New Noteworthy Changes to Necurs’ Behaviors
Tags
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Contact List - T1636.003 Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Email Account - T1087.003 Email Accounts - T1585.002 Email Accounts - T1586.002 Email Addresses - T1589.002 Malware - T1587.001 Malware - T1588.001 Screen Capture - T1513 Tool - T1588.002 Connection Proxy - T1090 Screen Capture - T1113 Screen Capture
Show in Graph
Common Information
Type Value
UUID 0914234f-c602-4a71-9859-036912737622
Fingerprint 6f372dda0fbabfc9
Analysis status DONE
Considered CTI value 0
Text language
Published June 28, 2018, midnight
Added to db Oct. 15, 2024, 5:17 p.m.
Last updated Nov. 17, 2024, 12:57 p.m.
Headline New Noteworthy Changes to Necurs’ Behaviors
Title New Noteworthy Changes to Necurs’ Behaviors
Detected Hints/Tags/Attributes 67/1/4
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_ca/research/18/f/the-new-face-of-necurs-noteworthy-changes-to-necurs-behaviors.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details File 96 
wallet.dat
Details sha1 1 
c25fcdf464202ef4226d085b8e495f4e5064125e
Details IPv4 1 
185.176.221.24
Details Url 1 
http://185.176.221.24/l/s.php