TF-MAL-apk.luckycat
📛 Threat Title
Malware family: LuckyCat
Description
ThreatFox malware family `apk.luckycat`. Printable name: LuckyCat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.luckycat
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.luckycat
IOC database
- Type
- domain
- Value
apk.luckycat- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.luckycat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.luckycat
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Tool: Lucky Cat ... Last change to this tool card: 28 December 2022 Download this tool card in JSON format
-
web:documents.trendmicro.com
The Luckycat campaign attacked a diverse set of targets using a variety of malware , some of which have been linked to other cyber-espionage campaigns. The attackers behind this campaign maintain a diverse set of C&C infrastructure and leverages anonymity tools to obfuscate their operations.
-
web:github.com
Repository of yara rules. Contribute to Yara-Rules/rules development by creating an account on GitHub.
-
web:malpedia.caad.fkie.fraunhofer.de
A series of attacks, targeting both Indian military research and south Asian shipping organizations, demonstrate the minimum level of effort required to successfully compromise a target and steal sensitive information. The attackers use very simple malware , which required little development time or skills, in conjunction with freely available Web hosting, to implement a highly effective attack ...
-
web:secoperations.wordpress.com
A China-linked cyberespionage group, tracked as TA413 (aka LuckyCat ), is exploiting recently disclosed flaws in Sophos Firewall (CVE-2022-1040) and Microsoft Office (CVE-2022-30190) to deploy a never-before-detected backdoor called LOWZERO in attacks aimed at Tibetan entities.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.f-secure.com
LuckyCat.A's icon and screenshot LuckyCat.A exhibits remote access trojan (RAT) capabilities, and connects to a command and control (C&C) server that further instructs the malware to perform these actions: Browse directory in the device Download file from the device Upload file to the device Send information to the C&C server More details For additional reading on the LuckyCat APT campaign ...
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.scribd.com
The document discusses a targeted cyber espionage campaign called Luckycat that has targeted entities in India, Japan, and Tibet since 2011 using diverse malware and infrastructure. The campaign compromised over 200 computers and is attributed to hackers in China based on open source research linking accounts and infrastructure to individuals in China.
-
web:www.securityweek.com
Malware & Threats New LuckyCat -Linked RAT Targets Users in Tibet A malware attack using a newly discovered backdoor has been targeting the mailing list of the organization officially representing the Tibetan government-in-exile.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.