Saefko: A new Multi-layered RAT | Zscaler Blog
Tags
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Data Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Social Media - T1593.001 Software - T1592.002 Tool - T1588.002 |
Common Information
| Type | Value |
|---|---|
| UUID | 6a98cc0f-667a-42e3-a0e5-3530cd2f8968 |
| Fingerprint | ec34be538492af8d |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Aug. 8, 2019, midnight |
| Added to db | Sept. 26, 2022, 9:31 a.m. |
| Last updated | Nov. 17, 2024, 6:54 p.m. |
| Headline | Saefko: A new multi-layered RAT |
| Title | Saefko: A new Multi-layered RAT | Zscaler Blog |
| Detected Hints/Tags/Attributes | 75/2/344 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://www.zscaler.com/blogs/research/saefko-new-multi-layered-rat |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 4 | clients3.google.com |
|
| Details | Domain | 69 | paypal.com |
|
| Details | Domain | 1 | adyen.com |
|
| Details | Domain | 1 | volusion.com |
|
| Details | Domain | 1 | pay.amazon.com |
|
| Details | Domain | 77 | apple.com |
|
| Details | Domain | 4 | atos.net |
|
| Details | Domain | 20 | authorize.net |
|
| Details | Domain | 2 | bitpay.com |
|
| Details | Domain | 1 | bpay.com |
|
| Details | Domain | 2 | braintreepayments.com |
|
| Details | Domain | 1 | centup.org |
|
| Details | Domain | 2 | cm.com |
|
| Details | Domain | 1 | creditcall.com |
|
| Details | Domain | 1 | cybersource.com |
|
| Details | Domain | 1 | mastercard.com |
|
| Details | Domain | 1 | digi.cash |
|
| Details | Domain | 1 | digitalriver.com |
|
| Details | Domain | 2 | dwolla.com |
|
| Details | Domain | 1 | elavon.com |
|
| Details | Domain | 1 | euronetworldwide.com |
|
| Details | Domain | 1 | eway.io |
|
| Details | Domain | 2 | firstdata.com |
|
| Details | Domain | 1 | fortumo.com |
|
| Details | Domain | 3 | pay.google.com |
|
| Details | Domain | 1 | heartlandpaymentsystems.com |
|
| Details | Domain | 1 | ingenico.com |
|
| Details | Domain | 1 | ippayments.com |
|
| Details | Domain | 1 | klarna.com |
|
| Details | Domain | 1 | emergentpayments.ne |
|
| Details | Domain | 1 | moduslink.com |
|
| Details | Domain | 1 | mpay.com |
|
| Details | Domain | 1 | neteller.com |
|
| Details | Domain | 1 | ofx.com |
|
| Details | Domain | 2 | payoneer.com |
|
| Details | Domain | 1 | paymentwall.com |
|
| Details | Domain | 1 | paypoint.co |
|
| Details | Domain | 1 | paysbuy.com |
|
| Details | Domain | 1 | paysafe.com |
|
| Details | Domain | 4 | paytm.com |
|
| Details | Domain | 1 | payzone.co.uk |
|
| Details | Domain | 4 | crunchbase.com |
|
| Details | Domain | 2 | qiwi.com |
|
| Details | Domain | 1 | globalpaymentsinc.com |
|
| Details | Domain | 1 | reddotpayment.com |
|
| Details | Domain | 1 | sagellc.com |
|
| Details | Domain | 2 | skrill.com |
|
| Details | Domain | 6 | stripe.com |
|
| Details | Domain | 3 | squareup.com |
|
| Details | Domain | 42 | tencent.com |
|
| Details | Domain | 1 | transfermate.com |
|
| Details | Domain | 1 | transferwise.com |
|
| Details | Domain | 2 | wmtransfer.com |
|
| Details | Domain | 1 | trustly.com |
|
| Details | Domain | 1 | wepay.com |
|
| Details | Domain | 1 | verifone.com |
|
| Details | Domain | 1 | xendpay.com |
|
| Details | Domain | 1 | pay.weixin.qq.com |
|
| Details | Domain | 2 | money.yandex.ru |
|
| Details | Domain | 1 | wirecard.com |
|
| Details | Domain | 1 | truemoney.com |
|
| Details | Domain | 1 | xsolla.com |
|
| Details | Domain | 3 | myshopify.com |
|
| Details | Domain | 1 | payza.com |
|
| Details | Domain | 1 | 2checkout.com |
|
| Details | Domain | 1 | 3dcart.com |
|
| Details | Domain | 1 | paysafecard.com |
|
| Details | Domain | 6 | weebly.com |
|
| Details | Domain | 5 | origin.com |
|
| Details | Domain | 4 | steampowered.com |
|
| Details | Domain | 1 | g2a.com |
|
| Details | Domain | 10 | twitch.tv |
|
| Details | Domain | 1 | nichegamer.com |
|
| Details | Domain | 2 | techraptor.net |
|
| Details | Domain | 1 | gematsu.com |
|
| Details | Domain | 1 | estructoid.com |
|
| Details | Domain | 2 | pcgamer.com |
|
| Details | Domain | 1 | gamefaqs.gamespot.com |
|
| Details | Domain | 2 | gamespot.com |
|
| Details | Domain | 1 | siliconera.com |
|
| Details | Domain | 1 | rockpapershotgun.com |
|
| Details | Domain | 1 | gameinformer.com |
|
| Details | Domain | 1 | decluttr.com |
|
| Details | Domain | 1 | glyde.com |
|
| Details | Domain | 1 | gamestop.com |
|
| Details | Domain | 368 | microsoft.com |
|
| Details | Domain | 8 | playstation.com |
|
| Details | Domain | 3 | nintendo.com |
|
| Details | Domain | 18 | gog.com |
|
| Details | Domain | 1 | game.co.uk |
|
| Details | Domain | 3 | itch.io |
|
| Details | Domain | 1 | gamefly.com |
|
| Details | Domain | 1 | greenmangaming.com |
|
| Details | Domain | 1 | gaming.youtube.com |
|
| Details | Domain | 3 | etoro.com |
|
| Details | Domain | 1 | 24option.com |
|
| Details | Domain | 1 | puatrack.com |
|
| Details | Domain | 2 | luno.com |
|
| Details | Domain | 1 | paxforex.com |
|
| Details | Domain | 18 | binance.com |
|
| Details | Domain | 40 | coinbase.com |
|
| Details | Domain | 39 | cex.io |
|
| Details | Domain | 2 | changelly.com |
|
| Details | Domain | 15 | coinmama.com |
|
| Details | Domain | 1 | xtrade.ae |
|
| Details | Domain | 2 | capital.com |
|
| Details | Domain | 15 | paxful.com |
|
| Details | Domain | 9 | kraken.com |
|
| Details | Domain | 10 | poloniex.com |
|
| Details | Domain | 4 | gemini.com |
|
| Details | Domain | 6 | bithumb.com |
|
| Details | Domain | 2 | xcoins.io |
|
| Details | Domain | 1 | cobinhood.com |
|
| Details | Domain | 2 | coincheck.com |
|
| Details | Domain | 3 | coinexchange.io |
|
| Details | Domain | 2 | shapeshift.io |
|
| Details | Domain | 2 | bitso.com |
|
| Details | Domain | 1 | indacoin.com |
|
| Details | Domain | 1 | cityindex.co.uk |
|
| Details | Domain | 3 | bitbay.net |
|
| Details | Domain | 5 | bitstamp.net |
|
| Details | Domain | 2 | cryptopia.co.nz |
|
| Details | Domain | 2 | pro.coinbase.com |
|
| Details | Domain | 9 | kucoin.com |
|
| Details | Domain | 3 | bitpanda.com |
|
| Details | Domain | 3 | foxbit.com.br |
|
| Details | Domain | 5 | bitflyer.com |
|
| Details | Domain | 4 | bitfinex.com |
|
| Details | Domain | 1 | bit-z.com |
|
| Details | Domain | 2 | quadrigacx.com |
|
| Details | Domain | 2 | big.one |
|
| Details | Domain | 1 | lakebtc.com |
|
| Details | Domain | 5 | wex.nz |
|
| Details | Domain | 2 | kuna.io |
|
| Details | Domain | 2 | yobit.io |
|
| Details | Domain | 1 | zebpay.com |
|
| Details | Domain | 3 | hitbtc.com |
|
| Details | Domain | 2 | bx.in.th |
|
| Details | Domain | 6 | trezor.io |
|
| Details | Domain | 3 | electrum.org |
|
| Details | Domain | 43 | blockchain.com |
|
| Details | Domain | 1 | crypto.robinhood.com |
|
| Details | Domain | 1 | exodus.io |
|
| Details | Domain | 1 | mycelium.com |
|
| Details | Domain | 18 | bitcointalk.org |
|
| Details | Domain | 7 | btc-e.com |
|
| Details | Domain | 1 | moonbit.co.in |
|
| Details | Domain | 1 | bitcoinaliens.com |
|
| Details | Domain | 1 | bitcoinwisdom.com |
|
| Details | Domain | 6 | coindesk.com |
|
| Details | Domain | 13 | cointelegraph.com |
|
| Details | Domain | 6 | ccn.com |
|
| Details | Domain | 26 | reddit.com |
|
| Details | Domain | 32 | bitcoin.org |
|
| Details | Domain | 3 | newsbtc.com |
|
| Details | Domain | 1 | blog.spectrocoin.com |
|
| Details | Domain | 1 | blog.coinbase.com |
|
| Details | Domain | 30 | bitcoinist.com |
|
| Details | Domain | 1 | forklog.com |
|
| Details | Domain | 1 | abitcoinc.com |
|
| Details | Domain | 1 | bitcoin.stackexchange.com |
|
| Details | Domain | 3 | news.bitcoin.com |
|
| Details | Domain | 1 | blog.bitfinex.com |
|
| Details | Domain | 1 | blog.genesis-mining.com |
|
| Details | Domain | 91 | instagram.com |
|
| Details | Domain | 330 | facebook.com |
|
| Details | Domain | 198 | youtube.com |
|
| Details | Domain | 19 | plus.google.com |
|
| Details | Domain | 1174 | gmail.com |
|
| Details | Domain | 49 | mail.google.com |
|
| Details | Domain | 2 | boohoo.com |
|
| Details | Domain | 1 | gymshark.com |
|
| Details | Domain | 1 | prettylittlething.com |
|
| Details | Domain | 1 | showpo.com |
|
| Details | Domain | 1 | athleta.com |
|
| Details | Domain | 1 | ae.com |
|
| Details | Domain | 1 | ruelala.com |
|
| Details | Domain | 3 | asos.com |
|
| Details | Domain | 1 | superdry.com |
|
| Details | Domain | 1 | zaful.com |
|
| Details | Domain | 1 | zafulswimwear.com |
|
| Details | Domain | 1 | luckybrand.com |
|
| Details | Domain | 4 | forever21.com |
|
| Details | Domain | 1 | urbanoutfitters.com |
|
| Details | Domain | 2 | nastygal.com |
|
| Details | Domain | 1 | jcrew.com |
|
| Details | Domain | 1 | anthropologie.com |
|
| Details | Domain | 1 | allsaints.com |
|
| Details | Domain | 1 | uniqlo.com |
|
| Details | Domain | 1 | armaniexchange.com |
|
| Details | Domain | 1 | fashionnova.com |
|
| Details | Domain | 1 | saksoff5th.com |
|
| Details | Domain | 103 | target.com |
|
| Details | Domain | 4 | macys.com |
|
| Details | Domain | 1 | barneys.com |
|
| Details | Domain | 4 | zappos.com |
|
| Details | Domain | 1 | sneakersnstuff.com |
|
| Details | Domain | 1 | yoox.com |
|
| Details | Domain | 5 | nike.com |
|
| Details | Domain | 1 | simmi.com |
|
| Details | Domain | 295 | amazon.com |
|
| Details | Domain | 25 | ebay.com |
|
| Details | Domain | 12 | walmart.com |
|
| Details | Domain | 8 | newegg.com |
|
| Details | Domain | 7 | bestbuy.com |
|
| Details | Domain | 1 | ftd.com |
|
| Details | Domain | 1 | 1800flowers.com |
|
| Details | Domain | 1 | glossier.com |
|
| Details | Domain | 1 | sephora.com |
|
| Details | Domain | 1 | thebodyshop.com |
|
| Details | Domain | 1 | ulta.com |
|
| Details | Domain | 1 | horchow.com |
|
| Details | Domain | 3 | homedepot.com |
|
| Details | Domain | 1 | pier1.com |
|
| Details | Domain | 1 | bedbathandbeyond.com |
|
| Details | Domain | 1 | wayfair.com |
|
| Details | Domain | 1 | shoptiques.com |
|
| Details | Domain | 1 | viator.com |
|
| Details | Domain | 6 | etsy.com |
|
| Details | Domain | 1 | cloud9living.com |
|
| Details | Domain | 1 | seatgeek.com |
|
| Details | Domain | 12 | aliexpress.com |
|
| Details | Domain | 21 | alibaba.com |
|
| Details | Domain | 80 | linkedin.com |
|
| Details | Domain | 1373 | twitter.com |
|
| Details | Domain | 1 | nasdaq.com |
|
| Details | Domain | 7 | ft.com |
|
| Details | Domain | 28 | reuters.com |
|
| Details | Domain | 1 | nyse.com |
|
| Details | Domain | 1 | tsx.com |
|
| Details | Domain | 4 | marketwatch.com |
|
| Details | Domain | 1 | thestreet.com |
|
| Details | Domain | 14 | wsj.com |
|
| Details | Domain | 8 | investing.com |
|
| Details | Domain | 2 | investopedia.com |
|
| Details | Domain | 13 | finance.yahoo.com |
|
| Details | Domain | 1 | seekingalpha.com |
|
| Details | Domain | 2 | fool.com |
|
| Details | Domain | 1 | investorguide.com |
|
| Details | Domain | 6 | zacks.com |
|
| Details | Domain | 1 | home.saxo |
|
| Details | Domain | 1 | forexbrokers.com |
|
| Details | Domain | 1 | swissquote.com |
|
| Details | Domain | 1 | cmcmarkets.com |
|
| Details | Domain | 1 | fxpro.co.uk |
|
| Details | Domain | 1 | forex.com |
|
| Details | Domain | 1 | dukascopy.com |
|
| Details | Domain | 1 | interactivebrokers.com |
|
| Details | Domain | 4 | tdameritrade.com |
|
| Details | Domain | 1 | bankofinternet.com |
|
| Details | Domain | 1 | ally.com |
|
| Details | Domain | 1 | bankpurely.com |
|
| Details | Domain | 1 | redneck.bank |
|
| Details | Domain | 123 | ipinfo.io |
|
| Details | Domain | 1 | irc.afterx.net |
|
| Details | Domain | 1 | irc.cyanide-x.net |
|
| Details | Domain | 3 | chat.freenode.net |
|
| Details | Domain | 1 | irc.europnet.org |
|
| Details | Domain | 1 | irc.azzurra.org |
|
| Details | Domain | 1 | irc.rizon.net |
|
| Details | Domain | 5 | irc.dal.net |
|
| Details | Domain | 1 | irc.efnet.org |
|
| Details | Domain | 1 | irc.gamesurge.net |
|
| Details | Domain | 1 | open.ircnet.net |
|
| Details | Domain | 1 | irc.quakenet.org |
|
| Details | Domain | 1 | irc.swiftirc.net |
|
| Details | Domain | 1 | eu.undernet.org |
|
| Details | Domain | 1 | irc.webchat.org |
|
| Details | Domain | 1 | irc.2600.net |
|
| Details | Domain | 1 | irc.abjects.net |
|
| Details | Domain | 1 | irc.accessirc.net |
|
| Details | Domain | 1 | irc.afternet.org |
|
| Details | Domain | 1 | irc.data.lt |
|
| Details | Domain | 1 | irc.allnetwork.org |
|
| Details | Domain | 1 | irc.alphachat.net |
|
| Details | Domain | 1 | irc.austnet.org |
|
| Details | Domain | 1 | irc.axenet.org |
|
| Details | Domain | 1 | irc.ayochat.or.id |
|
| Details | Domain | 1 | irc.beyondirc.net |
|
| Details | Domain | 1 | irc.blitzed.org |
|
| Details | Domain | 1 | irc.bongster.org |
|
| Details | Domain | 1 | irc.caelestia.net |
|
| Details | Domain | 1 | irc.canternet.org |
|
| Details | Domain | 1 | irc.chatall.org |
|
| Details | Domain | 1 | irc.chatcafe.net |
|
| Details | Domain | 1 | irc.chatspike.net |
|
| Details | Domain | 1 | irc.chatzona.org |
|
| Details | Domain | 1 | irc.criten.net |
|
| Details | Domain | 1 | irc.cyberarmy.net |
|
| Details | Domain | 1 | irc.d-t-net.de |
|
| Details | Domain | 1 | irc.darkmyst.org |
|
| Details | Domain | 1 | irc.deepspace.org |
|
| Details | Domain | 1 | irc.dream-irc.de |
|
| Details | Domain | 1 | irc.drlnet.com |
|
| Details | Domain | 1 | irc.dynastynet.net |
|
| Details | Domain | 1 | irc.echo.com |
|
| Details | Domain | 1 | irc.ecnet.org |
|
| Details | Domain | 1 | irc.enterthegame.com |
|
| Details | Domain | 1 | irc.epiknet.org |
|
| Details | Domain | 1 | irc.esper.net |
|
| Details | Domain | 1 | irc.euirc.net |
|
| Details | Domain | 1 | irc.evolu.net |
|
| Details | Domain | 1 | irc.explosionirc.net |
|
| Details | Domain | 1 | irc.fdfnet.net |
|
| Details | Domain | 1 | irc.fef.net |
|
| Details | Domain | 1 | aforge.video |
|
| Details | Domain | 1 | industry.aeconex.com |
|
| Details | Domain | 1 | receipt-inv.zip |
|
| Details | Domain | 1 | deqwrqwer.kl.com.ua |
|
| Details | Domain | 1 | maprivate.date |
|
| Details | Domain | 1 | bw20feb19.zip |
|
| Details | Domain | 1 | acpananma.com |
|
| Details | Domain | 1 | f0278951.xsph.ru |
|
| Details | File | 1 | saefkoagent.exe |
|
| Details | File | 26 | windows.exe |
|
| Details | File | 1260 | explorer.exe |
|
| Details | File | 1 | m.pl |
|
| Details | File | 85 | log.txt |
|
| Details | File | 1 | %appdata%\local\log.txt |
|
| Details | File | 1 | irc.swift |
|
| Details | File | 1 | irc.dat |
|
| Details | File | 1 | irc.ep |
|
| Details | File | 2125 | cmd.exe |
|
| Details | File | 1 | aforge.dll |
|
| Details | File | 1 | directshow.dll |
|
| Details | File | 4 | video.dll |
|
| Details | File | 104 | sqlite3.dll |
|
| Details | File | 2 | sas.exe |
|
| Details | File | 1 | usbstart.exe |
|
| Details | File | 1 | usbspread.vbs |
|
| Details | File | 1 | receipt-inv.zip |
|
| Details | File | 8 | vmp.exe |
|
| Details | File | 1 | bw20feb19.zip |
|
| Details | File | 24 | server.php |
|
| Details | md5 | 1 | D9B0ECCCA3AF50E9309489848EB59924 |
|
| Details | md5 | 1 | C4825334DA8AA7EA9E81B6CE18F9C15F |
|
| Details | md5 | 1 | 952572F16A955745A50AAF703C30437C |
|
| Details | md5 | 1 | 4F2607FAEC3CB30DC8C476C7029F9046 |
|
| Details | md5 | 1 | 7CCCB06681E7D62B2315761DBE3C81F9 |
|
| Details | md5 | 1 | 5B516EAB606DC3CC35B0494643129058 |
|
| Details | IPv4 | 1 | 3.121.182.157 |
|
| Details | Url | 1 | https://ipinfo.io/geo |
|
| Details | Windows Registry Key | 1 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer |
|
| Details | Windows Registry Key | 1 | HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer |