Resumen APTTrail
APTTrail mantiene indicadores publicos asociados a APT REAPER. Aliases observados: APT REAPER. Conteo por tipo: domain: 19, file_path: 1.
Indicadores de Compromiso (IOCs)
| Tipo | Valor | Contexto |
|---|---|---|
| Domain | account.drive-google-com.tk | APTTrail |
| Domain | account.gommask.online | APTTrail |
| Domain | accounts-youtube.drive-google-com.tk | APTTrail |
| Domain | anyportals.com | APTTrail |
| Domain | cgalim.com | APTTrail |
| Domain | dns-update.club | APTTrail |
| Domain | drive-google-com.tk | APTTrail |
| Domain | gmail.drive-google-com.tk | APTTrail |
| Domain | gommask.online | APTTrail |
| Domain | hakproperty.com | APTTrail |
| Domain | hpserver.online | APTTrail |
| Domain | iblcor.cafe24.com | APTTrail |
| Domain | imagedownloadsupport.com | APTTrail |
| Domain | login.drive-google-com.tk | APTTrail |
| Domain | mailattachmentimageurlxyz.site | APTTrail |
| Domain | mumbai-m.site | APTTrail |
| Domain | pmoae.com | APTTrail |
| Domain | proxycheker.pro | APTTrail |
| Domain | ssl-gstatic.drive-google-com.tk | APTTrail |
| FILE_PATH | /bbs/pu.php?do=upload | APTTrail |
Referencias
- https://blog.talosintelligence.com/2018/04/fake-av-investigation-unearths-kevdroid.html
- https://github.com/Cisco-Talos/IOCs/blob/main/2023/11/new-sugargh0st-rat.txt
- https://github.com/Cisco-Talos/IOCs/blob/main/2024/06/sneakychef-sugargh0st-rat.txt
- https://researchcenter.paloaltonetworks.com/2018/04/unit42-reaper-groups-updated-mobile-arsenal/
- https://twitter.com/QW5kcmV3/status/1033495729258606597
- https://twitter.com/h2jazi/status/1699821987361702229
- https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
- https://www.genians.co.kr/blog/threat_intelligence/k-messenger
- https://www.virustotal.com/gui/file/3a68d6bceb126fa26fa3549ccc8ac15d33066929152e628ae03edda4a1f42eae/detection
- https://www.virustotal.com/gui/file/7c87451261dfce64fda987eb395694b5330fd958466c46c931440cd9dc227505/detection
- https://www.virustotal.com/gui/file/81973e40fdb988d38342c901f334c402dd08cf4372ca8cffe038b62dade30e19/detection
- https://www.virustotal.com/gui/file/d0775ec420a4938cbf1b2e9432677e08fcfbde6f424a8f7289e57e31f9334b74/detection