TeamTNT Now Deploying DDoS-Capable IRC Bot TNTbotinger
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Bash History - T1552.003 Credentials - T1589.001 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Serverless - T1583.007 Serverless - T1584.007 Ssh - T1021.004 Unix Shell - T1059.004 Web Services - T1583.006 Web Services - T1584.006 Tool - T1588.002 Vulnerabilities - T1588.006 Unix Shell - T1623.001 Bash History - T1139 Denial Of Service
Show in Graph
Common Information
Type Value
UUID edb605f0-be50-4ce2-9b00-f717f18f47b4
Fingerprint 37a1c91104a7bf8d
Analysis status DONE
Considered CTI value 2
Text language
Published Dec. 18, 2020, midnight
Added to db Sept. 11, 2022, 12:37 p.m.
Last updated Dec. 21, 2024, 3:29 a.m.
Headline TeamTNT Now Deploying DDoS-Capable IRC Bot TNTbotinger
Title TeamTNT Now Deploying DDoS-Capable IRC Bot TNTbotinger
Detected Hints/Tags/Attributes 75/2/7
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_ie/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_se/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_nl/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_be/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_ph/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
Details Source https://www.trendmicro.com/en_fi/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 49 
trojan.sh
Details File 136 
tar.gz
Details sha256 3 
d9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66
Details sha256 2 
e52646f7cb2886d8a5d4c1a2692a5ab80926e7ce48bdb2362f383c0c6c7223a2
Details sha256 3 
252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a
Details sha256 2 
b666cd08b065132235303727f2d77997a30355ae0e5b557cd08d41c9ade7622d
Details sha256 4 
e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3