From URSNIF IoCs to Software Spoofing: Using DNS Intel to Connect the Dots
Tags
country: Aruba Italy
attack-pattern: Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Email Addresses - T1589.002 Impersonation - T1656 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Software - T1592.002 Whois - T1596.002
Show in Graph
Common Information
Type Value
UUID b6cd5bb0-6e3b-40b4-83fc-b433f5450550
Fingerprint e09929c10352f7e0
Analysis status DONE
Considered CTI value 0
Text language
Published Oct. 4, 2023, midnight
Added to db Oct. 5, 2023, 2:24 a.m.
Last updated Sept. 4, 2024, 4:15 p.m.
Headline UNKNOWN
Title From URSNIF IoCs to Software Spoofing: Using DNS Intel to Connect the Dots
Detected Hints/Tags/Attributes 36/2/36
Source URLs
Redirection Url
Details Source https://circleid.com/posts/20231004-from-ursnif-iocs-to-software-spoofing-using-dns-intel-to-connect-the-dots
URL Provider
Details Provider Source level domain
Details circleid.com circleid.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 163 ✔ — https://media.cert.europa.eu/rss?type=category&id=Malware&language=en&duplicates=false 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details IPv4 1 
54.153.56.183
Details IPv4 28 
34.102.136.180
Details IPv4 1 
91.216.248.22
Details IPv4 1 
91.216.248.21
Details IPv4 2 
91.216.248.20
Details IPv4 2 
45.79.222.138
Details IPv4 1 
162.55.0.137
Details IPv4 6 
15.197.142.173
Details Domain 1 
whoisprotection.cc
Details Domain 2 
avas1t.de
Details Domain 3 
debian-package.center
Details Domain 1 
avastone.com.de
Details Domain 1 
avast2014win81.com.de
Details Domain 1 
duchangzuidebianhucijisilu.se.net
Details Domain 1 
avasthome.site
Details Domain 1 
avastargallery.com
Details Domain 1 
debianns.com
Details Domain 1 
avastwin81.clan.rip
Details Domain 1 
avastwin81.webspace.rocks
Details Domain 1 
agenda-debian-test.2ix.de
Details Domain 1 
avast-free-antivirus.2ix.de
Details Domain 1 
debian4.clan.rip
Details Domain 1 
debian6.4lima.ch
Details Domain 1 
avast2014pojie.4lima.de
Details Domain 1 
debianpcjjos.lima-city.de
Details Domain 1 
httpd-debian.lima-city.de
Details Domain 1 
avastwin81.com.ph
Details Domain 1 
debian6.org.ph
Details Domain 1 
debianvm.mil.ph
Details Domain 1 
avast-free-antivirus.square7.de
Details Domain 1 
debian3.bplaced.net
Details Domain 1 
debianhelp.square7.de
Details Domain 1 
avastgalaxy.com
Details Domain 1 
avastlog.com
Details Domain 1 
avastore2023.com
Details Domain 45 
byipv4.global