otx.alienvault.com Open in urlscan Pro
13.32.121.88  Public Scan

Form analysis
0 forms found in the DOM

Text Content

×

   
 * Browse
 * Scan Endpoints
 * Create Pulse
 * Submit Sample
 * API Integration
   
   
 * Login | Sign Up
   

All
   
 * Login | Sign Up
   
 * 
   

Share
Actions
Subscribers (224939)
Suggest Edit
Clone
Embed
Download
Report Spam



APT43: NORTH KOREAN GROUP USES CYBERCRIME TO FUND ESPIONAGE OPERATIONS

   
 * Created 3 hours ago by AlienVault
 * Public
 * TLP: White

Mandiant assesses with high confidence that APT43 is a moderately-sophisticated
cyber operator that supports the interests of the North Korean regime.

Reference:
https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report
Tags:
phishing, code signing, install digital, ingress tool, run keys, mshta, bypass
user, crypto mining, android, espionage, backdoor
Adversary:
APT43
Industries:
Government, Education, Business, Manufacturing
Targeted Countries:
Korea, Democratic People's Republic of , Japan
Malware Families:
Ghost RAT , Quasarrat , Amadey
Att&ck IDs:
T1007 - System Service Discovery , T1010 - Application Window Discovery , T1012
- Query Registry , T1016 - System Network Configuration Discovery , T1020 -
Automated Exfiltration , T1027 - Obfuscated Files or Information , T1033 -
System Owner/User Discovery , T1036 - Masquerading , T1047 - Windows Management
Instrumentation , T1053 - Scheduled Task/Job , T1055 - Process Injection , T1056
- Input Capture , T1057 - Process Discovery , T1059 - Command and Scripting
Interpreter , T1070 - Indicator Removal on Host , T1071 - Application Layer
Protocol , T1082 - System Information Discovery , T1083 - File and Directory
Discovery , T1087 - Account Discovery , T1090 - Proxy , T1095 - Non-Application
Layer Protocol , T1102 - Web Service , T1105 - Ingress Tool Transfer , T1110 -
Brute Force , T1112 - Modify Registry , T1113 - Screen Capture , T1115 -
Clipboard Data , T1129 - Shared Modules , T1132 - Data Encoding , T1134 - Access
Token Manipulation , T1137 - Office Application Startup , T1140 -
Deobfuscate/Decode Files or Information , T1203 - Exploitation for Client
Execution , T1204 - User Execution , T1213 - Data from Information Repositories
, T1218 - Signed Binary Proxy Execution , T1489 - Service Stop , T1497 -
Virtualization/Sandbox Evasion , T1505 - Server Software Component , T1518 -
Software Discovery , T1529 - System Shutdown/Reboot , T1543 - Create or Modify
System Process , T1547 - Boot or Logon Autostart Execution , T1548 - Abuse
Elevation Control Mechanism , T1553 - Subvert Trust Controls , T1555 -
Credentials from Password Stores , T1560 - Archive Collected Data , T1564 - Hide
Artifacts , T1566 - Phishing , T1569 - System Services , T1573 - Encrypted
Channel , T1583 - Acquire Infrastructure , T1584 - Compromise Infrastructure ,
T1588 - Obtain Capabilities , T1608 - Stage Capabilities

Endpoint Security
Scan your endpoints for IOCs from this Pulse!
Learn more
 * Indicators of Compromise (124)
 * Related Pulses (0)
 * Comments (0)
 * History (0)

FileHash-MD5 (42)FileHash-SHA256 (41)Domain (1)FileHash-SHA1 (40)

TYPES OF INDICATORS

Show
10 25 50 100
entries
Search:

type

indicator

Role

title

Added

Active

related Pulses

FileHash-SHA256fb7fb6dbaf568b568cd5e60ab537a42d5982949a5e577db53cc707012c7f20e3VMProtectMar
29, 2023, 10:40:25 PM0

FileHash-SHA256d0971d098b0f8cf2187feeed3ce049930f19ec3379b141ec6a2f2871b1e90ff7Mar
29, 2023, 10:40:25 PM0

FileHash-SHA25694aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579vad_contains_network_stringsMar
29, 2023, 10:40:25 PM1

FileHash-SHA256855656bfecc359a1816437223c4a133359e73ecf45acda667610fbe7875ab3c8Mar
29, 2023, 10:40:25 PM0

FileHash-SHA2565cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4bvad_contains_network_stringsMar
29, 2023, 10:40:25 PM1

FileHash-SHA256557ff6c87c81a2d2348bd8d667ea8412a1a0a055f5e1ae91701c2954ca8a3fdbMar
29, 2023, 10:40:25 PM0

FileHash-SHA25643c2d5122af50363c29879501776d907eaa568fa142d935f6c80e823d18223f5Mar
29, 2023, 10:40:25 PM0

FileHash-SHA2562b78d5228737a38fa940e9ab19601747c68ed28e488696694648e3d70e53eb5aMar
29, 2023, 10:40:25 PM0

FileHash-SHA25607aed9fa864556753de0a664d22854167a3d898820bc92be46b1977c68b12b34Mar
29, 2023, 10:40:25 PM1

FileHash-SHA1f3b047e6eb3964deb047767fad52851c5601483fVMProtectMar 29, 2023,
10:40:25 PM0


SHOWING 1 TO 10 OF 124 ENTRIES
1
2
3
4
5
...
13
Next


COMMENTS

You must be logged in to leave a comment.

Refresh Comments

 * © Copyright 2023 AlienVault, Inc.
   
 * Legal
   
 * Status