Resumen APTTrail
APTTrail mantiene indicadores publicos asociados a APT EARTHBERBEROKA. Aliases observados: APT EARTHBERBEROKA. Conteo por tipo: domain: 55, ipv4: 3.
Indicadores de Compromiso (IOCs)
| Tipo | Valor | Contexto |
|---|---|---|
| Domain | 1.googie.ph | APTTrail |
| Domain | 12371829hkdanm.fbi.am | APTTrail |
| Domain | 1qw6etagydbn2peifj8hf.fbi.am | APTTrail |
| Domain | 2.googie.ph | APTTrail |
| Domain | 3.googie.ph | APTTrail |
| Domain | adobe-flash.wiki | APTTrail |
| Domain | adobe.name | APTTrail |
| Domain | agph.ivi66.net | APTTrail |
| Domain | bos.github.wiki | APTTrail |
| Domain | caonimade.11i.me | APTTrail |
| Domain | d.github.wiki | APTTrail |
| Domain | darknet.rootkit.tools | APTTrail |
| Domain | darwin.github.wiki | APTTrail |
| Domain | download.mircrosoftscoulds.com | APTTrail |
| Domain | dust.github.wiki | APTTrail |
| Domain | exmail.googie.com.ph | APTTrail |
| Domain | fbi.fuckbc.com | APTTrail |
| Domain | flash.wy886066.com | APTTrail |
| Domain | fuckbc.com | APTTrail |
| Domain | fuckeryoumm.nmb.bet | APTTrail |
| Domain | fuckyou.fbi.am | APTTrail |
| Domain | gb.googie.ph | APTTrail |
| Domain | github.wiki | APTTrail |
| Domain | googie.com.ph | APTTrail |
| Domain | googie.ph | APTTrail |
| Domain | helloword.11i.me | APTTrail |
| Domain | helloword.daj8.me | APTTrail |
| Domain | hk.whoamis.info | APTTrail |
| Domain | hkdust.github.wiki | APTTrail |
| Domain | huaidan.fbi.am | APTTrail |
Referencias
- https://documents.trendmicro.com/assets/txt/earth-berberoka-domains-2.txt
- https://g-soft.info/security/2196/earth-berberoka-apt-iocs/
- https://otx.alienvault.com/pulse/62714f1a00e250a297938915
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html
- https://www.virustotal.com/gui/file/2c403e390f59b2c2bfafde476dc18000b0ad1bbc8ac9ee0670662c48ba5b748f/detection
- https://www.virustotal.com/gui/file/401d0b1f1a94df6a70818ef2bad80d139bb258c0e7746612066599aa43456dad/detection
- https://x.com/DaveLikesMalwre/status/1840103584672960692