Top Tweets for #ZxShell

about 4 years ago

now payload hosting here #GoldDragon #ZxShell hxxp://118.27.3.39/xghk.exe

about 4 years ago

Again Chinese Threat Actor changed the location of #Winnti panel and payload #GoldDragon #ZxShell C2: ip: 204.15.78.131:3510 (TCP) url: us2\.\host\.\skybad\.\top Actual Payload hosted here : hxxp://150.158.27.38/xghk.exe (Active) hash: 23ae5b23ad69d731d7a80dd015aea3b9

$0xrb's tweet photo. Again Chinese Threat Actor changed the location of #Winnti panel and payload #GoldDragon #ZxShell C2: ip: 204.15.78.131:3510 (TCP) url: us2\.\host\.\skybad\.\top Actual Payload hosted here : hxxp://150.158.27.38/xghk.exe (Active) hash: 23ae5b23ad69d731d7a80dd015aea3b9 https://t.co/59BYVcI5LG$

R. @0xrb

about 4 years ago

Recent Chinese Threat Actor #Winnti panel C2: ip: 204.15.78.131:3220 (TCP) url: us\.\host.skybad\.\top Actual Payload hosted here : http://160.251.42(.)252/xghk.exe hash: c99397d66e49e2def1b17f57cd0c5fb9 #GoldDragon #ZxShell #threatintel cc: @500mk500 (;

$0xrb's tweet photo. Recent Chinese Threat Actor #Winnti panel C2: ip: 204.15.78.131:3220 (TCP) url: us\.\host.skybad\.\top Actual Payload hosted here : http://160.251.42(.)252/xghk.exe hash: c99397d66e49e2def1b17f57cd0c5fb9 #GoldDragon #ZxShell #threatintel cc: @500mk500 (; https://t.co/p6jtlQEugf$

Andy Svintsitsky

@AndySvints

over 6 years ago

#APT27 #ZxShell #RootKit updates 3 changes: • reversed the list of strings that identify the files that the Driver hides • disguise use of the undocumented Microsoft API “ObReferenceObjectByName” • moved part of the logic maintaining same functionality https://t.co/hhAVGejejh

Top Tweets for #ZxShell

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users