Multistage Attack Delivers BillGates/Setag Backdoor
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Vulnerabilities - T1588.006 Scripting - T1064 Scripting
Show in Graph
Common Information
Type Value
UUID ac1f1f9c-5590-4830-ada3-32671ba725e7
Fingerprint 90a18950a0233acf
Analysis status DONE
Considered CTI value 2
Text language
Published July 23, 2019, midnight
Added to db Oct. 15, 2024, 5:25 p.m.
Last updated Nov. 17, 2024, 5:55 p.m.
Headline Multistage Attack Delivers BillGates/Setag Backdoor
Title Multistage Attack Delivers BillGates/Setag Backdoor
Detected Hints/Tags/Attributes 51/2/12
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_ca/research/19/g/multistage-attack-delivers-billgates-setag-backdoor-can-turn-elasticsearch-databases-into-ddos-botnet-zombies.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details CVE 17 
cve-2015-1427
Details CVE 122 
cve-2017-5638
Details Domain 1 
s67.sh
Details Domain 1 
s66.sh
Details Domain 1 
crazydavesslots.com
Details Domain 1 
aduidc.xyz
Details sha256 1 
8ebd963f86ba62f45b936f6d6687ccb1e349a0f8a6cc19286457895c885695c8
Details sha256 1 
cfe3dccf9ba5a17e410e8e7cf8d0ff5c1b8688f99881b53933006250b6421468
Details IPv4 1 
3.17.149.255
Details IPv4 1 
154.223.159.5
Details Url 1 
https://crazydavesslots.com/.ppol
Details Url 1 
http://aduidc.xyz