s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-MAL-js.jsprat

📛 Threat Title

Malware family: jspRAT

Category: jspRAT First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `js.jsprat`. Printable name: jspRAT.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain js.jsprat VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jsprat

IOC database

Type
domain
Value
js.jsprat
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-js.jsprat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jsprat

References (1)

Remediations (10)

  • web:apt.etda.or.th

    Threat Group Cards: A Threat Actor Encyclopedia Tool: JSPRAT ... Last change to this tool card: 28 December 2021 Download this tool card in JSON format Previous: jsp File browser Next: JSPSPY All groups using tool JSPRAT ... 1 group listed (1 APT, 0 other, 0 unknown) ↑

  • web:attack.mitre.org

    Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser. [1] JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the ...

  • web:cloud.google.com

    Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. FIN13's operations have several noticeable differences from current cybercriminal data theft and ransomware extortion trends.

  • web:malpedia.caad.fkie.fraunhofer.de

    Details for the jspRAT malware family including references, samples and yara signatures.

  • web:openhunting.io

    (Mandiant) The usage of JSPRAT by FIN13 allows the actor to achieve local command execution, upload/download files, and proxy network traffic for additional pivoting during later stages of the intrusion.

  • web:www.cisa.gov

    It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  • web:www.fortinet.com

    This Adversary Playbook from FortiGuard Labs on the threat malware family known as "JsOutProx" was created for our customers, as well as part of our role in the Cyber Threat Alliance. For more information regarding this series of adversary playbooks being created by CTA members, please visit the Cyber Threat Alliance Playbook Whitepaper.

  • web:www.microsoft.com

    Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  • web:www.ncsc.gov.uk

    How to defend organisations against malware or ransomware attacks.

  • web:www.trendmicro.com

    This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.