Examining a Possible Member of the Winnti Group
Tags
country: Hong Kong South Korea
attack-pattern: Data Direct Digital Certificates - T1596.003 Digital Certificates - T1587.003 Digital Certificates - T1588.004 Domains - T1583.001 Domains - T1584.001 Email Addresses - T1589.002 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Virtual Private Server - T1583.003 Virtual Private Server - T1584.003
Show in Graph
Common Information
Type Value
UUID e31eec78-3ae0-446d-adb5-8e704eec417f
Fingerprint ee91add04af1a781
Analysis status DONE
Considered CTI value 0
Text language
Published April 19, 2017, midnight
Added to db Jan. 18, 2023, 9:06 p.m.
Last updated Sept. 1, 2024, 4:50 p.m.
Headline Examining a Possible Member of the Winnti Group
Title Examining a Possible Member of the Winnti Group
Detected Hints/Tags/Attributes 59/2/12
Source URLs
Redirection Url
Details Source http://blog.trendmicro.com/trendlabs-security-intelligence/pigs-malware-examining-possible-member-winnti-group/
Details Source https://blog.trendmicro.com/trendlabs-security-intelligence/pigs-malware-examining-possible-member-winnti-group/
URL Provider
Details Provider Source level domain
Details trendmicro.com blog.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
hack520.co.kr
Details Domain 1 
shaiya.kr
Details Domain 1 
zhu.kr
Details Domain 1 
shenqi.kr
Details Domain 1 
zhuxian.kr
Details Domain 1 
93.gd
Details Domain 1 
66.to
Details Domain 1 
secure.66.to
Details Domain 1 
zhu.vn
Details Domain 1 
mtrue.com
Details IPv4 1 
43.255.188.0
Details IPv4 1 
43.255.191.255