UNKNOWN
Image Description
Common Information
Type Value
UUID a91bcb6a-6d40-40f1-8b26-c8b2d68c38e8
Fingerprint 9759fea7bf5417fac67e9487dfbefe76f57d40d790df90e0d0a6e7140b2c6f39
Analysis status DONE
Considered CTI value 2
Text language
Published Aug. 16, 2024, 5:07 p.m.
Added to db Aug. 21, 2024, 3:28 p.m.
Last updated Aug. 31, 2024, 9:21 a.m.
Headline UNKNOWN
Title UNKNOWN
Detected Hints/Tags/Attributes 208/2/275
Attributes
Details Type #Events CTI Value
Details CVE 47
cve-2024-4577
Details CVE 38
cve-2024-3094
Details CVE 133
cve-2023-38831
Details CVE 25
cve-2024-1708
Details CVE 7
cve-2022-38028
Details CVE 29
cve-2024-1709
Details CVE 16
cve-2024-27198
Details CVE 9
cve-2024-27199
Details CVE 42
cve-2023-46805
Details CVE 55
cve-2024-21887
Details CVE 9
cve-2024-0519
Details CVE 6
cve-2024-23222
Details CVE 4
cve-2024-23225
Details CVE 7
cve-2024-23296
Details CVE 23
cve-2024-21338
Details CVE 4
cve-2024-21351
Details CVE 24
cve-2024-21412
Details CVE 15
cve-2024-26169
Details CVE 2
cve-2024-29745
Details CVE 7
cve-2024-29748
Details CVE 4
cve-2024-20353
Details CVE 5
cve-2024-20359
Details CVE 21
cve-2024-4671
Details CVE 8
cve-2024-4761
Details CVE 29
cve-2024-4947
Details CVE 8
cve-2024-30040
Details CVE 17
cve-2024-30051
Details CVE 38
cve-2024-3400
Details CVE 27
cve-2024-5274
Details CVE 1
cve-2024-4610
Details CVE 23
cve-2024-32896
Details CVE 16
cve-2012-1823
Details Domain 13
qianxin.com
Details Domain 58
ti.qianxin.com
Details Domain 118
sekoia.io
Details Domain 208
mp.weixin.qq.com
Details Domain 189
asec.ahnlab.com
Details Domain 6
www.chainalysis.com
Details Domain 36
decoded.avast.io
Details Domain 72
symantec-enterprise-blogs.security.com
Details Domain 13
www.securonix.com
Details Domain 22
www.genians.co.kr
Details Domain 8
www.kroll.com
Details Domain 124
www.sentinelone.com
Details Domain 7
www.nextron-systems.com
Details Domain 101
www.group-ib.com
Details Domain 262
www.welivesecurity.com
Details Domain 53
blogs.blackberry.com
Details Domain 20
www.seqrite.com
Details Domain 25
cyble.com
Details Domain 604
www.trendmicro.com
Details Domain 397
www.microsoft.com
Details Domain 47
go.recordedfuture.com
Details Domain 167
www.ic3.gov
Details Domain 57
www.clearskysec.com
Details Domain 88
securityintelligence.com
Details Domain 101
cert.pl
Details Domain 20
labs.withsecure.com
Details Domain 83
cert.gov.ua
Details Domain 50
cloud.google.com
Details Domain 261
blog.talosintelligence.com
Details Domain 182
www.mandiant.com
Details Domain 31
www.esentire.com
Details Domain 17
www.deepinstinct.com
Details Domain 5
harfanglab.io
Details Domain 224
unit42.paloaltonetworks.com
Details Domain 15
blog.eclecticiq.com
Details Domain 3
www.huntandhackett.com
Details Domain 41
arcticwolf.com
Details Domain 144
www.fortinet.com
Details Domain 31
blog.morphisec.com
Details Domain 4
www.facct.ru
Details Domain 434
medium.com
Details Domain 2
blog.sonicwall.com
Details Domain 100
cert.360.cn
Details Domain 2
www.stormshield.com
Details Domain 18
www.netskope.com
Details Domain 74
thedfirreport.com
Details Domain 58
blog.sekoia.io
Details Domain 370
www.proofpoint.com
Details Domain 403
securelist.com
Details Domain 18
www.cadosecurity.com
Details Domain 20
www.secrss.com
Details Domain 20
www.antiy.cn
Details Domain 3
blog.xlab.qianxin.com
Details Email 11
ti_support@qianxin.com
Details File 1
劫持和nodejs.exe
Details File 1
执行过程中core.dll
Details File 1
lazarus利用windows系统组件appid.sys
Details File 42
msvcr100.dll
Details File 1
用于下载并执行名为dwmm.exe
Details File 2
dwmm.exe
Details File 1
b.apk
Details File 1
cta-ru-2024-0530.pdf
Details File 6
router-roulette.html
Details File 2
240227.pdf
Details File 2
doppelgangerng_clearsky.pdf
Details File 99
cert.pl
Details File 2
attacks-abuses-psexec-and-expl.html
Details File 1
are-exploiting-recent-.html
Details File 1
multistage-ra-world-ransomware.html
Details File 1
jasmin-ransomware.html
Details File 1
vcenters-and-esxi-via-custom-pow.html
Details File 1
esxi-environments.html
Details File 2
trojancontrol_analysis.html
Details File 3
blog.xla
Details File 3
darkmozzie.html
Details IBM X-Force - Threat Group Enumeration 12
ITG05
Details Mandiant Uncategorized Groups 11
UNC5221
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 10
Storm-1811
Details Threat Actor Identifier - APT-C 44
APT-C-00
Details Threat Actor Identifier - APT-Q 20
APT-Q-27
Details Threat Actor Identifier - APT-Q 4
APT-Q-1
Details Threat Actor Identifier - APT-Q 3
APT-Q-78
Details Threat Actor Identifier - APT-Q 9
APT-Q-31
Details Threat Actor Identifier - APT-Q 5
APT-Q-20
Details Threat Actor Identifier - APT-Q 4
APT-Q-29
Details Threat Actor Identifier - APT-Q 11
APT-Q-36
Details Threat Actor Identifier - APT-Q 7
APT-Q-37
Details Threat Actor Identifier - APT-Q 1
APT-Q-46
Details Threat Actor Identifier - APT-Q 7
APT-Q-11
Details Threat Actor Identifier - APT-Q 7
APT-Q-14
Details Threat Actor Identifier - APT-Q 8
APT-Q-15
Details Threat Actor Identifier - APT-Q 3
APT-Q-43
Details Threat Actor Identifier - APT 783
APT28
Details Threat Actor Identifier - APT 277
APT37
Details Threat Actor Identifier - APT 665
APT29
Details Threat Actor Identifier - APT 194
APT35
Details Threat Actor Identifier - APT 181
APT33
Details Threat Actor Identifier - APT 20
APT44
Details Threat Actor Identifier by Volexity 9
UTA0218
Details Threat Actor Identifier - FIN 377
FIN7
Details Unknown Threat Group - UTG-Q 1
UTG-Q-001
Details Unknown Threat Group - UTG-Q 4
UTG-Q-005
Details Unknown Threat Group - UTG-Q 1
UTG-Q-006
Details Unknown Threat Group - UTG-Q 1
UTG-Q-008
Details Unknown Threat Group - UTG-Q 1
UTG-Q-009
Details Url 24
https://ti.qianxin.com
Details Url 1
https://mp.weixin.qq.com/s/mflg1nzvrhc6juvm0rw6gq
Details Url 2
https://asec.ahnlab.com/ko/62771
Details Url 1
https://asec.ahnlab.com/ko/65495
Details Url 1
https://mp.weixin.qq.com/s/84luansgo4lhqlpncvuhfq
Details Url 1
https://www.chainalysis.com/blog/2024-crypto-money-laundering
Details Url 1
https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-
Details Url 1
https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-
Details Url 1
https://mp.weixin.qq.com/s/kknktalupll2skxq3tcbfw
Details Url 1
https://asec.ahnlab.com/ko/61666
Details Url 2
https://asec.ahnlab.com/ko/62117
Details Url 1
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-
Details Url 2
https://mp.weixin.qq.com/s/pog2wxq8uzttzkybjfy1ow
Details Url 1
https://mp.weixin.qq.com/s/yhaeq6ogz3p5oqo_pyi-oq
Details Url 1
https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-deepgosu-
Details Url 1
https://www.genians.co.kr/blog/threat_intelligence/dropbox
Details Url 1
https://mp.weixin.qq.com/s/7vnxz8dymwf7z8cmaa8svg
Details Url 1
https://www.kroll.com/en/insights/publications/cyber/screenconnect-vulnerability-exploited-
Details Url 1
https://www.genians.co.kr/blog/threat_intelligence/webinar-apt
Details Url 2
https://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-
Details Url 2
https://mp.weixin.qq.com/s/yzd0avq2wzi-v-eb73f6lq
Details Url 1
https://mp.weixin.qq.com/s/botyh6ytmvzhvinhtlzxww
Details Url 2
https://mp.weixin.qq.com/s/jbx6agppgepzo4sqcn9n9a
Details Url 1
https://mp.weixin.qq.com/s/3ghwv3wsiaiztcldbjxg-g
Details Url 1
https://mp.weixin.qq.com/s/k-fuaffqx4g6d_hwexxctg
Details Url 1
https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis
Details Url 5
https://www.group-ib.com/blog/dark-pink-apt
Details Url 1
https://mp.weixin.qq.com/s/efxox3cwppee5z2_3g3wxw
Details Url 1
https://mp.weixin.qq.com/s/_gbnalghd3gbp-pq5m-7yq
Details Url 1
https://mp.weixin.qq.com/s/wr7igbmeuqqgq9scav39uw
Details Url 1
https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps
Details Url 2
https://mp.weixin.qq.com/s/sat5nu-hcbs0d6ji8gkkfq
Details Url 1
https://mp.weixin.qq.com/s/i_s5hrrwdbtw99b99udl1w
Details Url 1
https://mp.weixin.qq.com/s/endm2bvzw89tlkljzyfdbw
Details Url 1
https://www.sentinelone.com/labs/capratube-remix-transparent-tribes-android-spyware-
Details Url 1
https://mp.weixin.qq.com/s/nbfwjxnm2yiwpfmn87vbrq
Details Url 1
https://blogs.blackberry.com/en/2024/05/transparent-tribe-targets-indian-government-
Details Url 1
https://mp.weixin.qq.com/s/ft7xvygdk-wab9nfywpmug
Details Url 1
https://www.seqrite.com/blog/pakistani-apts-escalate-attacks-on-indian-gov-seqrite-labs-
Details Url 1
https://cyble.com/blog/the-overlapping-cyber-strategies-of-transparent-tribe-and-sidecopy-
Details Url 2
https://mp.weixin.qq.com/s/uf708khax2rjauhno1mz1q
Details Url 1
https://www.trendmicro.com/en_us/research/24/a/pawn-storm-uses-brute-force-and-stealth.
Details Url 1
https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-
Details Url 1
https://go.recordedfuture.com/hubfs/reports/cta-ru-2024-0530.pdf
Details Url 5
https://www.trendmicro.com/en_us/research/24/e/router-roulette.html
Details Url 2
https://www.ic3.gov/media/news/2024/240227.pdf
Details Url 2
https://www.clearskysec.com/wp-content/uploads/2024/02/doppelgangerng_clearsky.pdf
Details Url 2
https://securityintelligence.com/x-force/itg05-leverages-malware-arsenal
Details Url 1
https://cert.pl/posts/2024/05/apt28-kampania
Details Url 1
https://labs.withsecure.com/publications/kapeka
Details Url 1
https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-
Details Url 2
https://cert.gov.ua/article/6278706
Details Url 2
https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm
Details Url 1
https://blog.talosintelligence.com/tinyturla-ng-tooling-and-c2
Details Url 4
https://blog.talosintelligence.com/tinyturla-full-kill-chain
Details Url 1
https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-
Details Url 2
https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
Details Url 1
https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry
Details Url 1
https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-
Details Url 2
https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-
Details Url 1
https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-
Details Url 2
https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Details Url 1
https://harfanglab.io/en/insidethelab/muddywater-rmm-campaign
Details Url 1
https://www.nextron-systems.com/2024/01/29/analysis-of-falsefont-backdoor-used-by-peach-
Details Url 1
https://unit42.paloaltonetworks.com/curious-serpens-falsefont-backdoor/#post
Details Url 1
https://www.welivesecurity.com/en/eset-research/arid-viper-poisons-android-apps-with-
Details Url 1
https://www.esentire.com/blog/blind-eagles-north-american-journey
Details Url 2
https://mp.weixin.qq.com/s/tpvw-fbu3pqvktymzxb4bw
Details Url 1
https://blog.talosintelligence.com/starry-addax
Details Url 1
https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-
Details Url 1
https://www.huntandhackett.com/blog/turkish-espionage-campaigns
Details Url 1
https://arcticwolf.com/resources/blog/follow-on-extortion-campaign-targeting-victims-of-
Details Url 1
https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-
Details Url 1
https://blog.talosintelligence.com/decryptor-babuk-tortilla
Details Url 1
https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site
Details Url 1
https://asec.ahnlab.com/en/60440
Details Url 1
https://mp.weixin.qq.com/s/css8y2rpykynprlkjnq9ig
Details Url 1
https://asec.ahnlab.com/ko/60744
Details Url 1
https://mp.weixin.qq.com/s/xv0x10yv-wrs1zi6tnhjla
Details Url 2
https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-
Details Url 2
https://www.fortinet.com/blog/threat-research/phobos-ransomware-variant-launches-attack-
Details Url 1
https://www.fortinet.com/blog/threat-research/ransomware-roundup-albabat
Details Url 1
https://blog.morphisec.com/akira-ransomware-prevention-and-analysis
Details Url 1
https://www.fortinet.com/blog/threat-research/ransomware-roundup-abyss-locker
Details Url 1
https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-
Details Url 1
https://www.trendmicro.com/en_us/research/24/c/multistage-ra-world-ransomware.html
Details Url 1
https://blog.talosintelligence.com/ghostsec-ghostlocker2-ransomware
Details Url 1
https://www.facct.ru/blog/shadow-ransomware
Details Url 252
https://medium.com
Details Url 1
https://mp.weixin.qq.com/s/8dixwyn3v4u7y9iecpxa7g
Details Url 1
https://mp.weixin.qq.com/s/fxysdh9nrcrke_qfghviiw
Details Url 1
https://blog.sonicwall.com/en-us/2024/03/new-multi-stage-stopcrypt-ransomware
Details Url 1
https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-
Details Url 2
https://cert.360.cn/report/detail?id=65fceeb4c09f255b91b17f11
Details Url 1
https://www.trendmicro.com/en_us/research/24/c/agenda-ransomware-propagates-to-
Details Url 1
https://mp.weixin.qq.com/s/_kufpps6xfoicnprjzn5aa
Details Url 1
https://www.stormshield.com/news/technical-analysis-of-ransomware-crypt888
Details Url 1
https://www.netskope.com/blog/netskope-threat-coverage-evil-ant-ransomware
Details Url 1
https://asec.ahnlab.com/ko/64345
Details Url 1
https://mp.weixin.qq.com/s/ewo2lp5arhun3dm94pcsrw
Details Url 1
https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days
Details Url 1
https://cert.360.cn/report/detail?id=663c203cc09f255b91b17fd9
Details Url 1
https://cyble.com/blog/in-the-shadow-of-venus-trinity-ransomwares-covert-ties
Details Url 1
https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-
Details Url 1
https://www.proofpoint.com/us/blog/threat-insight/security-brief-millions-messages-
Details Url 1
https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-
Details Url 1
https://www.sentinelone.com/blog/ikaruz-red-team-hacktivist-group-leverages-ransomware-
Details Url 1
https://securelist.com/ransomware-abuses-bitlocker/112643
Details Url 1
https://cyble.com/blog/ransomware-menace-amplifies-for-vulnerable-industrial-control-
Details Url 2
https://arcticwolf.com/resources/blog/lost-in-the-fog-a-new-ransomware-threat
Details Url 1
https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomhub-knight-
Details Url 1
https://www.trendmicro.com/en_us/research/24/f/targetcompany-s-linux-variant-targets-
Details Url 1
https://www.fortinet.com/blog/threat-research/ransomware-roundup-shinra-and-limpopo-
Details Url 1
https://www.cadosecurity.com/blog/from-dormant-to-dangerous-p2pinfect-evolves-to-
Details Url 1
https://mp.weixin.qq.com/s/xxuble43zzorfvd62fwm4g
Details Url 1
https://mp.weixin.qq.com/s/-vvj2rhnnkcxrullmpfyra
Details Url 1
https://mp.weixin.qq.com/s/vvvcl1yv3jf6fpxrxt5f3a
Details Url 1
https://www.secrss.com/articles/52018
Details Url 2
https://www.antiy.cn/research/notice&report/research_report/trojancontrol_analysis.html
Details Url 1
https://mp.weixin.qq.com/s/hqhavweykfd2bp2vtrdwsw
Details Url 1
https://mp.weixin.qq.com/s/uz557zx-pr428e6d4jo5jw
Details Url 1
https://mp.weixin.qq.com/s/rhgwlo6xbghksobscd3u1q
Details Url 1
https://cert.360.cn/report/detail?id=6603e9fec09f255b91b17f3f
Details Url 1
https://mp.weixin.qq.com/s/ui_bu1ohip0--fxt-b6ulg
Details Url 2
https://www.antiy.cn/research/notice
Details Url 1
https://mp.weixin.qq.com/s/xk_ue0uls26sb_clmqfo4w
Details Url 1
https://mp.weixin.qq.com/s/qe_5k8us7nyzhehlshmlbg
Details Url 1
https://mp.weixin.qq.com/s/tbioiatw-qn2uwimgoeagw
Details Url 1
https://mp.weixin.qq.com/s/tnofw88eqaizxjkcrjp8kw
Details Url 1
https://mp.weixin.qq.com/s/diue6sxutfq5gs5l6ymqwa
Details Url 1
https://blog.xlab.qianxin.com/unveiling-the-mystery-of-bigpanzi
Details Url 1
https://ti.qianxin.com/blog/articles/analysis-of-recent-oneinstack-supply-chain-poisoning-
Details Url 1
https://mp.weixin.qq.com/s/r0kn5stsiwiuhiqvrwnnxw
Details Url 1
https://www.antiy.cn/research/notice&report/research_report/darkmozzie.html
Details Url 1
https://mp.weixin.qq.com/s/7h5rmlnv16uh27rovrdmcw
Details Url 1
https://mp.weixin.qq.com/s/meqp4i1ilrxf91etb0yzyq
Details Url 1
https://mp.weixin.qq.com/s/ohenn_ir_atckokyk8flag
Details Url 1
https://mp.weixin.qq.com/s/yf48xzcwb4s5amfmchrxwg