#Ismdoor - Twitter Hashtag

about 5 years ago

"RE: Revisione dell'ordine" spam email #italy #spread 1Gz https://t.co/8IKz1bhMyz 2zip pw "1" not write inside email txt https://t.co/JzOqN6wZqj 3Exe #AgentTesla https://t.co/d05mhhjLuM >> 3adll #Ismdoor https://t.co/CpT6BIcUn9 3bexe #AgentTesla https://t.co/xHKfRA8AdR 1/2

JAMESWT_WT's tweet photo. "RE: Revisione dell'ordine" spam email #italy
#spread
1Gz
https://t.co/8IKz1bhMyz
2zip pw "1" not write inside email txt
https://t.co/JzOqN6wZqj
3Exe #AgentTesla
https://t.co/d05mhhjLuM
>>
3adll #Ismdoor
https://t.co/CpT6BIcUn9
3bexe #AgentTesla
https://t.co/xHKfRA8AdR
1/2 https://t.co/vmULuTN8kP

1

21

11

1

0

DomainTools @DomainTools

almost 7 years ago

[New Blog] Check out a new blog by Research Engineer, @piffey, that takes you through an investigation of Greenbug’s DNS tunneling in ISMDoor: https://t.co/WGnqjbqpko #ISMDoor

DomainTools's tweet photo. [New Blog] Check out a new blog by Research Engineer, @piffey, that takes you through an investigation of Greenbug’s DNS tunneling in ISMDoor: https://t.co/WGnqjbqpko #ISMDoor https://t.co/btgFKdqPvt

0

6

2

1

0

Ivon @ivoniswright

about 7 years ago

Did you know @BlackLotusLabs monitors over 742 million global DNS queries a day? See their latest #ThreatInltelligence uncovering how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling. https://t.co/3AHHhhnRq7

ivoniswright's tweet photo. Did you know @BlackLotusLabs monitors over 742 million global DNS queries a day? See their latest #ThreatInltelligence uncovering how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling. https://t.co/3AHHhhnRq7 https://t.co/yVFHRNj4Sz

0

1

2

0

John Heacock @heacojoh

about 7 years ago

Did you know @BlackLotusLabs monitors over 742 million global DNS queries a day? See their latest #ThreatInltelligence uncovering how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling. https://t.co/OWaK51wLpw

heacojoh's tweet photo. Did you know @BlackLotusLabs monitors over 742 million global DNS queries a day? See their latest #ThreatInltelligence uncovering how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling. https://t.co/OWaK51wLpw https://t.co/5V3dPHBYLu

0

1

0

Black Lotus Labs @BlackLotusLabs

about 7 years ago

We’ve been tracking malware that makes use of DNS tunneling for communications between infected devices and C2s, including #Ismdoor. Read more: https://t.co/rhMmzlGSYN

0

11

5

0

CenturyLink @CenturyLink

about 7 years ago

.@BlackLotusLabs uncovers how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling and why today’s #DigitalBusiness should keep DNS traffic on their radar. Full blog below.

CenturyLink's tweet photo. .@BlackLotusLabs uncovers how malicious actors are using #ISMDoor to conduct cyberattacks leveraging DNS tunneling and why today’s #DigitalBusiness should keep DNS traffic on their radar. Full blog below.

0

7

4

0

Silv0123 @silv0123

almost 8 years ago

Recently uploaded (old) ISMdoor sample File Name: WmiPrv.exe MD5: 715aad888023a3a85adc5d28026dd4f7 Timestamp: 2017-09-05 09:06:56 C2: securepackupdater./com (SinkHole) Used to communicate to C2 using Google's DNS 8.8.8.8 #ISMagent #ISMdoor #APT34 #OilRig #Trashtics #Malware

0

2

0

1

0

やまちゃん @yamayamaorange

about 8 years ago

ismdoor 12/1に決定❗️ 詳細は追って連絡が致します。今から予定の調整をば❗️ #ismdoor #徳島 #12月1日 #p-paradise https://t.co/5bog8gfzg3

0

3

1

0

azusa0226 @azuzuzu0213

about 8 years ago

雨の中観に来てくれた方、関係者の皆様ありがとうございました☺️💗 #ismDoor Vol.2 #レナnice酔っ払い #先輩も#後半も#いっぱそして #この年になっても#同期の仲間が5人も#ここにいる有り難さ https://t.co/aQgQ2PwRIa

0

2

0

ippei castle ohshiro @IppeiOhshiro

about 8 years ago

まじで終始おもろかったー！最高のイベントです！🔥 みのさん、たむたむさん、だいこくさん、ありがとうございました！🙏 #ismdoor #p_paradise #pink徳島 #bboy #bgirl #beer https://t.co/edWlXleB3w

0

3

1

0

Intezer @IntezerLabs

over 8 years ago

Catching the new #ISMDoor #malware variant found by @DrunkBinary by identifying code similarities. Only 5/65 on VT https://t.co/qZuXeRmJvM

IntezerLabs's tweet photo. Catching the new #ISMDoor #malware variant found by @DrunkBinary by identifying code similarities. Only 5/65 on VT
https://t.co/qZuXeRmJvM https://t.co/i0cHZ8vpk6

0

4

7

0

Itai Tevet @itaitevet

almost 9 years ago

@securitydoggo @James_inthe_box @IdoNaor1 @eyalsela @ImPureMotion Code reuse analysis confirms it's #ISMAgent #ISMDoor https://t.co/Na4EqmE61m Seems like just a new hash, no code is unique here

3

5

2

0

Eyal Sela

@eyalsela

almost 9 years ago

#ISMDoor impersonates ZAHRANI (an electrical equipment and engineering company in Saudi Arabia) and ThetaRay. IOCs: https://t.co/l3iNlev6G4

eyalsela's tweet photo. #ISMDoor impersonates ZAHRANI (an electrical equipment and engineering company in Saudi Arabia) and ThetaRay. IOCs:
https://t.co/l3iNlev6G4 https://t.co/P09WNsj4Zb

0

33

25

0

@blu3_team @blu3_team

about 9 years ago

#ISMDoor #malware f5ef3b060fb476253f9a7638f82940d9 thetaraysecurityupdate\.com

0

6

4

0

ᵖRͥoͤmͭaͬnͦo @tribal_sec

about 9 years ago

#Iran-linked #OilRig #hacked group use a new #Trojan in Middle East #Attacks https://t.co/zOGD1Us3ji #CyberAttack #ISMDoor #RAT #malware

0

1

0

Robert Falc @r0bf4lc

about 9 years ago

#OilRig #ISMAgent payload uses same DNS tunneling protocol as #ISMDoor.. OilRig == #Greenbug? https://t.co/oLiuaieb8L

0

3

1

0

Eyal Sela

@eyalsela

about 9 years ago

New #Ismdoor served from 217.182.190\.33/hhhb3.exe. IP allocated to ersthost, an Iranian hosting company 3ecf62e9de512826d78b3dcf6a863f94

$eyalsela's tweet photo. New #Ismdoor served from 217.182.190\.33/hhhb3.exe. IP allocated to ersthost, an Iranian hosting company 3ecf62e9de512826d78b3dcf6a863f94 https://t.co/CyL2rk6HoD$

0

20

23

0

Eyal Sela

@eyalsela

over 9 years ago

New #Ismdoor by #Greenbug uploaded from Saudi Arabia; DNS C2: arielsecurityupdater\.com (A record in IR gov AS; NS pointed to IR hosting)

$eyalsela's tweet photo. New #Ismdoor by #Greenbug uploaded from Saudi Arabia; DNS C2: arielsecurityupdater\.com (A record in IR gov AS; NS pointed to IR hosting) https://t.co/RJhY1q8zHf$