TF-MAL-js.kopiluwak
📛 Threat Title
Malware family: KopiLuwak
Description
ThreatFox malware family `js.kopiluwak`. Printable name: KopiLuwak.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.kopiluwak
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.kopiluwak
IOC database
- Type
- domain
- Value
js.kopiluwak- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.kopiluwak
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.kopiluwak
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
KOPILUWAK is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017. [1]
-
web:bazaar.abuse.ch
KopiLuwak malware samples MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as KopiLuwak .
-
web:cloud.google.com
In September 2022, Mandiant discovered a suspected Turla Team operation, currently tracked as UNC4210, distributing the KOPILUWAK reconnaissance utility and QUIETCANARY backdoor to ANDROMEDA malware victims in Ukraine. Mandiant discovered that UNC4210 re-registered at least three expired ANDROMEDA command and control (C2) domains and began profiling victims to selectively deploy KOPILUWAK and ...
-
web:cve.nohackme.com
KOPILUWAK is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.
-
web:filescanio.github.io
This technical analysis of a Turla APT malware sample underscores the depth and sophistication of modern cyber threats, and how an emulated-based sandbox can save massive amount of time by automatically de-obfuscating multiple encryption layers until it reaches the C2 servers. This malware is KopiLuwak , a JavaScript-based reconnaissance tool widely used for victim profiling and C2 ...
-
web:hivepro.com
The Turla Group is reportedly distributing the KOPILUWAK reconnaissance software and the QUIETCANARY backdoor to victims of ANDROMEDA malware in Ukraine. ANDROMEDA malware , spread through infected USB drives. KOPILUWAK is a JavaScript-based reconnaissance utility that has been been distributed to victims as a first-stage malicious email attachment. Following the initial execution and ...
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the KopiLuwak malware family including references, samples and yara signatures.
-
web:securelist.com
Victims in Ukraine were infected with KopiLuwak and QUIETCANARY, two malware strains previously associated with Turla. While publicly available data indeed shows that anam0rph [.]su was re-registered on August 12, 2022, we couldn't find any link between Andromeda and KopiLuwak from our telemetry.
-
web:socprime.com
With USB-spreading malware becoming a popular vector for initial access, cyber defenders remain vigilant in safeguarding the organization's critical infrastructure. Cybersecurity researchers have recently observed malicious activity of the russia-linked cyberespionage group tracked as Turla APT leveraging legacy Andromeda USB-delivered malware to deploy novel backdoors and custom ...
-
web:www.infosecurity-magazine.com
The advanced persistent group (APT) known as Tomiris has been observed deploying KopiLuwak and TunnusSched malware , attack tools previously linked to another APT group named Turla. Security experts at Kaspersky shared the findings in an advisory published earlier today, where they analyzed Tomiris ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.