DragonRank, a Chinese-speaking SEO manipulator service provider
Tags
cmtmf-attack-pattern: Masquerading
country: Belgium China Netherlands Hong Kong India Japan Thailand Taiwan
attack-pattern: Data Model Models Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Msiexec - T1218.007 Multi-Factor Authentication - T1556.006 Remote Desktop Protocol - T1021.001 Rundll32 - T1218.011 Search Engines - T1593.002 Server - T1583.004 Server - T1584.004 Social Media - T1593.001 Software - T1592.002 Web Shell - T1505.003 Tool - T1588.002 Vulnerabilities - T1588.006 Connection Proxy - T1090 Credential Dumping - T1003 Masquerading - T1036 Remote Desktop Protocol - T1076 Rundll32 - T1085 Web Shell - T1100 Masquerading
Show in Graph
Common Information
Type Value
UUID 5641ae1a-5a18-4176-9cae-f894783d80fd
Fingerprint 259c9f99c9b8a79d
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 10, 2024, midnight
Added to db Sept. 11, 2024, 12:27 p.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Cisco Talos Blog
Title DragonRank, a Chinese-speaking SEO manipulator service provider
Detected Hints/Tags/Attributes 149/3/65
Source URLs
Redirection Url
Details Source https://blog.talosintelligence.com/dragon-rank-seo-poisoning/?&web_view=true
Details Source https://blog.talosintelligence.com/dragon-rank-seo-poisoning/
URL Provider
Details Provider Source level domain
Details talosintelligence.com blog.talosintelligence.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 68 ✔ Cisco Talos Blog https://blog.talosintelligence.com/rss/ 2024-08-30 22:08
Details 99 ✔ Cyware News - Latest Cyber News https://cyware.com/allnews/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 1 
tttseo.com
Details Domain 2 
co.th
Details Domain 2 
admin1.tttseo.com
Details Domain 2 
ht.zip
Details Domain 1 
ddos.tttseo.com
Details Domain 1 
ddos.zip
Details Domain 1 
mail.tttseo.com
Details Domain 285 
microsoft.net
Details Domain 397 
asp.net
Details Domain 904 
snort.org
Details File 1 
c:\phpmyadmin\shell.aspx
Details File 1 
c:\awstats\wwwroot\shell.aspx
Details File 1 
pp888.tmp
Details File 1 
badpotato.exe
Details File 2 
godpotato-net4.exe
Details File 226 
certutil.exe
Details File 10 
1.aspx
Details File 127 
c:\windows\system32\rundll32.exe
Details File 2 
ht.zip
Details File 1 
ddos.zip
Details File 18 
%windir%\system32\svchost.exe
Details File 4 
%windir%\system32\winlogon.exe
Details File 1 
%windir%\system32\loginui.exe
Details File 11 
%windir%\system32\rundll32.exe
Details File 4 
%windir%\system32\dllhost.exe
Details File 6 
%windir%\system32\msiexec.exe
Details File 2 
zz.php
Details File 4 
zz1.php
Details File 2 
zk.php
Details File 2 
pq.php
Details File 2 
wh1.php
Details File 2 
zid.php
Details File 2 
xin.html
Details File 2 
zy.php
Details File 2 
xx1.php
Details File 1 
iismodex86.dll
Details File 1 
iismodex64.dll
Details File 61 
1.bat
Details File 10 
appcmd.exe
Details File 3 
c:\windows\system32\inetsrv\appcmd.exe
Details File 1 
httpresetmodule.dll
Details File 1 
httpresetmodule64.dll
Details File 1 
nc.aspx
Details File 1 
new.aspx
Details File 1 
32.aspx
Details File 1 
40222049595830.aspx
Details File 1 
image.aspx
Details File 1 
list.aspx
Details File 3 
trojan.pl
Details sha256 1 
046a03725df3104d02fa33c22e919cc73bed6fd6a905098e98c07f0f1b67fadb
Details sha256 1 
785d92dc175cb6b7889f07aa2a65d6c99e59dc1bbc9edb8f5827668fd249fa2e
Details sha256 1 
f748b210677a44597a724126a3d97173d97840b59d6deaf010c370657afc01f8
Details IPv4 1 
35.247.175.184
Details Pdb 1 
c:\users\administrator\desktop\dll\release\httpmodrespdllx64.pdb
Details Pdb 1 
c:\users\administrator\desktop\dll\release\httpmodrespdllx86.pdb
Details Pdb 1 
c:\users\administrator\desktop\httpmodrespdll\release\httpmodrespdllx64.pdb
Details Pdb 1 
c:\users\administrator\desktop\httpmodrespdll\release\httpmodrespdllx86.pdb
Details Pdb 1 
c:\users\administrator\desktop\httpmodrespdll\release\x64\httpmodrespdllx64.pdb
Details Url 1 
http://35.247.175.184:443/1.aspx
Details Url 2 
https://admin1.tttseo.com/ht.zip
Details Url 1 
http://ddos.tttseo.com/ddos/ddos.zip
Details Url 1 
http://a.googie.pw/xx1.php?host=www.[redacted].com&reurl=/wp-content/uploads/2023/&domain=www.[redacted].com
Details Windows Registry Key 26 
HKLM\SYSTEM\CurrentControlSet\Control\Terminal
Details Windows Registry Key 1 
HKEY_LOCAL_MACHINE\SOFTWARE\bINARy
Details Windows Registry Key 1 
HKEY_CURRENT_USER\SOFTWARE\bINARy