Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects network connections to known C2 servers and payload delivery URLs associated with a PureRAT campaign. This activity is linked to a Vietnamese threat actor using AI to generate their toolset.
Detects network connections to domains identified as part of the IClickFix redirection infrastructure. These domains host the initial JavaScript payloads or act as part of the Traffic Distribution System (TDS).
Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.
Detects the creation or setting of the specific environment variable 'ALLUSERSPROFILE_X'. This variable is used as a mandatory execution gate by a malware campaign delivering Amatera Stealer to ensure that the initial user-assisted execution step was completed.
Detects network connections to known Command and Control (C2) domains used by NetSupport RAT as delivered by the IClickFix framework.
Detects the use of 'chmod 000' on PHP files within common web root directories. This technique is used by threats like the EncystPHP web shell to make malicious files unreadable, unwritable, and non-executable, effectively locking them to prevent inspection or removal.
Detects network connections to a known Amatera Stealer C2 IP address where the HTTP Host header is spoofed. This technique is used by the malware to masquerade its C2 traffic, often by using a legitimate-looking or unrelated domain in the Host header, while communicating directly with the malicious IP address.
Detects network traffic to fallback command and control (C2) domains generated by the 'Children Protection' malicious browser extension. The extension uses a Domain Generation Algorithm (DGA) based on the current date to provide resilient C2 infrastructure.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects the creation of a hidden directory under %LOCALAPPDATA%\Google Chrome. This technique is used by a Vietnamese threat actor associated with the PureRAT campaign to stage malicious components while blending in with legitimate application data.
Page 25 of 30