#ismagent - Twitter Hashtag

almost 8 years ago

Recently uploaded (old) ISMdoor sample File Name: WmiPrv.exe MD5: 715aad888023a3a85adc5d28026dd4f7 Timestamp: 2017-09-05 09:06:56 C2: securepackupdater./com (SinkHole) Used to communicate to C2 using Google's DNS 8.8.8.8 #ISMagent #ISMdoor #APT34 #OilRig #Trashtics #Malware

0

2

0

1

0

Itai Tevet @itaitevet

over 8 years ago

Fun fact: @IntezerLabs shows that #ROKRAT by #Group123 (North Korea), shared code with Iranian APT #ISMAgent. Code is WinHTTPClient from @codeproject. This is the third time I see these two threat actors using same @codeproject code. https://t.co/1nVndHeRqu

itaitevet's tweet photo. Fun fact: @IntezerLabs shows that #ROKRAT by #Group123 (North Korea), shared code with Iranian APT #ISMAgent. Code is WinHTTPClient from @codeproject. This is the third time I see these two threat actors using same @codeproject code.

https://t.co/1nVndHeRqu https://t.co/Mqsi0QiyZj

7

95

52

0

Itai Tevet @itaitevet

almost 9 years ago

@securitydoggo @James_inthe_box @IdoNaor1 @eyalsela @ImPureMotion Code reuse analysis confirms it's #ISMAgent #ISMDoor https://t.co/Na4EqmE61m Seems like just a new hash, no code is unique here

3

5

2

0

Robert Falc @r0bf4lc

almost 9 years ago

Just for clarity, #OilRig/#APT34 #BONDUPDATER does not appear to use a DGA. Payloads (#Helminth, #ISMAgent, #ALMACommunicator) that use DNS for C2 comms generate specially crafted sub-domains as part of their DNS tunneling protocol to send/recv data over DNS.

1

9

2

0

PhysicalDrive0 @PhysicalDrive0

about 9 years ago

#ISMAgent Sample MD5 96b47c5af8652ac99150bf602a88498b https://t.co/zX9fXt0g64 #GreenBug https://t.co/7yGdBUK2E3

ClearSky Cyber Security

@ClearskySec

about 9 years ago

New Infrastructure of ISMAgent, a trojan by Iranian Group GreenBug, disguised as a base64 digital certificate ! https://t.co/O7z2kVXf7r

ClearskySec's tweet photo. New Infrastructure of ISMAgent, a trojan by Iranian Group GreenBug, disguised as a base64 digital certificate !
https://t.co/O7z2kVXf7r https://t.co/YXqSTR0Hgv

0

1

4

0

18

21

0

Eyal Sela

@eyalsela

about 9 years ago

1\ #Greenbug email targeting Saudi Arabia org (See image), contains "Important.xls "(https://t.co/9UCbhPrPTx), drops netsrvd.exe (#ISMAgent)

$eyalsela's tweet photo. 1\ #Greenbug email targeting Saudi Arabia org (See image), contains "Important.xls "(https://t.co/9UCbhPrPTx), drops netsrvd.exe (#ISMAgent) https://t.co/0gVeCTm7mN$