Resumen APTTrail
APTTrail mantiene indicadores publicos asociados a danbot. Aliases observados: danbot, hexane, lyceum. Conteo por tipo: domain: 45, ipv4: 7.
Indicadores de Compromiso (IOCs)
| Tipo | Valor | Contexto |
|---|---|---|
| Domain | akastatus.com | APTTrail |
| Domain | bsolutions-cloude.com | APTTrail |
| Domain | centosupdatecdn.com | APTTrail |
| Domain | cloudmsn.net | APTTrail |
| Domain | cyberclub.one | APTTrail |
| Domain | cybersecnet.co.za | APTTrail |
| Domain | cybersecnet.org | APTTrail |
| Domain | defenderlive.com | APTTrail |
| Domain | defenderstatus.com | APTTrail |
| Domain | digitalmarketingnews.net | APTTrail |
| Domain | dmgagency.net | APTTrail |
| Domain | dnscachecloud.com | APTTrail |
| Domain | dnscatalog.net | APTTrail |
| Domain | dnscdn.org | APTTrail |
| Domain | dnscloudservice.com | APTTrail |
| Domain | dnsstatus.org | APTTrail |
| Domain | excsrvcdn.com | APTTrail |
| Domain | he-express-marketing.com | APTTrail |
| Domain | hpesystem.com | APTTrail |
| Domain | jobschippc.com | APTTrail |
| Domain | livecdn.com | APTTrail |
| Domain | main.download | APTTrail |
| Domain | mastertape.org | APTTrail |
| Domain | microsftonline.net | APTTrail |
| Domain | msnnews.org | APTTrail |
| Domain | news-reporter.xyz | APTTrail |
| Domain | news-spot.live | APTTrail |
| Domain | news-spot.xyz | APTTrail |
| Domain | online-analytic.com | APTTrail |
| Domain | onlineoutlook.net | APTTrail |
Referencias
- https://medium.com/@Manu_De_Lucia/exploding-the-danbot-code-to-hunt-for-hexanes-cyber-weapon-3d466775f480
- https://otx.alienvault.com/pulse/5d656065aaa9ac9b19ef75c2
- https://otx.alienvault.com/pulse/611cebb137fe5c6475b044f5
- https://otx.alienvault.com/pulse/624c29baad734a210134b02c
- https://otx.alienvault.com/pulse/6298718ccb0c8c00f0485af3
- https://otx.alienvault.com/pulse/62b598f4ee9576cd17e3ad87
- https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/
- https://twitter.com/Manu_De_Lucia/status/1208388233731678208
- https://twitter.com/RedDrip7/status/1537389704374431744
- https://twitter.com/RedDrip7/status/1564090684612952064
- https://twitter.com/blackorbird/status/1166345000826724352
- https://twitter.com/fr0s7_/status/1503678175284449288