{
  "aliases": [
    "byeby",
    "microcin",
    "mikroceen",
    "vicious panda"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 55,
    "ipv4": 2,
    "url": 1,
    "url_path": 2
  },
  "first_seen": {
    "domain": {
      "612bb.sheetsbrandnewday.com": "2020-05-15",
      "9hnvb8917gzr.com": "2020-05-15",
      "adyboh.com": "2022-01-01",
      "ans.moutw.com": "2020-05-15",
      "apjgtipty.com": "2022-01-01",
      "app.obokay.com": "2020-05-15",
      "apps.uzdarakchi.com": "2020-06-23",
      "bestrongerlouder.com": "2022-01-01",
      "bmy.hqoohoa.com": "2020-03-12",
      "bur.vueleslie.com": "2020-03-12",
      "bzz.utakatarefrain.com": "2020-05-15",
      "cloud.googleupdating.net": "2024-02-22",
      "cloud.msseces.com": "2024-02-22",
      "cloud.systemupdating.com": "2024-02-22",
      "clouds.googleupdating.net": "2024-02-22",
      "clouds.osppsvc.com": "2024-02-22",
      "compdate.my03.com": "2020-03-12",
      "credibusco.com": "2022-03-29",
      "dnsrequery.com": "2024-02-22",
      "dw.adyboh.com": "2020-03-12",
      "esvnpe.com": "2022-01-01",
      "feb.kkooppt.com": "2020-03-12",
      "forum.mediaok.info": "2020-06-23",
      "forum.uzdarakchi.com": "2020-06-23",
      "future-hope2011.com": "2020-05-15",
      "googleupdating.net": "2024-02-22",
      "heroisshit.com": "2020-06-23",
      "hqoohoa.com": "2022-01-01",
      "jocoly.esvnpe.com": "2020-03-12",
      "kkooppt.com": "2022-01-01",
      "kliju.wulinon.com": "2020-05-15",
      "log.bestrongerlouder.com": "2020-05-15",
      "mediaok.info": "2020-06-23",
      "moutw.com": "2022-01-01",
      "msdtcupdate.com": "2020-03-30",
      "nan.thanhale.com": "2020-05-15",
      "ns.dnsrequery.com": "2024-02-22",
      "obokay.com": "2020-06-23",
      "offcialwrittencomplaint.com": "2020-05-15",
      "owa.obokay.com": "2020-06-23",
      "parked.wulinon.com": "2022-01-01",
      "qrot.apjgtipty.com": "2020-05-15",
      "runtime.heroisshit.com": "2020-05-15",
      "sheetsbrandnewday.com": "2022-01-01",
      "systemupdating.com": "2024-02-22",
      "thanhale.com": "2022-01-01",
      "update.heroisshit.com": "2020-05-15",
      "utakatarefrain.com": "2022-01-01",
      "uzdarakchi.com": "2020-06-23",
      "vueleslie.com": "2022-01-01",
      "wind.windmilldrops.com": "2020-03-12",
      "windmilldrops.com": "2022-01-01",
      "wulinon.com": "2022-01-01",
      "wy.adyboh.com": "2020-03-12",
      "yuemt.zzux.com": "2020-05-15"
    },
    "ipv4": {
      "58.64.209.84:1080": "2024-02-22",
      "58.64.209.84:443": "2024-02-22"
    },
    "url": {
      "http://58.64.209.84": "2024-02-22"
    },
    "url_path": {
      "/credibus/aids/designUnmarriedCooker": "2022-03-29",
      "/designUnmarriedCooker": "2022-03-29"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2020-03-12",
    "latest": "2024-02-22"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "612bb.sheetsbrandnewday.com",
      "9hnvb8917gzr.com",
      "adyboh.com",
      "ans.moutw.com",
      "apjgtipty.com",
      "app.obokay.com",
      "apps.uzdarakchi.com",
      "bestrongerlouder.com",
      "bmy.hqoohoa.com",
      "bur.vueleslie.com",
      "bzz.utakatarefrain.com",
      "cloud.googleupdating.net",
      "cloud.msseces.com",
      "cloud.systemupdating.com",
      "clouds.googleupdating.net",
      "clouds.osppsvc.com",
      "compdate.my03.com",
      "credibusco.com",
      "dnsrequery.com",
      "dw.adyboh.com",
      "esvnpe.com",
      "feb.kkooppt.com",
      "forum.mediaok.info",
      "forum.uzdarakchi.com",
      "future-hope2011.com",
      "googleupdating.net",
      "heroisshit.com",
      "hqoohoa.com",
      "jocoly.esvnpe.com",
      "kkooppt.com",
      "kliju.wulinon.com",
      "log.bestrongerlouder.com",
      "mediaok.info",
      "moutw.com",
      "msdtcupdate.com",
      "nan.thanhale.com",
      "ns.dnsrequery.com",
      "obokay.com",
      "offcialwrittencomplaint.com",
      "owa.obokay.com",
      "parked.wulinon.com",
      "qrot.apjgtipty.com",
      "runtime.heroisshit.com",
      "sheetsbrandnewday.com",
      "systemupdating.com",
      "thanhale.com",
      "update.heroisshit.com",
      "utakatarefrain.com",
      "uzdarakchi.com",
      "vueleslie.com",
      "wind.windmilldrops.com",
      "windmilldrops.com",
      "wulinon.com",
      "wy.adyboh.com",
      "yuemt.zzux.com"
    ],
    "ipv4": [
      "58.64.209.84:1080",
      "58.64.209.84:443"
    ],
    "url": [
      "http://58.64.209.84"
    ],
    "url_path": [
      "/credibus/aids/designUnmarriedCooker",
      "/designUnmarriedCooker"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "VICIOUSPANDA"
  ],
  "references": [
    "https://app.any.run/tasks/38c37dfa-b070-4b28-b475-a09763f00d8c/",
    "https://github.com/avast/ioc/tree/master/Microcin",
    "https://github.com/eset/malware-ioc/tree/master/mikroceen/",
    "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT-C-23_MICROPSIA_Variant.json",
    "https://otx.alienvault.com/pulse/5ef2300c6b8792647750e3bf",
    "https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/",
    "https://securelist.com/microcin-is-here/97353/",
    "https://twitter.com/Sebdraven/status/1244532660690718722",
    "https://twitter.com/dewan202/status/1244595728175030272",
    "https://twitter.com/malwrhunterteam/status/1507747753824333826",
    "https://twitter.com/malwrhunterteam/status/1508497950254764033",
    "https://twitter.com/ni_fi_70/status/1508725950829277184",
    "https://www.virustotal.com/gui/file/3ada06dfaa959fce18cd7eb3eb9e967f4645060495355cf0fb3af70469d1a55a/detection",
    "https://www.virustotal.com/gui/file/5e79390f5268043f4dc6aec0206249014038ee8acd001b8a35e141f8fdbce002/detection",
    "https://www.virustotal.com/gui/file/b8841879796c1139202764daf2224c61d7442625e07c9c923b66f2b31bef2226/detection",
    "https://www.virustotal.com/gui/ip-address/58.64.209.84/relations",
    "https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G0081"
    }
  ],
  "slug": "VICIOUSPANDA",
  "timeline": [
    {
      "counts": {
        "domain": 9,
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2024-02-22",
      "indicators": {
        "domain": [
          "cloud.googleupdating.net",
          "cloud.msseces.com",
          "cloud.systemupdating.com",
          "clouds.googleupdating.net",
          "clouds.osppsvc.com",
          "dnsrequery.com",
          "googleupdating.net",
          "ns.dnsrequery.com",
          "systemupdating.com"
        ],
        "ipv4": [
          "58.64.209.84:1080",
          "58.64.209.84:443"
        ],
        "url": [
          "http://58.64.209.84"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/dewan202/status/1244595728175030272",
        "https://www.virustotal.com/gui/ip-address/58.64.209.84/relations",
        "https://www.virustotal.com/gui/file/3ada06dfaa959fce18cd7eb3eb9e967f4645060495355cf0fb3af70469d1a55a/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 2
      },
      "first_seen": "2022-03-29",
      "indicators": {
        "domain": [
          "credibusco.com"
        ],
        "url_path": [
          "/credibus/aids/designUnmarriedCooker",
          "/designUnmarriedCooker"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1507747753824333826",
        "https://twitter.com/malwrhunterteam/status/1508497950254764033",
        "https://twitter.com/ni_fi_70/status/1508725950829277184",
        "https://www.virustotal.com/gui/file/5e79390f5268043f4dc6aec0206249014038ee8acd001b8a35e141f8fdbce002/detection",
        "https://www.virustotal.com/gui/file/b8841879796c1139202764daf2224c61d7442625e07c9c923b66f2b31bef2226/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2022-01-01",
      "indicators": {
        "domain": [
          "apjgtipty.com",
          "bestrongerlouder.com",
          "moutw.com",
          "parked.wulinon.com",
          "sheetsbrandnewday.com",
          "thanhale.com",
          "utakatarefrain.com",
          "wulinon.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/",
        "https://github.com/avast/ioc/tree/master/Microcin",
        "https://github.com/eset/malware-ioc/tree/master/mikroceen/",
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT-C-23_MICROPSIA_Variant.json"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-01-01",
      "indicators": {
        "domain": [
          "adyboh.com",
          "esvnpe.com",
          "hqoohoa.com",
          "kkooppt.com",
          "vueleslie.com",
          "windmilldrops.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2020-06-23",
      "indicators": {
        "domain": [
          "apps.uzdarakchi.com",
          "forum.mediaok.info",
          "forum.uzdarakchi.com",
          "mediaok.info",
          "owa.obokay.com",
          "uzdarakchi.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/microcin-is-here/97353/",
        "https://otx.alienvault.com/pulse/5ef2300c6b8792647750e3bf"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-23",
      "indicators": {
        "domain": [
          "obokay.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/",
        "https://github.com/avast/ioc/tree/master/Microcin",
        "https://github.com/eset/malware-ioc/tree/master/mikroceen/",
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT-C-23_MICROPSIA_Variant.json",
        "https://securelist.com/microcin-is-here/97353/",
        "https://otx.alienvault.com/pulse/5ef2300c6b8792647750e3bf"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-23",
      "indicators": {
        "domain": [
          "heroisshit.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/",
        "https://github.com/avast/ioc/tree/master/Microcin",
        "https://github.com/eset/malware-ioc/tree/master/mikroceen/",
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT-C-23_MICROPSIA_Variant.json"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2020-05-15",
      "indicators": {
        "domain": [
          "612bb.sheetsbrandnewday.com",
          "9hnvb8917gzr.com",
          "ans.moutw.com",
          "app.obokay.com",
          "bzz.utakatarefrain.com",
          "future-hope2011.com",
          "kliju.wulinon.com",
          "log.bestrongerlouder.com",
          "nan.thanhale.com",
          "offcialwrittencomplaint.com",
          "qrot.apjgtipty.com",
          "runtime.heroisshit.com",
          "update.heroisshit.com",
          "yuemt.zzux.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/",
        "https://github.com/avast/ioc/tree/master/Microcin",
        "https://github.com/eset/malware-ioc/tree/master/mikroceen/",
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_APT-C-23_MICROPSIA_Variant.json"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-03-30",
      "indicators": {
        "domain": [
          "msdtcupdate.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Sebdraven/status/1244532660690718722",
        "https://app.any.run/tasks/38c37dfa-b070-4b28-b475-a09763f00d8c/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2020-03-12",
      "indicators": {
        "domain": [
          "bmy.hqoohoa.com",
          "bur.vueleslie.com",
          "compdate.my03.com",
          "dw.adyboh.com",
          "feb.kkooppt.com",
          "jocoly.esvnpe.com",
          "wind.windmilldrops.com",
          "wy.adyboh.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/"
      ],
      "total": 8
    }
  ]
}