Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion
Tags
country: China
attack-pattern: Data Dns - T1071.004 Dns - T1590.002 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Timestomp - T1070.006 Tool - T1588.002 Connection Proxy - T1090 Timestomp - T1099
Show in Graph
Common Information
Type Value
UUID 570dff35-b46b-447b-94f1-4f500f666788
Fingerprint b4507c49aa1d4ed3
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 4, 2024, midnight
Added to db Sept. 4, 2024, 10:37 a.m.
Last updated Oct. 15, 2024, 11:52 p.m.
Headline Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion
Title Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion
Detected Hints/Tags/Attributes 63/2/3
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_us/research/24/i/earth-lusca-ktlvdoor.html
Details Source https://www.trendmicro.com/en_us/research/24/i/earth-lusca-ktlvdoor.html?&web_view=true
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 99 ✔ Cyware News - Latest Cyber News https://cyware.com/allnews/feed 2024-08-30 22:08
Details 119 ✔ Trend Micro Research, News and Perspectives https://feeds.feedburner.com/TrendMicroSimplySecurity 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 7 
myip.ipip.net
Details Url 7 
http://myip.ipip.net
Details Windows Registry Key 7 
HKLM\SOFTWARE\Microsoft\Cryptography