalt Strike, a post-exploitation framework ...
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the WhiteRabbit malware family including references, samples and yara signatures.
-
web:thehackernews.com
The financially motivated FIN8 actor , in all likelihood, has resurfaced with a never-before-seen ransomware strain called " White Rabbit " that was recently deployed against a local bank in the U.S. in December 2021. That's according to new findings published by Trend Micro, calling out the malware's overlaps with Egregor, which was taken down by Ukrainian law enforcement authorities in ...
-
web:www.arcserve.com
Removal and Decryption Is Available, But Prevention Is Better PC Risk offers a White Rabbit removal guide that can at least help you identify and eliminate the malware from your systems. But prevention is a better approach. Meanwhile, Trend Micro offers these suggestions for mitigating the risks of White Rabbit:
-
web:www.enigmasoftware.com
White Rabbit Ransomware Back in December, right before the end of 2021, a new ransomware family emerged on the cybercrime landscape in an attack against a US bank. Discovered by the researchers at Trend Micro and tacked as White Rabbit ransomware, the threat displays multiple fully-implement characteristics of modern malware of this type.
-
web:www.linkedin.com
Beyond the technical analysis, we explore the broader implications of White Rabbit's emergence in the evolving ransomware landscape. This includes an examination of its potential impact on ...
-
web:www.pcrisk.com
White Rabbit ransomware overview The ransom-demanding message, created to correspond to the locked files, informs victims that their networks have been compromised, the files stored on them were encrypted, and sensitive data - exfiltrated.
-
web:www.researchgate.net
This research paper provides a comprehensive analysis of the White Rabbit ransomware, a rising cyber threat targeting high-value organizations. It examines the ransomware's attack chain ...
-
web:www.resecurity.com
2022 White Rabbit ransom note, source: Resecurity Notably, the message text contains a fragment of the ransom note associated with the White Rabbit ransomware family—specifically the one observed in an earlier version of the locker analyzed back in January 2022.
-
web:www.trendmicro.com
We spotted the new ransomware family White Rabbit discretely making a name for itself by executing an attack on a local US bank in December 2021. This newcomer takes a page from Egregor, a more established ransomware family , in hiding its malicious activity and carries a potential connection to the advanced persistent threat (APT) group FIN8.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.