#Cacosms - Twitter Hashtag

over 3 years ago

Dull deal, but OK. C2: nobiapi[.]shop nobiweb[.]shop Ref: https://t.co/3RhEQeDCJp + other related crap from IP: 185.149.120[.]47 Detection: https://t.co/3RhEQeDCJp #Android #iRATA/#Mellat/#Cacosms

0

3

0

293

Mikhail Kasimov @500mk500

almost 4 years ago

[2023-01-14] #Android #cacosms/#irata/#irspy/#realrat domains to detect: https://t.co/SC3MevUPXh

0

1

0

525

Mikhail Kasimov @500mk500

over 4 years ago

+ more #Android #cacosms/#irspy/#realrat domains: https://t.co/GmpaGwKrvY

1

0

Mikhail Kasimov @500mk500

over 4 years ago

Interesting case. Mentoined C2 addresses are "looking" on IPs: 23.235.232[.]236 and 82.221.129[.]39. The first one also "holds" domains (adalat/eablg/eblagh etc) of #Android #cacosms/#irspy/#realrat , which target Iran. Detections: https://t.co/NJYw3zDcPh https://t.co/MykMMl7O7f

500mk500's tweet photo. Interesting case. Mentoined C2 addresses are "looking" on IPs: 23.235.232[.]236 and 82.221.129[.]39. The first one also "holds" domains (adalat/eablg/eblagh etc) of #Android #cacosms/#irspy/#realrat , which target Iran.

Detections:
https://t.co/NJYw3zDcPh
https://t.co/MykMMl7O7f https://t.co/uGgaZs41Wj

Cert AgID @AgidCert

over 4 years ago

Nuovo malware android #SmsRat è stato individuato in data odierna - veicolato come App di un noto istituto bancario italiano; - imposta l'app come gestore SMS; - legge e sottrae gli SMS inviandoli al C2. Gli #IoC sono disponibili al seguenti link 👇 🔗 https://t.co/PlSrxjRixi