Examining XLoader, FakeSpy, and the Yanbian Gang
Tags
country: China Japan South Korea
attack-pattern: Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Social Media - T1593.001 Whois - T1596.002
Show in Graph
Common Information
Type Value
UUID c5f58c2c-f285-4ce7-bcc7-89f7959940f3
Fingerprint 3c1d9d999242f21f
Analysis status DONE
Considered CTI value 0
Text language
Published Nov. 26, 2018, midnight
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Oct. 15, 2024, 5:18 p.m.
Headline Examining XLoader, FakeSpy, and the Yanbian Gang
Title Examining XLoader, FakeSpy, and the Yanbian Gang
Detected Hints/Tags/Attributes 37/2/2
Source URLs
Redirection Url
Details Source https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/
Details Source https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html
Details Source https://www.trendmicro.com/en_ca/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Details trendmicro.com blog.trendmicro.com
Attributes
Details Type #Events CTI Value
Details sha256 1 
bf0ad39d8a19b9bc385fb629e3227dec4012e1f5a316e8a30c932202624e8e0e
Details sha256 1 
ba5b85a4dd70b96f4a43bda5eb66e546facc4e3523f78a91fc01c768c6de5c24