Overview 80 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| domain | 78 | EARTHESTRIES-domain.txt |
| ipv4 | 1 | EARTHESTRIES.json |
| url | 1 | EARTHESTRIES.json |
Principal sources 9 reports
Ranked by how many of this actor's indicators each report brought in.
- 32trendmicro.com/en_us/research/23/h/earth-estries-targe…
- 32trendmicro.com/content/dam/trendmicro/global/en/resear…
- 17synacktiv.com/publications/krustyloader-rust-malware-…
- 17github.com/synacktiv/krustyloader-analysis
- 16trendmicro.com/content/dam/trendmicro/global/en/resear…
- 11x.com/tdatwja/status/1873363875363688459
- 11khonggianmang.vn/uploads/1_20241120_CV_APT_EARTHESTRIES_…
- 2businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-o…
Related groups 2
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 80 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-o…
sentinelonepro.com virusblocker.it.com -
security.com/threat-intelligence/toolshell-china-zin…
kia-almotores.s3.amazonaws.com omnileadzdev.s3.amazonaws.com -
x.com/tdatwja/status/1873363875363688459 · khonggianmang.vn/uploads/1_20241120_CV_APT_EARTHESTRIES_…
awsdns531.com c11r.awsdns531.com cas04.awsdns531.com cdn181.awsdns531.com credits.officesanalytics.com globalnetzone.bcdn.net llnw-dd.awsdns531.com officesanalytics.com resource.officesanalytics.com services.officesanalytics.com soffice.officesanalytics.com -
trendmicro.com/content/dam/trendmicro/global/en/resear…
api.solveblemten.com billing.clothworls.com esh.hoovernamosong.com helpdesk.stnekpro.com infraredsen.com jasmine.lhousewares.com materialplies.com news.colourtinctem.com private.royalnas.com pulseathermakf.com telcom.grishamarkovgf8936.workers.dev vpn114240349.softether.net vpn305783366.softether.net vpn487875652.softether.net vpn943823465.softether.net -
trendmicro.com/content/dam/trendmicro/global/en/resear…
imap.dateupdata.com -
synacktiv.com/publications/krustyloader-rust-malware-… · github.com/synacktiv/krustyloader-analysis
2261992.s3.amazonaws.com acapros-app.s3-us-west-2.amazonaws.com ahha-asset.s3.ap-northeast-2.amazonaws.com api.farstream.org bbr-promo.s3.amazonaws.com be-at-home.s3.ap-northeast-2.amazonaws.com beansdeals-static.s3.amazonaws.com bigtimeassets.s3.amazonaws.com blog-app-system2.s3.amazonaws.com breaknlinks.s3.amazonaws.com check.sysupdates.org farstream.org music.farstream.org ntp.sysupdates.org sysupdates.org update.sysupdates.org video.farstream.org -
trendmicro.com/en_us/research/23/h/earth-estries-targe… · trendmicro.com/content/dam/trendmicro/global/en/resear…
domain access.trhammer.com domain anynucleus.com domain cdn-6dd0035.oxcdntech.com domain cdn-7a3d.vultr-dns.com domain cdn728a66b0.smartlinkcorp.net domain cloudlibraries.global.ssl.fastly.net domain dns2021.net domain east.smartpisang.com domain jptomorrow.com domain jttoday.net domain keyplancorp.com domain linkaircdn.com domain lyncidc.com domain microware-help.com domain mncdntech.com domain ms101.cloudshappen.com domain nx2.microware-help.com domain oxcdntech.com domain publicdnsau.com domain rthtrade.com domain rtsoftcorp.com domain rtwebmaster.com domain shinas.global.ssl.fastly.net domain substantialeconomy.com domain trhammer.com domain vultr-dns.com domain web9a78bc52.trhammer.com domain z7-tech.com domain zmailssl3.global.ssl.fastly.net ipv4 103.159.133.205:443 url http://96.44.160.181 -
trendmicro.com/en_us/research/23/h/earth-estries-targe… · trendmicro.com/content/dam/trendmicro/global/en/resear…
rtsafetech.com
Further reading 9
- businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-o…
- trendmicro.com/content/dam/trendmicro/global/en/resear…
- trendmicro.com/en_us/research/23/h/earth-estries-targe…
- x.com/tdatwja/status/1873363875363688459
- trendmicro.com/content/dam/trendmicro/global/en/resear…
- khonggianmang.vn/uploads/1_20241120_CV_APT_EARTHESTRIES_…
- github.com/synacktiv/krustyloader-analysis
- security.com/threat-intelligence/toolshell-china-zin…
- synacktiv.com/publications/krustyloader-rust-malware-…