Chaos: a Stolen Backdoor Rising Again - GoSecure
Tags
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Credentials - T1589.001 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Ssh - T1021.004 Connection Proxy - T1090 Rootkit - T1014 Rootkit
Show in Graph
Common Information
Type Value
UUID 6fcc5dbf-6a8d-477a-9b53-312924e98fb0
Fingerprint a1869018653aac51
Analysis status DONE
Considered CTI value 0
Text language
Published Feb. 14, 2018, 4 p.m.
Added to db Feb. 18, 2023, 1:24 a.m.
Last updated Oct. 1, 2024, 2:32 p.m.
Headline Chaos: a Stolen Backdoor Rising Again
Title Chaos: a Stolen Backdoor Rising Again - GoSecure
Detected Hints/Tags/Attributes 52/1/6
Source URLs
Redirection Url
Details Source http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/
Details Redirection http://www.gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/
Details Source https://www.gosecure.net/blog/2018/02/14/chaos-a-stolen-backdoor-rising/
URL Provider
Details Provider Source level domain
Details gosecure.net www.gosecure.net
Details gosecure.net gosecure.net
Attributes
Details Type #Events CTI Value
Details Domain 7 
xxx.xxx.xxx
Details Domain 22 
hackforums.net
Details File 1 
default2.jpg
Details IPv4 4 
89.234.157.254
Details IPv4 3 
192.42.116.16
Details Url 1 
http://xxx.xxx.xxx.29/cs/default2.jpg