TF-MAL-py.responder
📛 Threat Title
Malware family: Responder
Description
ThreatFox malware family `py.responder`. Printable name: Responder. Aliases: SpiderLabs Responder.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
py.responder
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.responder
IOC database
- Type
- domain
- Value
py.responder- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-py.responder
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.responder
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. [1] This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate ...
-
web:cherry-security.com
Attacking with Responder Enough theory—let's get practical and simulate a real-world attack using Responder ! First, I launch Responder on my Kali Linux system. As soon as it starts, Responder begins poisoning name resolution requests and offering fake services for all clients to connect to.
-
web:github.com
a simple incident response playbook outlining step-by-step procedures for responding to common cybersecurity incidents such as malware infections, data breaches, or insider threats,Including escalation paths. - Incident-Response-Playbooks/ Malware Infection at main · aeeshah/Incident-Response-Playbooks
-
web:learn.microsoft.com
If your organization is using Defender for Endpoint (or Defender for Business), automated investigation and remediation capabilities can save your security operations team time and effort. As outlined in this blog post, these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.crowdstrike.com
Remediate faster Execute built-in commands or custom scripts to easily carry out complex remediation actions on any managed endpoint remotely. Connect to and quickly isolate the impacted endpoint, then remove malicious files to immediately shut down the attack.
-
web:www.cynet.com
We protect our customers from this attack by actively searching for instances of Responder on the network, as well as utilizing passive mitigation methods.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.