Keitaro TDS Leads to RIG-v EK at 188.225.36.231
Tags
| attack-pattern: | Control Panel - T1218.002 Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 |
Common Information
| Type | Value |
|---|---|
| UUID | 896a1c51-0c89-43cd-a4cd-9892f942e2ac |
| Fingerprint | ee733158bcea16cf |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Feb. 8, 2017, 9:39 p.m. |
| Added to db | Jan. 18, 2023, 9:59 p.m. |
| Last updated | Nov. 18, 2024, 1:38 a.m. |
| Headline | Keitaro TDS Leads to RIG-v EK at 188.225.36.231 |
| Title | Keitaro TDS Leads to RIG-v EK at 188.225.36.231 |
| Detected Hints/Tags/Attributes | 27/1/26 |
Source URLs
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 2 | hand.stayatsouthpadre.com |
|
| Details | Domain | 1 | pivesso.us |
|
| Details | Domain | 10 | curlmyip.net |
|
| Details | Domain | 35 | resolver1.opendns.com |
|
| Details | Domain | 20 | 222.222.67.208.in-addr.arpa |
|
| Details | Domain | 35 | myip.opendns.com |
|
| Details | Domain | 2 | tds.com |
|
| Details | Domain | 1 | qhoster.net |
|
| Details | File | 1 | oni64.gif |
|
| Details | File | 52 | exploit.swf |
|
| Details | File | 1 | rad1f7d9.tmp |
|
| Details | File | 1 | bthmpsvc.exe |
|
| Details | File | 1 | brothers.dll |
|
| Details | File | 47 | min.css |
|
| Details | File | 1 | style_v2_optimized.css |
|
| Details | File | 2127 | cmd.exe |
|
| Details | File | 1 | appdataroamingmicrosoftapdsclntbthmpsvc.exe |
|
| Details | sha256 | 1 | 0c1b3a0131c98032141d2315902b546bd926d5d4365628dafbbfca165f934f12 |
|
| Details | sha256 | 1 | ddb35d228fbd3cd4d6eb78063bd407e8e95708925e8568bd3b7e7933ad7308c7 |
|
| Details | sha256 | 1 | 2013911086eeba13ee90a57d81a27fabdab52e9896f0ec55e7b9aec0528c57b7 |
|
| Details | sha256 | 1 | fda8e2088f7ca3f22d90e0ce3a9e2e466b7a30e96cfc166059156aabab3dea1b |
|
| Details | sha256 | 1 | 732459cebedadc55d5011689102d5ad91fe8cbcf40ec9228eaa2e31d2d7a4ecb |
|
| Details | IPv4 | 2 | 188.225.36.231 |
|
| Details | IPv4 | 1 | 31.11.32.225 |
|
| Details | IPv4 | 6 | 37.48.122.26 |
|
| Details | IPv4 | 24 | 222.222.67.208 |