Resumen APTTrail
APTTrail mantiene indicadores publicos asociados a entryshell. Aliases observados: entryshell, sparrowdoor, xiangoop. Conteo por tipo: domain: 14, ipv4: 15.
Indicadores de Compromiso (IOCs)
| Tipo | Valor | Contexto |
|---|---|---|
| Domain | aftercould.com | APTTrail |
| Domain | amelicen.com | APTTrail |
| Domain | datacentreonline.com | APTTrail |
| Domain | dateupdata.com | APTTrail |
| Domain | freedecrease.com | APTTrail |
| Domain | game.newfreepre.com | APTTrail |
| Domain | imap.dateupdata.com | APTTrail |
| Domain | imap.newlylab.com | APTTrail |
| Domain | imap.webdignusdata.com | APTTrail |
| Domain | mail.reclubpress.com | APTTrail |
| Domain | newfreepre.com | APTTrail |
| Domain | newlylab.com | APTTrail |
| Domain | reclubpress.com | APTTrail |
| Domain | webdignusdata.com | APTTrail |
| IP | 103.85.25.166:8444 | APTTrail |
| IP | 107.148.165.158:443 | APTTrail |
| IP | 107.148.165.158:80 | APTTrail |
| IP | 154.223.135.214:443 | APTTrail |
| IP | 154.223.135.214:80 | APTTrail |
| IP | 27.102.113.240:443 | APTTrail |
| IP | 27.102.113.240:80 | APTTrail |
| IP | 27.102.113.57:443 | APTTrail |
| IP | 27.102.113.57:80 | APTTrail |
| IP | 27.102.114.55:443 | APTTrail |
| IP | 27.102.114.55:80 | APTTrail |
| IP | 27.102.115.51:443 | APTTrail |
| IP | 27.102.115.51:80 | APTTrail |
| IP | 27.102.129.120:443 | APTTrail |
| IP | 27.102.129.120:80 | APTTrail |
Referencias
- https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
- https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/
- https://www.virustotal.com/gui/file/b696fe2f31279af1e006d89beb0ff0c1915df4f8a6d3a201ccda54505688840c/detection
- https://www.virustotal.com/gui/file/f81a2e8a2a272e0bdae4e267fa220d6d40e23214087f33bdcdab6c7ad10b60b8/detection
- https://www.virustotal.com/gui/ip-address/193.239.86.168/relations
- https://www.virustotal.com/gui/ip-address/43.254.216.195/relations
- https://www.virustotal.com/gui/ip-address/45.131.179.24/relations
- https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/