TF-MAL-elf.zhtrap
📛 Threat Title
Malware family: ZHtrap
Description
ThreatFox malware family `elf.zhtrap`. Printable name: ZHtrap.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.zhtrap
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zhtrap
IOC database
- Type
- domain
- Value
elf.zhtrap- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.zhtrap
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zhtrap
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the ZHtrap malware family including references, samples and yara signatures.
-
web:media.defense.gov
A functioning botnet can be used for a variety of purposes, including malware delivery, distributed denial of service (DDoS) attacks, or routing nefarious Internet traffic. The botnet uses the Mirai family of malware , designed to hijack IoT devices such as webcams, DVRs, IP cameras, and routers running Linux-based operating systems.
-
web:snyk.io
Shai-Hulud NPM Attack: Remediation with Snyk — Walkthrough of using Snyk to identify compromised packages in your dependency tree and remediate exposure. Summary: indicators of compromise Community-maintained detection scripts: GLPMC/Tanstack-Worm-Detector and omarpr/mini-shai-hulud-ioc-scanner (please do verify before using these, though).
-
web:www.bleepingcomputer.com
A new botnet is hunting down and transforming infected routers, DVRs, and UPnP network devices into honeypots that help it find other targets to infect. The malware , dubbed ZHtrap by the 360 ...
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.datatechguard.com
Just when we thought we had seen the last of the Mirai botnet, new variants like OMG, ZHTrap , and Mukashi emerged, reminding us of the ever-present threat to IoT security. These variants continue to exploit the vulnerabilities exposed by the original Mirai botnet attack, targeting insecure IoT devices to expand their malicious networks.
-
web:www.enigmasoftware.com
An example of the latter is the ZHtrap Botnet discovered by the researchers at 360 Netlab. The malware can take over a wide range of devices and assimilate them into the structure of the botnet.
-
web:www.infosecinstitute.com
A new botnet called ZHtrap is deploying honeypots to capture attacks from other botnets and use that information to hijack their infrastructures. Security researchers from Netlab 360 Team discovered a recent Mirai-based botnet dubbed ZHtrap that implements a honeypot mechanism to find more victims and use them to launch powerful attacks in the wild. According to the NetLab researchers, " the ...
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.