Top Tweets for #GetaRat
#APT36 #SideCopy #APT #Phishing
documentcentre[.]in
docsportal[.]in #opendir
ISO/ZIP > LNK > HTA
#C2 #GetaRAT
dns.sysdllt[.]xyz
45.61.157[.22:5863
144.172.89[.29:5941
@500mk500
DoCDWork()
Public\User\startT.hta, appT.bat, runT.bat
Public\Config\Config.hta, CerT.bat, SigT.bat
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
documentcentre[.]in
docsportal[.]in #opendir
ISO/ZIP > LNK > HTA
#C2 #GetaRAT
dns.sysdllt[.]xyz
45.61.157[.22:5863
144.172.89[.29:5941
@500mk500
DoCDWork()
Public\User\startT.hta, appT.bat, runT.bat
Public\Config\Config.hta, CerT.bat, SigT.bat https://t.co/Dj7786wO18](https://pbs.twimg.com/media/HCp7U8iakAElH90.png)
#APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500
![PrakkiSathwik's tweet photo. #APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500 https://t.co/93fpuO6IWC](https://pbs.twimg.com/media/HBsWwh_bgAUHf0W.png)
/2 #APT36 #ReverseRAT #GetaRAT
4f7fb053db6f253cc6ce64031e996801 - a.hta
cc04d1aeba8293d668fb517ccb8a322e - 307.hta
9e35a021619152a2cd6069752465d54b - mha.hta
877d68c962e54d5ee8cf4b28cea2729e - 101.hta
(Unknown) - 308.PHP/hta
1.bat
runT.bat
LT.lnk
linked: https://t.co/vDpvUoXvi4

#APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500
![PrakkiSathwik's tweet photo. #APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500 https://t.co/93fpuO6IWC](https://pbs.twimg.com/media/HBsWwh_bgAUHf0W.png)
#APT36
Latest Deployment Updates.iso
cb5fc8584023ec7be2721e45845f5434
LATEST DEPLOYMENT UPDATE.PPTX.LNK
8d6dea4fbc1618a0ab90509e0b70bfaf
#CrimsonRAT
rgwnshnr wsfcias.exe
191e9e0f6dd48379d084868506a34025
#C2 AS32097
204.12.218[.]202
9916, 14955, 18961, 25226, 37822
@500mk500
![PrakkiSathwik's tweet photo. #APT36
Latest Deployment Updates.iso
cb5fc8584023ec7be2721e45845f5434
LATEST DEPLOYMENT UPDATE.PPTX.LNK
8d6dea4fbc1618a0ab90509e0b70bfaf
#CrimsonRAT
rgwnshnr wsfcias.exe
191e9e0f6dd48379d084868506a34025
#C2 AS32097
204.12.218[.]202
9916, 14955, 18961, 25226, 37822
@500mk500 https://t.co/XauXqLkqvz](https://pbs.twimg.com/media/HBcVaeaawAA_eiH.png)
#SideCopy #APT #Opendir
Windows version based HTA
-7/10/11.php
useT.hta / startT.hta
#GetaRAT
C2: 72.11.156.132:5863
CN=WIN-P9NRMH5G6M8 #APT36
useH.hta
#ReverseRAT
C2: checkdailytips.servehttp[.com/dailyworkout
Lures
-Climate Change.docx
-Professional.docx
-Research Work.docx

#DISGOMOJI #APT36 #TransparentTribe
vmcoreinfo.txt
4c52bb770d7b8639e1f305f908dbc800
Password (Golang Downloader)
4eaa6a69c9835c29ce8d39734e5d3d5f
#Opendir #APT
campusportals[.]in
Hidden URLs hosting #SideCopy payloads on same domain
IOCs in new blog:
https://t.co/WpUoUW2I47
![PrakkiSathwik's tweet photo. #DISGOMOJI #APT36 #TransparentTribe
vmcoreinfo.txt
4c52bb770d7b8639e1f305f908dbc800
Password (Golang Downloader)
4eaa6a69c9835c29ce8d39734e5d3d5f
#Opendir #APT
campusportals[.]in
Hidden URLs hosting #SideCopy payloads on same domain
IOCs in new blog:
https://t.co/WpUoUW2I47 https://t.co/zLEFb4EKeU](https://pbs.twimg.com/media/GToePw1WoAAO2_Z.jpg)
A huge congratulations to MTE Ducks 6th Topaz on their 4-1 weekend @GymRatCHALLENGE. Topaz used incredibly balanced & productive scoring along with intense ball pressure to propel them to be tournament finalists! #MTEDFamily #TrueToughness #GetaRat #CoachAllie #OnlyTheBeginning

In 2008, The Cleveland Tigers tied it up against The Hominy Bucks 29-29 late in the 4th quarter.... But then our HC @calebchristian3 made an outstanding game winning touchdown catch!!! The Bucks were able to go up 36-29 and get the W! #GetARat π #BuckPride

ITS RIVALRY WEEK BOIS!!! π₯ BONFIRE ON WEDNESDAY @DARK AND THE GAME TO BE AT IS ON THURSDAY! HOME! @7:30!! #GetARat #TheyAintReady π ESKETIT!
#getarat β€οΈππ

Last Seen Hashtags on Sotwe
ΰΉΰΈΰΉΰΈΰΈΰΉΰΈΰΈΰΈ’
Seen from Thailand
anxiouspandaa
Seen from United Kingdom
gay pakistani
Seen from Pakistan
ΰΈΰΈ±ΰΈΰΉΰΈ’ΰΉΰΈΰΈ§ΰΈ±ΰΈΰΈ‘ΰΈ°ΰΈΰΈ²ΰΈ§
Seen from Thailand
tango arabic
Seen from India
bopper tiktok
Seen from United States
ι₯ζ§
Seen from United States
mgai()()() + filter:native_video
Seen from Philippines
ζι³ι£θθΉ
θ₯Ώθ£
Seen from Malaysia
Most Popular Users

Elon Musk 
@elonmusk
241.5M followers

Barack Obama 
@barackobama
118.8M followers

Cristiano Ronaldo 
@cristiano
114.6M followers

Donald J. Trump 
@realdonaldtrump
111.8M followers

Narendra Modi 
@narendramodi
107.1M followers

Rihanna 
@rihanna
98.7M followers

NASA 
@nasa
92.3M followers

Justin Bieber 
@justinbieber
91.8M followers

KATY PERRY 
@katyperry
90M followers

Taylor Swift 
@taylorswift13
84M followers

Lady Gaga 
@ladygaga
75.5M followers

Virat Kohli 
@imvkohli
73.5M followers

Kim Kardashian 
@kimkardashian
70.9M followers

YouTube 
@youtube
68.8M followers

Neymar Jr 
@neymarjr
66.5M followers

Bill Gates 
@billgates
65.3M followers

Selena Gomez 
@selenagomez
63.1M followers

The Ellen Show
@theellenshow
62.2M followers

CNN 
@cnn
61.7M followers

X 
@x
60.7M followers

![PrakkiSathwik's tweet photo. #APT36 #SideCopy [1/2]
Advisosry Fake Websites Seeking Beneficiary Data1 (1).zip {x2} -> desktop / #LNK
Advisosry Fake Websites.desktop
e10923fbfebbac23650756e77045533b
ashraagrotech[.]com
#C2
2.56.10.101:6357 - flow.hta #GetaRAT
2.56.10.121:52145 - vcache #AresRAT
@500mk500 https://t.co/C4HsexijZH](https://pbs.twimg.com/media/HC0tR5JaEAAf0yk.png)

![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
documentcentre[.]in
docsportal[.]in #opendir
ISO/ZIP > LNK > HTA
#C2 #GetaRAT
dns.sysdllt[.]xyz
45.61.157[.22:5863
144.172.89[.29:5941
@500mk500
DoCDWork()
Public\User\startT.hta, appT.bat, runT.bat
Public\Config\Config.hta, CerT.bat, SigT.bat https://t.co/Dj7786wO18](https://pbs.twimg.com/media/HCp7UFCasAAQvAD.jpg)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
documentcentre[.]in
docsportal[.]in #opendir
ISO/ZIP > LNK > HTA
#C2 #GetaRAT
dns.sysdllt[.]xyz
45.61.157[.22:5863
144.172.89[.29:5941
@500mk500
DoCDWork()
Public\User\startT.hta, appT.bat, runT.bat
Public\Config\Config.hta, CerT.bat, SigT.bat https://t.co/Dj7786wO18](https://pbs.twimg.com/media/HCp7TB5bQAAuhTM.png)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
documentcentre[.]in
docsportal[.]in #opendir
ISO/ZIP > LNK > HTA
#C2 #GetaRAT
dns.sysdllt[.]xyz
45.61.157[.22:5863
144.172.89[.29:5941
@500mk500
DoCDWork()
Public\User\startT.hta, appT.bat, runT.bat
Public\Config\Config.hta, CerT.bat, SigT.bat https://t.co/Dj7786wO18](https://pbs.twimg.com/media/HCp7STobwAA0MaV.png)
![PrakkiSathwik's tweet photo. #APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500 https://t.co/93fpuO6IWC](https://pbs.twimg.com/media/HBsWp-FbgAAbuRh.png)
![PrakkiSathwik's tweet photo. #APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500 https://t.co/93fpuO6IWC](https://pbs.twimg.com/media/HBsWo9CbgAUJQse.jpg)
![PrakkiSathwik's tweet photo. #APT36 (ISO-LNK-BAT) triggers HTA-based #ReverseRAT & #GetaRAT, instead of CrimsonRAT [seen early Dec-2025]
commskl.iso
7edf05d02d84b160b39e4e778a226959
commskl.docx.lnk
7f735f1605a54a18072f299a14507a5d
#C2 AS14956
172.86.122[.]203:5863
dns.sysdllfile[.]site
@500mk500 https://t.co/93fpuO6IWC](https://pbs.twimg.com/media/HBsWnyXaAAAojjT.jpg)
![PrakkiSathwik's tweet photo. #SideCopy #APT
2.hta
d81608fffc905efa19ddff046c689cca
file.hta #GetaRAT
97bc9f61855c32b84154cfea23063379
useH.hta #ReverseRAT
4cd25b06c42536a4bfe32b7676601c3e
#C2
dns.educationportals[.]biz/dailyworkout
37.1.198.72:5863
AS28753 (Leaseweb Deutschland GmbH) π©πͺ
@500mk500 https://t.co/qBjtlxZIVI](https://pbs.twimg.com/media/GtJKJL4aMAAxhC-.png)
![PrakkiSathwik's tweet photo. #APT36
Latest Deployment Updates.iso
cb5fc8584023ec7be2721e45845f5434
LATEST DEPLOYMENT UPDATE.PPTX.LNK
8d6dea4fbc1618a0ab90509e0b70bfaf
#CrimsonRAT
rgwnshnr wsfcias.exe
191e9e0f6dd48379d084868506a34025
#C2 AS32097
204.12.218[.]202
9916, 14955, 18961, 25226, 37822
@500mk500 https://t.co/XauXqLkqvz](https://pbs.twimg.com/media/HBcVXBSbgAEAEeM.png)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
Salary Account Package 14 -1-26 (DFS).pdf.lnk
275261b351d57b8d272b28b1291a87d2
6892ff98bf0ea47396cedbe9a272f427
santepluspharma[.]com
@500mk500
sal.hta
b57587fbabddb2f6d25784c7cfdc7c1e
flow.hta #GetaRAT
bcb2890fd071c7b3f855409e6024caaf
Same C2 https://t.co/vnvplSi5j2](https://pbs.twimg.com/media/HA2vmn6agAA20Cp.jpg)
![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
SOP TO ACCESS -NIDMS-.pdf.lnk/zip
1f7f9fdb6aa92545b36f81988fd4ed31
298ccded6d491fe96651a34f982b6fde
chandigarh[.]guru
sop.hta
30224401aabd4d35fab14648119dca47
flow.hta #GetaRAT
a13cd4e30c3bf61c6051e93dab35bc2d
#C2
149.3.170.165:6357
@500mk500 https://t.co/qUkkYoGCct](https://pbs.twimg.com/media/G_PtvQgXMAAt4H-.jpg)

![PrakkiSathwik's tweet photo. #APT36 #SideCopy #APT #Phishing
sgblranchi[.]com
@500mk500
Revision of Seniority.pdf.lnk /zip
dfeddebbc0e0ab9ae05cfd51860ffe47
e888103067c75c86c6fa5cd6d40812c8
rev.hta
e05e3e311a0504bf4d1ad22cf9a65a90
flow.hta #GetaRAT
29dfe04ba32d9ea0190dec6942173e20
#C2
146.19.173.32 :8621 https://t.co/bcgt7ggtTG](https://pbs.twimg.com/media/G-wy_ihbQAAgxEJ.png)
![PrakkiSathwik's tweet photo. #SideCopy #APT36 #Phishing #APT
Threat Application.pdf.lnk/zip
222f012bed5d59ac845fbedb6575b0f6
68fdd4392d92cc79f28ae98d096126c9
sifi.]co.]in
thr.hta
be670ce9c4828016f07cce931f53c9ea
flow.hta #GetaRAT
71edf4bc5cc307414b1c22f0b1a04bc5
flowB.bat
#C2
2.56.10.57:8621
@500mk500 https://t.co/TdE9MiHOMq](https://pbs.twimg.com/media/G9hGkwzaMAAzylW.png)

![PrakkiSathwik's tweet photo. #SideCopy #APT36 #Phishing #APT
APPLICATION FOR UPDATION OF NIC E-MAIL ID.pdf.lnk
9f82018ae0d5bc007dc5f64bad5b3372
riastaging.ryangroup[.]org
mail.hta
f1f623f58c9af236645a6b9f1c0c6359
flow.hta #GetaRAT
bc3fce98f66657e1ba10fa75a03a436f
#C2
164.215.103.231:8621
AS213373(IPC)SC https://t.co/EgiI6n5CXy](https://pbs.twimg.com/media/G33nOCVX0AAdC0H.jpg)
![PrakkiSathwik's tweet photo. #SideCopy #APT36 #Phishing #APT
COA_Train_Cancelled.zip
7468206d321b9a1be58510b6c910739c
COA_Train_Cancelled.docx.lnk
b7c189367ecaab4fcc5a53eddbbc5a38
drjagrutichavan[.]com (Jan'25)
coa.hta
e05c2204aa01e4f05313095d41b6f99f
flow.exe #AllaKore
6a4ebcd1af69e64a2d14f5c12566603b https://t.co/1ZB7HhqRye](https://pbs.twimg.com/media/G33E9JeXYAETclu.jpg)
![PrakkiSathwik's tweet photo. #SideCopy #APT36 #Phishing #APT
COA_Train_Cancelled.zip
7468206d321b9a1be58510b6c910739c
COA_Train_Cancelled.docx.lnk
b7c189367ecaab4fcc5a53eddbbc5a38
drjagrutichavan[.]com (Jan'25)
coa.hta
e05c2204aa01e4f05313095d41b6f99f
flow.exe #AllaKore
6a4ebcd1af69e64a2d14f5c12566603b https://t.co/1ZB7HhqRye](https://pbs.twimg.com/media/G33E7gfWEAAs6cs.png)











