s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-MAL-asp.localolive

📛 Threat Title

Malware family: LocalOlive

Category: LocalOlive First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `asp.localolive`. Printable name: LocalOlive.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain asp.localolive VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/asp.localolive

IOC database

Type
domain
Value
asp.localolive
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-asp.localolive

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/asp.localolive

References (1)

Remediations (10)

  • Russian Hackers Target Government with Stealthy "Living-Off-the-Land ...
    web:gbhackers.com

    Russian-linked attackers have intensified their targeting of Ukrainian organizations through sophisticated intrusions that rely heavily on legitimate Windows tools rather than malware . The attackers demonstrated remarkable restraint in their malware deployment, instead leveraging living-off-the-land tactics and dual-use tools to evade detection while accomplishing their objectives. A recent ...

  • LocalOlive (Malware Family)
    web:malpedia.caad.fkie.fraunhofer.de

    LocalOlive Propose Change Actor (s): Sandworm According to Microsoft, this is a web shell, written in ASPX supporting C#, carrying sufficient yet rudimentary functionality to support the following secondary activities: uploading and downloading files, running shell commands, opening a port (default port is set to TCP 250).

  • Emulating the Destructive Sandworm Adversary - Security Boulevard
    web:securityboulevard.com

    After breaching these systems, the attackers deployed a custom webshell known as LocalOlive , a tool previously identified in past Sandworm-related intrusions. The presence of this webshell, along with the operational style of the intrusion, is a key factor driving the current (but still unconfirmed) suspicion of Sandworm involvement.

  • Emulating the Destructive Sandworm Adversary - AttackIQ
    web:www.attackiq.com

    After breaching these systems, the attackers deployed a custom webshell known as LocalOlive , a tool previously identified in past Sandworm-related intrusions. The presence of this webshell, along with the operational style of the intrusion, is a key factor driving the current (but still unconfirmed) suspicion of Sandworm involvement.

  • Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
    web:www.breachsense.com

    Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  • Technical Approaches to Uncovering and Remediating Malicious ... - CISA
    web:www.cisa.gov

    It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  • New eBPF Filters for Symbiote and BPFdoor Malware
    web:www.fortinet.com

    FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  • Trojan:Win32/LocalOlive.C!dha - microsoft.com
    web:www.microsoft.com

    Take these steps to help prevent malware infection on your computer. Guidance for enterprise administrators and Microsoft 365 Defender customers Ransomware more than often attacks enterprises than individuals. Following the below mitigation stepTake these steps to help prevent malware infection on your computers can help prevent ransomware attacks.

  • Mitigating malware and ransomware attacks - The National Cyber Security ...
    web:www.ncsc.gov.uk

    How to defend organisations against malware or ransomware attacks.

  • Ukrainian Organizations Still Heavily Targeted by Russian Attacks
    web:www.security.com

    Protection/ Mitigation For the latest protection updates, please visit the Symantec Protection Bulletin. Indicators of Compromise If an IOC is malicious and the file available to us, Symantec Endpoint products will detect and block that file. File indicators 636e04f0618dd578d107f440b1cf6c910502d160130adae5e415b2dd2b36abcb - Localolive Webshell

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.