#GossRat - Twitter Hashtag

over 2 years ago

#Censys query to find #GossRAT #C2 servers: services.http.response.body_hash="sha1:b7c4a3bf814a5aaf96e208f47a17066c32ac0ad0" The URL path used for C2 communication is the same across all domains > /rat/apps/mellat/notify.php IOCs: https://t.co/BaMoqNxpL3 #IOC #IRATA #GossRAT

NDA0E's tweet photo. #Censys query to find #GossRAT #C2 servers:
services.http.response.body_hash="sha1:b7c4a3bf814a5aaf96e208f47a17066c32ac0ad0"

The URL path used for C2 communication is the same across all domains > /rat/apps/mellat/notify.php

IOCs: https://t.co/BaMoqNxpL3

#IOC #IRATA #GossRAT https://t.co/7EmDd5NqZG

NDA0E @NDA0E

over 2 years ago

Iranian threat actors are using phishing sites that impersonate @mellatbankiran to distribute #GossRAT through a download page claiming to be the bank's mobile app. Using @censysio DNS records i found over 100 domains to have been involved, most of them using .buzz as their TLD.

NDA0E's tweet photo. Iranian threat actors are using phishing sites that impersonate @mellatbankiran to distribute #GossRAT through a download page claiming to be the bank's mobile app.

Using @censysio DNS records i found over 100 domains to have been involved, most of them using .buzz as their TLD. https://t.co/nxv4uNY0Zf

2

6

0

7K

0

51

7

28

6K

NDA0E @NDA0E

over 2 years ago

As for now, the 10 active domains are delivering the same #GossRAT payload. URLhaus: https://t.co/MUN0mLUVHO Mellat.apk: https://t.co/4qWA2TMQhq

1

3

0

374

NDA0E @NDA0E

over 2 years ago

Iranian threat actors are using phishing sites that impersonate @mellatbankiran to distribute #GossRAT through a download page claiming to be the bank's mobile app. Using @censysio DNS records i found over 100 domains to have been involved, most of them using .buzz as their TLD.

2

6

0

7K

Mikhail Kasimov @500mk500

over 2 years ago

adsmanagera310[.]gmail[.]com has spawned some pile of #Android #Gossrat #IRATA-related/affiliated domains. 1230 of them weren't covered and now it is fixed too: https://t.co/SPz0ixR41D @ValidinLLC intel

500mk500's tweet photo. adsmanagera310[.]gmail[.]com has spawned some pile of #Android #Gossrat #IRATA-related/affiliated domains.

1230 of them weren't covered and now it is fixed too: https://t.co/SPz0ixR41D

@ValidinLLC intel https://t.co/kmChFGeC8E

Mikhail Kasimov @500mk500

over 2 years ago

Infra: C2: 45.136.49[.]151:2000, 45.136.49[.]151:2056 277 domains from 186.2.171[.]40 and 45.136.49[.]151 https://t.co/lmbvhAsFFk #Android #GossRat #IRATA

1

7

2

3

2K

0

7

1

2

1K

Mikhail Kasimov @500mk500

over 2 years ago

Infra: C2: 45.136.49[.]151:2000, 45.136.49[.]151:2056 277 domains from 186.2.171[.]40 and 45.136.49[.]151 https://t.co/lmbvhAsFFk #Android #GossRat #IRATA

MalwareHunterTeam

@malwrhunterteam

over 2 years ago

"Mellat.apk": 3ada8cf9e5bdaa73de6a102e7c86764f6fb15d403e21e0e77e55bac560693904 From: https://hamrah-melat[.]pro/a/ -> https://hamrah-melat[.]pro/a/Mellat.apk