TF-MAL-js.jsprat
📛 Threat Title
Malware family: jspRAT
Description
ThreatFox malware family `js.jsprat`. Printable name: jspRAT.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.jsprat
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jsprat
IOC database
- Type
- domain
- Value
js.jsprat- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.jsprat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jsprat
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Threat Group Cards: A Threat Actor Encyclopedia Tool: JSPRAT ... Last change to this tool card: 28 December 2021 Download this tool card in JSON format Previous: jsp File browser Next: JSPSPY All groups using tool JSPRAT ... 1 group listed (1 APT, 0 other, 0 unknown) ↑
-
web:attack.mitre.org
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser. [1] JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the ...
-
web:cloud.google.com
Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. FIN13's operations have several noticeable differences from current cybercriminal data theft and ransomware extortion trends.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the jspRAT malware family including references, samples and yara signatures.
-
web:openhunting.io
(Mandiant) The usage of JSPRAT by FIN13 allows the actor to achieve local command execution, upload/download files, and proxy network traffic for additional pivoting during later stages of the intrusion.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fortinet.com
This Adversary Playbook from FortiGuard Labs on the threat malware family known as "JsOutProx" was created for our customers, as well as part of our role in the Cyber Threat Alliance. For more information regarding this series of adversary playbooks being created by CTA members, please visit the Cyber Threat Alliance Playbook Whitepaper.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.trendmicro.com
This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.