Inside the IcedID BackConnect Protocol
Tags
country: Moldova Ukraine
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Sms Messages - T1636.004 Software - T1592.002 Ssh - T1021.004 Vnc - T1021.005 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID ed13807d-6172-4ee1-a9c4-7f66477846ce
Fingerprint 8e50ea978530ac05
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 21, 2022, 5:15 p.m.
Added to db June 5, 2023, 1:43 p.m.
Last updated Dec. 23, 2024, 4:12 p.m.
Headline Inside the IcedID BackConnect Protocol
Title Inside the IcedID BackConnect Protocol
Detected Hints/Tags/Attributes 56/2/14
Source URLs
Redirection Url
Details Source https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol
URL Provider
Details Provider Source level domain
Details team-cymru.com www.team-cymru.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 377 ✔ Team Cymru https://www.team-cymru.com/blog-feed.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 1492 
twitter.com
Details Domain 1 
onlinesim.ru
Details IPv4 2 
51.89.201.236
Details IPv4 1 
135.125.242.223
Details IPv4 1 
198.244.187.242
Details IPv4 4 
135.181.175.108
Details IPv4 5 
137.74.104.108
Details IPv4 1 
176.31.136.226
Details IPv4 1 
185.156.172.97
Details IPv4 2 
188.40.246.37
Details IPv4 1 
198.251.84.61
Details IPv4 2 
212.114.52.91
Details IPv4 4 
51.195.169.87
Details Url 1 
https://twitter.com/netresec/status/1577966512459087874