Current Trojan Ambler Activity
ID: 46a35895-a921-5686-9b48-252ea59a9cf7
STIX ID: report--46a35895-a921-5686-9b48-252ea59a9cf7
Feed Name: Zscaler Security Research Blog
Threat Score
This report documents analysis of a low-volume, intermittent beaconing campaign attributed to an Ambler/Amber Trojan and related IRC bot activity. The author registered and monitored a .net sinkhole, observed about a dozen unique infected Australian hosts, identified beacon URL patterns (/newuser.php and /comm.php?userid=DDMMYYYY_HHMMSS), provided a low-detection MD5 and VirusTotal link, and enumerated numerous suspected C2 domains and related infrastructure.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.