Sekoia.io
@sekoia_io
A #SOCplatform driven by #threatintelligence and combining #SIEM, #SIRP, #TIP, #logmanagement in a single solution. Used by End-users, MSSP and APIs
ID:907525398631780353
https://www.sekoia.io/ 12-09-2017 08:44:50
708 Tweets
3,1K Followers
147 Following
(1/7) 💡 Illumination of a large resilient infrastructure distributing #NetSupport RAT using:
- Google Ads (malvertising)
- Traffic Distribution System (TDS)
- Fake websites
- MSIX
40+ IP addresses
70+ domain names
IoCs:
gist.github.com/qbourgue/62cee…
twitter.com/Threat_Down/st…
⬇️
![Latest ACR Stealer C2 domains: trxh.]xyz trxh.]xyz trxq.]xyz trxu.]xyz Stealer configuration on the URL '/ujs/9adbbdfd-2661-43e4-8280-7f9a9698f912' Deobfuscation: - base64 - XOR {38 35 32 31 34 39 37 32 33 00} Configuration: gist.github.com/qbourgue/d0f06… twitter.com/sekoia_io/stat…](https://pbs.twimg.com/media/GMhPdqIXgAAQ-Tf.jpg "crep1x (@crep1x) on Twitter photo 2024-05-01 20:21:12 Latest ACR Stealer C2 domains: trxh.]xyz trxh.]xyz trxq.]xyz trxu.]xyz Stealer configuration on the URL '/ujs/9adbbdfd-2661-43e4-8280-7f9a9698f912' Deobfuscation: - base64 - XOR {38 35 32 31 34 39 37 32 33 00} Configuration: gist.github.com/qbourgue/d0f06… twitter.com/sekoia_io/stat…")
