It's alive!
Tags
country: Laos Russia United States Of America
attack-pattern: Data Direct Model Credentials - T1589.001 Malware - T1587.001 Malware - T1588.001 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 Remote Access Tools - T1219
Show in Graph
Common Information
Type Value
UUID b77b6d3d-62e5-40dc-93d4-897de4fc0a57
Fingerprint 3f917059740dbec1
Analysis status DONE
Considered CTI value 0
Text language
Published June 8, 2021, midnight
Added to db Aug. 31, 2024, 12:51 a.m.
Last updated Nov. 17, 2024, 6:49 p.m.
Headline UNKNOWN
Title It's alive!
Detected Hints/Tags/Attributes 92/2/24
Source URLs
Redirection Url
Details Source https://blog.group-ib.com/blackmatter#
Details Source https://blog.group-ib.com/blackmatter
URL Provider
Details Provider Source level domain
Details group-ib.com blog.group-ib.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 36 ✔ Blog Group-IB https://blog.group-ib.com/rss.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 1 
hhcp.com
Details Domain 10 
paymenthacks.com
Details Domain 11 
mojobiden.com
Details Email 1 
aheisler@hhcp.com
Details Email 1 
dsmith@hhcp.com
Details Email 1 
administrator@hhcp.com
Details File 367 
readme.txt
Details File 351 
recycle.bin
Details File 33 
config.msi
Details File 196 
desktop.ini
Details File 243 
autorun.inf
Details File 99 
bootsect.bak
Details File 143 
thumbs.db
Details File 120 
boot.ini
Details File 193 
ntuser.dat
Details File 101 
iconcache.db
Details File 90 
bootfont.bin
Details File 66 
ntuser.ini
Details File 100 
ntuser.dat.log
Details Url 2 
https://paymenthacks.com
Details Url 3 
http://paymenthacks.com
Details Url 3 
https://mojobiden.com
Details Url 4 
http://mojobiden.com
Details Windows Registry Key 7 
HKLM\SOFTWARE\Microsoft\Cryptography