norosta[.]ruDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“On the other hand, the check-host.net implementation revealed the use of actor-controlled domains, specifically norosta[.]ru and randomized subdomains of selltosell.ru, to resolve C2 or staging IP.”
Indicators reported together
named in the same reports- write[.]asin 1 report
- lesma[.]euin 1 report
- tebi[.]ioin 1 report
- de-fra.i3storage[.]comin 1 report
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- check-host[.]netin 1 report
- selltosell[.]ruin 1 report
- hxxps://rentry[.]co/hwzrmfkxin 1 report
- serveirc[.]comin 1 report
- webhop[.]mein 1 report
- serveftp[.]comin 1 report
- myvnc[.]comin 1 report
- hxxps://api.telegra[.]ph/getPage/Hello-01-23-161in 1 report
- hxxps://write[.]as/api/posts/1nei1af6dnw8qin 1 report
- hxxps://mastodon[.]social/api/v1/statuses/115942411657067215in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.