New Yokai Side-loaded Backdoor Targets Thai Officials
Tags
cmtmf-attack-pattern: Application Layer Protocol Masquerading Scheduled Task/Job
country: Thailand United States Of America
maec-delivery-vectors: Watering Hole
attack-pattern: Data Application Layer Protocol - T1437 Dll Side-Loading - T1574.002 Domains - T1583.001 Domains - T1584.001 Encrypted Channel - T1521 Encrypted Channel - T1573 Execution Guardrails - T1480 Execution Guardrails - T1627 Hide Artifacts - T1628 Hide Artifacts - T1564 Hijack Execution Flow - T1625 Hijack Execution Flow - T1574 Inter-Process Communication - T1559 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Ntfs File Attributes - T1564.004 Scheduled Task - T1053.005 Scheduled Task/Job - T1603 Symmetric Cryptography - T1521.001 Symmetric Cryptography - T1573.001 Web Protocols - T1071.001 Web Protocols - T1437.001 Standard Application Layer Protocol - T1071 Dll Side-Loading - T1073 Masquerading - T1036 Ntfs File Attributes - T1096 Scheduled Task - T1053 Masquerading
Show in Graph
Common Information
Type Value
UUID c261e7d9-7fab-47a1-8178-23ef180be4e1
Fingerprint 84e59913e7718fc1
Analysis status DONE
Considered CTI value 2
Text language
Published Dec. 13, 2024, 3 p.m.
Added to db Dec. 13, 2024, 4:13 p.m.
Last updated Dec. 24, 2024, 1:43 p.m.
Headline New Yokai Side-loaded Backdoor Targets Thai Officials
Title New Yokai Side-loaded Backdoor Targets Thai Officials
Detected Hints/Tags/Attributes 85/4/24
Source URLs
Redirection Url
Details Source https://www.netskope.com/blog/new-yokai-side-loaded-backdoor-targets-thai-officials
URL Provider
Details Provider Source level domain
Details netskope.com www.netskope.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 343 ✔ Netskope https://www.netskope.com/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 1 
idrinit.exe.data
Details Domain 4 
gen.detect.by.nscloudsandbox.tr
Details File 2 
กา.pdf
Details File 3 
องทางอาญา.docx
Details File 3 
justice.pdf
Details File 3 
matters.docx
Details File 61 
file.exe
Details File 5 
idrinit.exe
Details File 5 
productstatistics3.dll
Details File 2337 
cmd.exe
Details File 1 
path_to_idrinit.exe
Details File 1313 
index.php
Details IPv4 2 
122.155.28.155
Details IPv4 2 
154.90.47.77
Details MITRE ATT&CK Techniques 502 
T1053
Details MITRE ATT&CK Techniques 29 
T1559
Details MITRE ATT&CK Techniques 13 
T1564.004
Details MITRE ATT&CK Techniques 371 
T1036
Details MITRE ATT&CK Techniques 246 
T1574.002
Details MITRE ATT&CK Techniques 1 
T1480.002
Details MITRE ATT&CK Techniques 480 
T1071.001
Details MITRE ATT&CK Techniques 137 
T1573.001
Details Pdb 1 
eacore.pdb
Details Threat Actor Identifier - APT 605 
APT41