#AllaKore - Twitter Hashtag

11 months ago

#SideCopy #APT36 #Phishing #APT COA_Train_Cancelled.zip 7468206d321b9a1be58510b6c910739c COA_Train_Cancelled.docx.lnk b7c189367ecaab4fcc5a53eddbbc5a38 drjagrutichavan[.]com (Jan'25) coa.hta e05c2204aa01e4f05313095d41b6f99f flow.exe #AllaKore 6a4ebcd1af69e64a2d14f5c12566603b

PrakkiSathwik's tweet photo. #SideCopy #APT36 #Phishing #APT

COA_Train_Cancelled.zip
7468206d321b9a1be58510b6c910739c

COA_Train_Cancelled.docx.lnk
b7c189367ecaab4fcc5a53eddbbc5a38

drjagrutichavan[.]com (Jan'25)

coa.hta
e05c2204aa01e4f05313095d41b6f99f

flow.exe #AllaKore
6a4ebcd1af69e64a2d14f5c12566603b https://t.co/1ZB7HhqRye

Sathwik Ram Prakki @PrakkiSathwik

over 1 year ago

#SideCopy #APT 2.hta d81608fffc905efa19ddff046c689cca file.hta #GetaRAT 97bc9f61855c32b84154cfea23063379 useH.hta #ReverseRAT 4cd25b06c42536a4bfe32b7676601c3e #C2 dns.educationportals[.]biz/dailyworkout 37.1.198.72:5863 AS28753 (Leaseweb Deutschland GmbH) 🇩🇪 @500mk500

PrakkiSathwik's tweet photo. #SideCopy #APT

2.hta
d81608fffc905efa19ddff046c689cca

file.hta #GetaRAT
97bc9f61855c32b84154cfea23063379

useH.hta #ReverseRAT
4cd25b06c42536a4bfe32b7676601c3e

#C2
dns.educationportals[.]biz/dailyworkout
37.1.198.72:5863

AS28753 (Leaseweb Deutschland GmbH) 🇩🇪

@500mk500 https://t.co/qBjtlxZIVI

1

21

9

4

6K

1

17

5

7

4K

Threat Intelligence @threatintel

about 1 year ago

#ThreatProtection #GreedySponge threat group distributes #AllaKore #RAT and #SystemBC #malware to Mexican organizations, read more about Symantec's protection: https://t.co/sH3uI6cfpV

0

1

0

983

Cyber Team @Cyberteam008

almost 2 years ago

Some Recently observed #SideCopy #APT 's #AllaKore #RAT Payloads Targeting Indian Govt. Infra: https://t.co/bFchyXtSq4 Note: All 05 payloads connecting to the same #AllaKore #RAT C2 173.249.18[.]251 over C2 ports 3945, 6659 & 9794 #Malware #ioc

Cyberteam008's tweet photo. Some Recently observed #SideCopy #APT 's #AllaKore #RAT Payloads Targeting Indian Govt.

Infra: https://t.co/bFchyXtSq4

Note: All 05 payloads connecting to the same #AllaKore #RAT C2 173.249.18[.]251 over C2 ports 3945, 6659 & 9794

#Malware #ioc https://t.co/3oW2U3IGRc

0

27

7

8

3K

Kseniia \n @naumovax

almost 2 years ago

🌐 Interesting network finding in #AllaKore #RAT loading hosted on *.brazilsouth.cloudapp.azure\.com: https://t.co/z542XPUhAF https://t.co/gNdqSTvV2u

$naumovax's tweet photo. 🌐 Interesting network finding in #AllaKore #RAT loading hosted on *.brazilsouth.cloudapp.azure\.com: https://t.co/z542XPUhAF https://t.co/gNdqSTvV2u https://t.co/EoqLH6Vg3s$

JAMESWT @JAMESWT_WT

about 2 years ago

#CarnavalHeist update @pollo290987 "#AllaKore RAT > #AllaSenha" #smb ⛔️\191.233.243.92@80 \Documentos\NotaFiscal.pdf.lnk \c\c.cmd 🔱Samples https://t.co/TY0okDFnnJ ✅AnyRun https://t.co/gyaD34Ggp4 ❇️Reference https://t.co/qpvga65fTw

$JAMESWT_WT's tweet photo. #CarnavalHeist update @pollo290987 "#AllaKore RAT > #AllaSenha" #smb ⛔️\191.233.243.92@80 \Documentos\NotaFiscal.pdf.lnk \c\c.cmd 🔱Samples https://t.co/TY0okDFnnJ ✅AnyRun https://t.co/gyaD34Ggp4 ❇️Reference https://t.co/qpvga65fTw https://t.co/XHFYz1IqXJ$

0

24

4

2

5K

0

9

2

3

786

Threat Intelligence @threatintel

over 2 years ago

#ThreatProtection #AllaSenha - new #AllaKore #malware variant, read more about Symantec's protection: https://t.co/8wOdKAhCT5

0

2

1

0

1K

Johnk3r @johnk3r

over 2 years ago

https://t.co/vQYWKwC42N #AllaSenha #AllaKore @1ZRR4H @0xToxin

Johnk3r @johnk3r

over 2 years ago

@pollo290987 @1ZRR4H @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @0xToxin @pr0xylife @executemalware @0xDanielLopez @hiramcoop @Gi7w0rm @V3n0mStrike @pollo290987 Have you ever seen anything similar to this in the first stage? I have never seen any reports of this 'Initial Access' method involving trojan/fraud. ps: I made a small adjustment to the payload for debug.

johnk3r's tweet photo. @pollo290987 @1ZRR4H @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @0xToxin @pr0xylife @executemalware @0xDanielLopez @hiramcoop @Gi7w0rm @V3n0mStrike @pollo290987 Have you ever seen anything similar to this in the first stage?

I have never seen any reports of this 'Initial Access' method involving trojan/fraud.

ps: I made a small adjustment to the payload for debug. https://t.co/0IPP909Dcu

2

4

0

1

6K

1

21

7

6K

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT springfielduniversity[.]info HTA 2563492e4133072855a497e48e9826b0 86b9909075c8d83dc4609b6ee6eec823 830675a179041ecddd44d82263a5e2e5 #AllaKoreRAT 1f2bc76b47976ece108a208f9f711c9b 1b201b442a80a254d7b971ef2631e5e8 C2: 62.169.30.39 Ports: 6660, 7884

PrakkiSathwik's tweet photo. #SideCopy #APT #AllaKore #RAT

springfielduniversity[.]info

HTA
2563492e4133072855a497e48e9826b0
86b9909075c8d83dc4609b6ee6eec823
830675a179041ecddd44d82263a5e2e5

#AllaKoreRAT
1f2bc76b47976ece108a208f9f711c9b
1b201b442a80a254d7b971ef2631e5e8

C2: 62.169.30.39
Ports: 6660, 7884 https://t.co/291VVEuMNk

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT vparking[.]online HTA ecc65e6074464706bb2463cb74f576f7 da529e7b6056a055e3bbbace20740ee9 cadafc6a91fc4bba33230baed9a8a338 #AllaKoreRAT 4ba7ca56d1a6082f0303f2041b0c1a45 6cda3b5940a2a97c5e71efcd1dd1d2ca C2: 213.136.94.11 Ports: 6663, 7880 Same bait

PrakkiSathwik's tweet photo. #SideCopy #APT #AllaKore #RAT

vparking[.]online

HTA
ecc65e6074464706bb2463cb74f576f7
da529e7b6056a055e3bbbace20740ee9
cadafc6a91fc4bba33230baed9a8a338

#AllaKoreRAT
4ba7ca56d1a6082f0303f2041b0c1a45
6cda3b5940a2a97c5e71efcd1dd1d2ca

C2: 213.136.94.11
Ports: 6663, 7880

Same bait https://t.co/qViR7x8VE1

1

24

9

10

7K

0

16

4

4K

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

Connecting Pakistan #APT's #SideCopy and #TransparentTribe (#APT36) #CrimsonRAT variants: - .NET (Reactor) packed - Base64 zipped #AllaKoreRAT variants: - Delphi based by Sidecopy (dual #AllaKore #RAT) - .NET (Reactor) based by APT36 #CrimsonKeylogger https://t.co/JUu1ZCGKts

2

21

6

5

2K

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT vparking[.]online HTA ecc65e6074464706bb2463cb74f576f7 da529e7b6056a055e3bbbace20740ee9 cadafc6a91fc4bba33230baed9a8a338 #AllaKoreRAT 4ba7ca56d1a6082f0303f2041b0c1a45 6cda3b5940a2a97c5e71efcd1dd1d2ca C2: 213.136.94.11 Ports: 6663, 7880 Same bait

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT HTA 6cdc79655e9866e31f6c901d0a05401d dbf196ccb2fe4b6fb01f93a603056e55 37b10e4ac08534ec36a59be0009a63b4 revivelife[.]in #AllaKoreRAT 76ca50a71e014aa2d089fed1251bf6cd 71b285c8903bb38d16d97c1042cbeb92 C2: 164.68.102.44 Ports: 6663, 9828 Old Decoy:

PrakkiSathwik's tweet photo. #SideCopy #APT #AllaKore #RAT

HTA
6cdc79655e9866e31f6c901d0a05401d
dbf196ccb2fe4b6fb01f93a603056e55
37b10e4ac08534ec36a59be0009a63b4

revivelife[.]in

#AllaKoreRAT
76ca50a71e014aa2d089fed1251bf6cd
71b285c8903bb38d16d97c1042cbeb92

C2: 164.68.102.44
Ports: 6663, 9828

Old Decoy: https://t.co/bp3K1EIHzG

0

14

4

2

7K

1

24

9

10

7K

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT HTA d907284734ea5bf3bd277e118b6c51f0 2a47ea398397730681f121f13efd796f 6ab0466858eb6d71d830e7b2e86dab03 smokeworld[.]in #AllaKoreRAT 9684bf8955b348540446df6b78813cdb 48e1e695258a23742cd27586e262c55a (Same C2) C2: 164.68.102.44 Ports: 6663, 9828

PrakkiSathwik's tweet photo. #SideCopy #APT #AllaKore #RAT

HTA
d907284734ea5bf3bd277e118b6c51f0
2a47ea398397730681f121f13efd796f
6ab0466858eb6d71d830e7b2e86dab03

smokeworld[.]in

#AllaKoreRAT
9684bf8955b348540446df6b78813cdb
48e1e695258a23742cd27586e262c55a

(Same C2)
C2: 164.68.102.44
Ports: 6663, 9828 https://t.co/IBMQPG6QXZ

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT HTA 6cdc79655e9866e31f6c901d0a05401d dbf196ccb2fe4b6fb01f93a603056e55 37b10e4ac08534ec36a59be0009a63b4 revivelife[.]in #AllaKoreRAT 76ca50a71e014aa2d089fed1251bf6cd 71b285c8903bb38d16d97c1042cbeb92 C2: 164.68.102.44 Ports: 6663, 9828 Old Decoy:

0

14

4

2

7K

0

8

4

2

1K

Sathwik Ram Prakki @PrakkiSathwik

over 2 years ago

#SideCopy #APT #AllaKore #RAT HTA 6cdc79655e9866e31f6c901d0a05401d dbf196ccb2fe4b6fb01f93a603056e55 37b10e4ac08534ec36a59be0009a63b4 revivelife[.]in #AllaKoreRAT 76ca50a71e014aa2d089fed1251bf6cd 71b285c8903bb38d16d97c1042cbeb92 C2: 164.68.102.44 Ports: 6663, 9828 Old Decoy:

0

14

4

2

7K

Hiram Alejandro

@hiramcoop

over 2 years ago

🇲🇽 Instituciones financieras mexicanas están siendo atacadas por el Malware de Acceso Remoto #AllaKore Las infecciones se producen vía correos electrónicos que suplantan la identidad del #IMSS, los cuales contienen un archivo (PluginIMSSSIPARE . zip) que al ejecutarse, verifica que la IP de la víctima sea de México El malware fue modificado ya que contiene palabras en español y utiliza direcciones IPs Mexicanas asignadas al servicio de #Starlink para acceder a los servidores que controlan el malware https://t.co/cVr4h5eT9H

hiramcoop's tweet photo. 🇲🇽 Instituciones financieras mexicanas están siendo atacadas por el Malware de Acceso Remoto #AllaKore

Las infecciones se producen vía correos electrónicos que suplantan la identidad del #IMSS, los cuales contienen un archivo (PluginIMSSSIPARE . zip) que al ejecutarse, verifica que la IP de la víctima sea de México

El malware fue modificado ya que contiene palabras en español y utiliza direcciones IPs Mexicanas asignadas al servicio de #Starlink para acceder a los servidores que controlan el malware

https://t.co/cVr4h5eT9H

2

128

69

34

13K

ReconBee @ReconBee

over 2 years ago

AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks https://t.co/VNbkBVaOdy #Allakore #RATmalware #malware #mexico #mexican #FinancialSecurity #financialfraud #FinancialMarkets #CybersecurityNews #CyberSec #CyberSecurityAwareness

0

2

0

70

Threat Intelligence @threatintel

over 2 years ago

#ThreatProtection #AllaKore #RAT targets #Mexican banks in latest campaign, read more about Symantec's protection: https://t.co/7iEhsBCFc3 #malware

0

4

2

1

2K

Cyber Team @Cyberteam008

over 2 years ago

#Censys Query for Allakore RAT services.http.response.favicons.md5_hash="5b4d6217005ba406219ddbb181986fa3" Report & IOCs: https://t.co/oB0KJHnLNv @BlackBerry #Censys #Allakore #RAT #Malware #ioc

Cyberteam008's tweet photo. #Censys Query for Allakore RAT

services.http.response.favicons.md5_hash="5b4d6217005ba406219ddbb181986fa3"

Report & IOCs:
https://t.co/oB0KJHnLNv

@BlackBerry #Censys #Allakore #RAT #Malware #ioc https://t.co/TSeN4e7GAY

0

2

0

370

Carlos Seisdedos @CarloSeisdedos

over 2 years ago

Mexican Banks and #Cryptocurrency Platforms Targeted With #AllaKore RAT. Bancos mexicanos 🇲🇽 y plataformas de criptomonedas en el punto de mira de AllaKore RAT. https://t.co/cQrUN0lQEe

0

5

3

0

628

Dmitry Melikov

@DmitriyMelikov

over 2 years ago

Interesting new blogpost about how #AllaKore RAT is targeting Mexican banks. https://t.co/PbHU1DOaqt #IoCs #C2C #CyberSecurity

0

12

2

4

1K

TOBTC

@_TOBTC

over 2 years ago

#Blackberry warns #Mexican #crypto #exchanges of lurking cyberthreat : Blackberry’s report identified an attack that attempted to steal sensitive user information from banks and crypto trading services using an open-source remote access tool named #AllaKore RAT. #Bitcoin #BTC #Crypto

_TOBTC's tweet photo. #Blackberry warns #Mexican #crypto #exchanges of lurking cyberthreat :

Blackberry’s report identified an attack that attempted to steal sensitive user information from banks and crypto trading services using an open-source remote access tool named #AllaKore RAT.

#Bitcoin #BTC #Crypto

2

3

0

207

Sathwik Ram Prakki @PrakkiSathwik

almost 3 years ago

#SideCopy Multi-platform Onslaught: Leveraging #WinRAR Zero-Day #CVE-2023-38831 and Linux Variant of #AresRAT to target #India #AllaKore #DRat #KeyRAT Linux code similarity with #TransparentTribe #APT36 https://t.co/pZ5LzFvscA

1

7

2

1

782

Aaron Jornet

@RexorVc0

almost 3 years ago

#APT #SideCopy CVE-2023-38831 #Allakore #AllakoreRAT #threat #malware 📍🇵🇰 💥🇮🇳 ⛓️#Phishing > #CVE RAR > PDF bait | #LNK fake PDF> Folder with pdf.exe | .HTA + .BAT > #Allakore #RAT > Keylog + Capturing + Steal info > #C2 🔗Anheng Research Report: https://t.co/UH2AYmjrNr

RexorVc0's tweet photo. #APT #SideCopy CVE-2023-38831 #Allakore #AllakoreRAT #threat #malware

📍🇵🇰
💥🇮🇳

⛓️#Phishing > #CVE RAR > PDF bait | #LNK fake PDF> Folder with pdf.exe | .HTA + .BAT > #Allakore #RAT > Keylog + Capturing + Steal info > #C2

🔗Anheng Research Report: https://t.co/UH2AYmjrNr https://t.co/Oooyoqaw2e

1

51

14

11

7K

Top Tweets for #AllaKore

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users