OTX-604f4c3467af75530a3caafe
high
📛 Threat Title
PupyRAT - C2 IP/Domain Tracker
Description
This pulse contains IOCs related to PupyRAT Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
27.50.70.46
IOC database
- Type
- ipv4
- Value
27.50.70.46- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
64.7.199.151
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for ip_addresses/64.7.199.151
IOC database
- Type
- ipv4
- Value
64.7.199.151- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for ip_addresses/64.7.199.151
References (1)
-
OTX pulse
AlienVaulkt OTX
This pulse contains IOCs related to PupyRAT Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Remediations (8)
-
web:attack.mitre.org
Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]
-
web:gbhackers.com
Security researchers from Recorded Future observed a European energy sector organization Email server communicating with the PupyRAT command and control ( C2 ) server between late November 2019 until at least January 5, 2020.
-
web:github.com
C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/ C2 infrastructure.
-
web:medium.com
A: Remote Access What IP address has been mapped as the PupyRAT C2 Server A: 89.107.62.39 From the Intrusion Set Galaxy, what attack group is known to use this form of attack? A: Magic Hound There ...
-
web:www.recordedfuture.com
Insikt Group identified a PupyRAT C2 server communicating with a mail server for a European energy sector organization starting late last year.
-
web:www.securityweek.com
Recent attacks aimed at a key organization in the European energy sector involved PupyRAT , a piece of malware used by Iran-linked threat groups
-
web:www.sharitsec.eu.org
Malware strains that target Linux systems generally have their process names changed to resemble normal processes to conceal themselves. One of the characteristics of Pupy RAT is that it changes the process name to "/usr/sbin/atd" at runtime by default. Of course, some threat actors may use different path names. The different names can be used as one of the factors for distinguishing ...
-
web:www.threatdown.com
An initial two domains were being used as Command & Control centers ( C2 ), with almost all of the C2 communications originating from Russia. From there, further research identified a DNS signature not related to Pupy components.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.