Overview 94 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| domain | 93 | XDSPY-domain.txt |
| url_path | 1 | XDSPY.json |
Principal sources 21 reports
Ranked by how many of this actor's indicators each report brought in.
- 62harfanglab.io/insidethelab/sadfuture-xdspy-latest-evo…
- 62virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c…
- 62virustotal.com/gui/file/050018ecd9792776ef435c79469507…
- 23zdnet.com/article/eset-discovers-a-rare-apt-that-…
- 23welivesecurity.com/2020/10/02/xdspy-stealing-government-se…
- 23github.com/eset/malware-ioc/tree/master/xdspy
- 23vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf
- 23otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c
Timeline 94 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
harfanglab.io/insidethelab/sadfuture-xdspy-latest-evo… · virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c… · virustotal.com/gui/file/050018ecd9792776ef435c79469507…
domain aoc-upravleniye.com domain bukhgalter-x5group.com domain bystryvelosiped.com domain cellporyad.com domain chistyyvozdukh.com domain doverennyye-fayly.com domain downloading24.com domain dversteklo.com domain dwd765m.com domain easy-download24.com domain faylbox365.com domain faylsklad.com domain file-magazin.com domain full-downloader.com domain khitrayalisitsa.com domain khoroshayamych.com domain kletchatayarubashka.com domain krasnayastena.com domain laultrachunk.com domain magnitgroup.com domain melodicprogress.com domain moy-fayl.com domain moy-pdf.com domain nevynosimayapchela.com domain nniir.com domain obmen-faylami.com domain otpravkafaylov.com domain pdf-bazaar.com domain pdf-reyestr.com domain pdf-sklad.com domain pdfdepozit.com domain pdfmagazin.com domain pdfsklad.com domain pechalnoyebudushcheye.com domain promenimath.com domain protej.org.nniir.com domain quan-miami.com domain reyestr-faylov.com domain ru-pochta365.com domain ru-sistema.com domain serayagrust.com domain seychaspozzhe.com domain skachivanie-failov.com domain skachivanie-failov24.com domain slomannyymonitor.com domain sogrevayushchiynapitok.com domain svobodnoepredlozheniye.com domain temnayamashina.com domain tvoi-fayly.com domain tvoy-disk.com domain utrenneyesolntse.com domain vash-disk.com domain vashazagruzka365.com domain zagruzka-pdf.com domain zagruzkadannykh.com domain zagruzkafayla.com domain zelenyysalat.com domain zetta-strakhovaniye.com domain zhestovyyliker.com domain zimniyeravlecheniya.com url_path /wevjhnyh/ -
x.com/malwrhunterteam/status/1900654391742316… · virustotal.com/gui/ip-address/216.252.233.7/relations · virustotal.com/gui/file/59b907430dde62fc7a0d1c33c38081… · virustotal.com/gui/file/745d7ff35fa716b105e85d492deff0… · virustotal.com/gui/file/796b057a6d2b6e8e7ef7b9a81b2203…
fakturaaa.com file-bazar.com trxpay.cc -
harfanglab.io/insidethelab/sadfuture-xdspy-latest-evo… · virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c… · virustotal.com/gui/file/050018ecd9792776ef435c79469507…
vashi-fayly.com -
x.com/malwrhunterteam/status/1816855989859106… · x.com/t3ft3lb/status/1817943106181861704 · virustotal.com/gui/file/a08029b0a01228a2a4904da723862d…
sbordokumentov.com -
twitter.com/t3ft3lb/status/1640373954018770945 · virustotal.com/gui/file/60f2a6de283d37aba090db3be84a2d…
just-downloads.com -
twitter.com/t3ft3lb/status/1578448091476131841 · virustotal.com/gui/file/6d975d2b3557bc3eebc8b24fdafca6…
best-downloader.com download24center.com global-downloader.com my1businessconnection.com -
zdnet.com/article/eset-discovers-a-rare-apt-that-… · welivesecurity.com/2020/10/02/xdspy-stealing-government-se… · github.com/eset/malware-ioc/tree/master/xdspy · vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf · otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c · cert.by/?p=1458 (Russian)
365downloading.com boborux.com chtcc.net cracratutu.com daftsync.com documentsklad.com download-365.com dropsklad.com easytosay.org ferrariframework.com file-download.org getthatupdate.com jerseygameengine.com maiwegwurst.com migration-info.com minisnowhair.com nomatterwhat.info officeupdtcentr.com seatwowave.com -
zdnet.com/article/eset-discovers-a-rare-apt-that-… · welivesecurity.com/2020/10/02/xdspy-stealing-government-se… · github.com/eset/malware-ioc/tree/master/xdspy · vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf · otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c · cert.by/?p=1458 (Russian)
downloadsprimary.com filedownload.email theslideshare.com wildboarcontest.com
Further reading 21
- welivesecurity.com/2020/10/02/xdspy-stealing-government-se…
- virustotal.com/gui/ip-address/216.252.233.7/relations
- virustotal.com/gui/file/050018ecd9792776ef435c79469507…
- virustotal.com/gui/file/796b057a6d2b6e8e7ef7b9a81b2203…
- cert.by/?p=1458 (Russian)
- virustotal.com/gui/file/745d7ff35fa716b105e85d492deff0…
- zdnet.com/article/eset-discovers-a-rare-apt-that-…
- x.com/malwrhunterteam/status/1816855989859106…
- twitter.com/t3ft3lb/status/1640373954018770945
- virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c…
- x.com/malwrhunterteam/status/1900654391742316…
- twitter.com/t3ft3lb/status/1578448091476131841
- x.com/t3ft3lb/status/1817943106181861704
- virustotal.com/gui/file/6d975d2b3557bc3eebc8b24fdafca6…
- virustotal.com/gui/file/60f2a6de283d37aba090db3be84a2d…
- otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c
- vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf
- github.com/eset/malware-ioc/tree/master/xdspy
- virustotal.com/gui/file/59b907430dde62fc7a0d1c33c38081…
- harfanglab.io/insidethelab/sadfuture-xdspy-latest-evo…
- virustotal.com/gui/file/a08029b0a01228a2a4904da723862d…