TF-MAL-elf.whirlpool
📛 Threat Title
Malware family: WHIRLPOOL
Description
ThreatFox malware family `elf.whirlpool`. Printable name: WHIRLPOOL.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.whirlpool
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.whirlpool
IOC database
- Type
- domain
- Value
elf.whirlpool- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.whirlpool
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.whirlpool
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.netmanageit.com
Pattern rule CISA_10452108_02 : WHIRLPOOL backdoor communicates_with_c2 installs_other_components { meta: Author = "CISA Code & Media Analysis" Incident = "10452108" Date = "2023-06-20" Last_Modified = "20230804_1730" Actor = "n/a" Family = " WHIRLPOOL " Capabilities = "communicates-with-c2 installs-other-components" Malware_Type = "backdoor" Tool_Type = "unknown" Description = "Detects ...
-
web:computersecurityinfo.com
The Whirlpool malware Is A Prime Example Of This Evolving Landscape. This Article Delves Into The Depths Of The Whirlpool Malware , Its Stealthy Tactics, Potential Implications, And Proactive Strategies For Protection And Removal.
-
web:d2ul67h78igv2v.cloudfront.net
The Whirlpool Malware Establishes a Backdoor Connection to Breached Systems Seapsy is a well-known and enduring culprit within the realm of Barracuda offenses. It adeptly disguises itself as a genuine Barracuda service under the name 'BarracudaMailService,' affording threat actors to execute arbitrary commands on the ESG appliance.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the WHIRLPOOL malware family including references, samples and yara signatures.
-
web:securityaffairs.com
If you have not replaced your appliance after receiving notice in your UI, contact support now (support@barracuda.com)." urges the company. "Barracuda's remediation recommendation at this time is full replacement of the impacted ESG." This week, CISA announced the discovery of the Whirlpool backdoor, a 32-bit ELF file.
-
web:www.bleepingcomputer.com
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has discovered a new backdoor malware named 'Whirlpool' used in attacks on compromised Barracuda Email Security Gateway (ESG) devices.
-
web:www.cisa.gov
WHIRLPOOL is a backdoor that establishes a Transport Layer Security (TLS) reverse shell to the Command-and-Control (C2) server. For information about related malware , specifically information on the initial exploit payload and other backdoors, see CISA Alert: CISA Releases Malware Analysis Reports on Barracuda Backdoors.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.scribd.com
The malware analysis report details the discovery of SEASPY and WHIRLPOOL backdoors that exploit a vulnerability in Barracuda Email Security Gateway. SEASPY acts as a persistent backdoor, while WHIRLPOOL establishes a TLS reverse shell to a Command-and-Control server. The report includes technical details about the malware samples and their behavior, emphasizing the need for awareness and ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.