TF-MAL-js.nanhaishu
📛 Threat Title
Malware family: NanHaiShu
Description
ThreatFox malware family `js.nanhaishu`. Printable name: NanHaiShu.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.nanhaishu
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.nanhaishu
IOC database
- Type
- domain
- Value
js.nanhaishu- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.nanhaishu
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.nanhaishu
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.cloudfall.cn
NanHaiShu NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute. [1][2] ID: S0228 ⓘ Type: MALWARE ⓘ Platforms: Windows Version: 1.1 Created: 18 April 2018 Last Modified: 23 June 2020 ATT&CK ...
-
web:attack.mitre.org
NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.
-
web:blog-assets.f-secure.com
SUMMARY This whitepaper details a malicious program we identify as NanHaiShu . Based on our analysis, the threat actor behind this malware targets government and private-sector organizations. Notable targets of the malware include the Department of Justice of the Philippines, the organizers of the Asia-Pacific Economic Cooperation (APEC) Summit and a major international law firm.
-
web:malpedia.caad.fkie.fraunhofer.de
NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.
-
web:pasei.com
The malware has been dubbed NanHai Shu, in which NanHai means South Sea, and Shu means Rat, the animal. NanHai Shu is spread with a crafted spear-phising emails that contains industry-specific terms which is relevant to each of the targeted organizations, that is indicating specific emails that were designed with the target in mind.
-
web:thehackernews.com
Cybersecurity researchers are calling attention to a search engine optimization (SEO) poisoning campaign likely undertaken by a Chinese-speaking threat actor using a malware called BadIIS in attacks targeting East and Southeast Asia, particularly with a focus on Vietnam. "To perform SEO poisoning ...
-
web:www.academia.edu
The People's Republic of China's (PRC) assertive power projection in the South China Sea (SCS) and its consequences in the form of hybrid threats have increasingly become an accepted reality of the region. China has gradually constructed this "new normal" or "fait accompli" under the framework of its assertive policies which have generated geostrategic repercussions both in the regional and ...
-
web:www.cybervision.co.za
NanHaiShu : "Rat"ing the South China Sea This whitepaper details a malicious program we identify as NanHaiShu . Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.
-
web:www.securityweek.com
A cyber espionage group previously linked to China has been using a recently patched .NET vulnerability in attacks aimed at organizations in the United States, including a shipbuilding company and a university research center with ties to the military. The threat actor, known for its use of a remote access trojan (RAT) named NanHaiShu , has been active since at least 2014. In the past years, it ...
-
web:www.spamfighter.com
The campaign appears to have targeted Philippines particularly, whereas the malware named NanHaiShu by the F-Secure seemed to utilize code as well as infrastructure related to China. Targets were infected with malicious files that are attached to the spear-phishing emails.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.