216.73.217.22

CNC

· Published 21/12/2025 13:26 · Modified 21/12/2025 13:26 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 13:26
Modified
21/12/2025 13:26
Updated at
21/12/2025 13:26
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 22 attack patterns (mitre), 13 malware, 2 sectors, 2 countries, 11 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (22)

  • T1547.001 uses
    Registry Run Keys / Startup Folder
  • T1056.001 uses
    Keylogging
  • T1074 uses
    Data Staged
  • T1005 uses
    Data from Local System
  • T1573.002 uses
    Asymmetric Cryptography
  • T1566.001 uses
    Spearphishing Attachment
  • T1059 uses
    Command and Scripting Interpreter
  • T1059.003 uses
    Windows Command Shell
  • T1553.002 uses
    Code Signing
  • T1547 uses
    Boot or Logon Autostart Execution
  • T1056 uses
    Input Capture
  • T1102.002 uses
    Bidirectional Communication
  • T1204.002 uses
    Malicious File
  • T1573 uses
    Encrypted Channel
  • T1102 uses
    Web Service
  • T1204 uses
    User Execution
  • T1571 uses
    Non-Standard Port
  • T1091 uses
    Replication Through Removable Media
  • T1074.001 uses
    Local Data Staging
  • T1566 uses
    Phishing
  • T1113 uses
    Screen Capture
  • T1553 uses
    Subvert Trust Controls

Malware (13)

Sectors (2)

  • Government targets
  • Education targets

Countries (2)

  • British Indian Ocean Territory targets
  • India targets

Indicators (11)

  • https://aliyunconsole.com/product/VectorRetrievalService/dashvector indicates
  • c75cbbb4435e0e7392db00a854c72fe48ef5811308e84707cf5bbf3798527234 indicates
  • https://185.140.12.224/.vendor/git/srclog indicates
  • https://66.85.26.161:443/csgdyhfywhefdj/gdydfhasc/qgtopl.exe indicates
  • https://66.85.26.161:443/csgdyhfywhefdj/gdydfhasc/chsgdjc.pdf indicates
  • https://192.52.166.252/cgyusdft/whfgujfg/calc.exe indicates
  • https://aliyunconsole.com/alcloud/dgyx-4121-Firnsnxywfytw indicates
  • https://185.140.12.224/logindex.php?q=ascii indicates
  • aliyunconsole.com indicates
  • https://185.140.12.224/licenseAdministrator/discover.xml indicates
  • https://192.52.166.252/cgyusdft/whfgujfg/tt.pdf indicates