issuer[.]countryDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
PikaBot: a Guide to its Deep Secrets and Operations“services:(tls.certificates.leaf_data.issuer.province=/[A-Z]{2}/ and tls.certificates.leaf_data.issuer[.]country=/[A-Z]{2}/ and tls.certificates.leaf_data.issuer.organization=/[A-Z][a-z]{4,24}( [A-Z][a-z]{4,24})?( Inc.)?/ and tls.certificates.leaf_data.issuer.common_name=/[a-z]{6,32…”
Indicators reported together
named in the same reports- 959da0fb174a8e4d…76a2f43c0f25in 1 report
- data[.]datain 1 report
- lordless[.]namein 1 report
- resonancessewars[.]tiresin 1 report
- alkaliesnonperspective[.]fishin 1 report
- demonising[.]liin 1 report
- callipersoutane[.]comin 1 report
- hxxps://redops[.]at/en/blog/direct-syscalls-vs-indirect-syscallsin 1 report
- redops[.]atin 1 report
- hxxps://www.vmray[.]com/cyber-security-blog/why-your-edr-let-pikabot-jump-through/in 1 report
- www.vmray[.]comin 1 report
- hxxps://victorbush[.]com/2015/04/the-anti-rootkit-rootkit/in 1 report
- victorbush[.]comin 1 report
- hxxps://blog.krakz[.]fr/notes/syswhispers2/in 1 report
- blog.krakz[.]frin 1 report
- hxxps://medium[.]com/@DCSO_CyTec/shortandmalicious-pikabot-and-the-matanbuchus-connection-5e302644398in 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.