← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Analysis of Nood RAT Used in Attacks Against Linux (Gh0st RAT&'s Variant) - ASEC BLOG
WHITE CyberHunter_NL 2024-02-26 Modified: 2024-03-27
50
IOCs
MEDIUM VOLUME
Nood RAT is a variant of the Gh0st remote control malware developed by the C. Rufus Security Team of China, which has been used in a number of vulnerability attacks.
nood ratgh0st ratlinuxc serverkey typerc4 algorithmrc4 keyasecnoodmssqlcloud snooperkoreanrockepathformatdategh0stoverview gh0stlinux nood
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Overview Gh0st Cloud Snooper Linux Nood Nood RAT Linux Gh0st Nood
Indicators of Compromise (50)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2017-10271 — 2024-02-26
FileHash-MD5 035f83018cf96f5e1f6817ccd39fc0b6 — 2024-02-26
FileHash-MD5 0a35e06f53c17ab1c8e18e7e0c0821d8 — 2024-02-26
FileHash-MD5 35743db3dc333245ef5b69100721ced9 — 2024-02-26
FileHash-MD5 4f3afdcfff8f7994b7d3d3fbaa6858b4 — 2024-02-26
FileHash-MD5 75838e5d481da40db2e235a6d5a222ef — 2024-02-26
FileHash-MD5 7d631e5b0c78805dd5d440cce788d25b — 2024-02-26
FileHash-MD5 8457f71c6a5fe83bb513d1dfba99271a — 2024-02-26
FileHash-MD5 905c2158fadfe31850766f010e149a0f — 2024-02-26
FileHash-MD5 97db3f7676380f0baa3840ed5d5c1767 — 2024-02-26
FileHash-MD5 a15ebd19cac42b0297858018da62b1be — 2024-02-26
FileHash-MD5 b4910e998cf58da452f8151b71c868cb — 2024-02-26
FileHash-MD5 c440bd814be37fac669567131c4ba996 — 2024-02-26
FileHash-MD5 d9f00f71efabdfcca7c63d4b0805673c — 2024-02-26
FileHash-SHA1 14fd16e6465b74c5ac4dc895f4c15bccb447af31 SHA1 of 0a35e06f53c17ab1c8e18e7e0c0821d8 2024-02-26
FileHash-SHA1 1afd03b91e73db0de7685af473530503bc9257ff SHA1 of b4910e998cf58da452f8151b71c868cb 2024-02-26
FileHash-SHA1 49c4aa2812535884bd9d3a564e7656dec150933a SHA1 of d9f00f71efabdfcca7c63d4b0805673c 2024-02-26
FileHash-SHA1 4d4bc836641840ad8b0873b07d31ce38732c4a28 SHA1 of 905c2158fadfe31850766f010e149a0f 2024-02-26
FileHash-SHA1 4fe8efef8c2e7cc3bafee19da8b223daae2242a1 SHA1 of 97db3f7676380f0baa3840ed5d5c1767 2024-02-26
FileHash-SHA1 71449bdde94afd1fe10ad68743ceba67f0975f84 SHA1 of 75838e5d481da40db2e235a6d5a222ef 2024-02-26
FileHash-SHA1 fa681933eccc1b3cae4cce6ab6f16db08c2f2a87 SHA1 of 35743db3dc333245ef5b69100721ced9 2024-02-26
FileHash-SHA256 275d63587f3ac511d7cca5ff85af2914e74d8b68edd5a7a8a1609426d5b7f6a9 SHA256 of 0a35e06f53c17ab1c8e18e7e0c0821d8 2024-02-26
FileHash-SHA256 3bff2c5bfc24fc99d925126ec6beb95d395a85bc736a395aaf4719c301cbbfd4 SHA256 of 35743db3dc333245ef5b69100721ced9 2024-02-26
FileHash-SHA256 7440a7b56d3670d4204a57974fa76ae76ca78168bb181640f565976d192cc159 SHA256 of 905c2158fadfe31850766f010e149a0f 2024-02-26
FileHash-SHA256 870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887 SHA256 of d9f00f71efabdfcca7c63d4b0805673c 2024-02-26
FileHash-SHA256 8ec87dee13de3281d55f7d1d3b48115a0f5e4a41bfbef1ea08e496ac529829c8 SHA256 of 97db3f7676380f0baa3840ed5d5c1767 2024-02-26
FileHash-SHA256 bf1b88385aebb37182421e967749f057fbefb4e4386bb47b5098abac7c70c476 SHA256 of b4910e998cf58da452f8151b71c868cb 2024-02-26
FileHash-SHA256 c830a233f716416e3754e46aa70e049d10989a48028f3879d425c3851c4dd761 SHA256 of 75838e5d481da40db2e235a6d5a222ef 2024-02-26
URL http://1.117.165.141:53 — 2024-02-26
URL http://101.42.139.110:53 — 2024-02-26
URL http://101.42.139.110:8443 — 2024-02-26
URL http://194.36.191.75:443 — 2024-02-26
URL http://42.51.40.184:56 — 2024-02-26
URL http://43.140.251.218:8080 — 2024-02-26
URL http://43.156.118.72:443 — 2024-02-26
URL http://81.68.143.132:1234 — 2024-02-26
URL http://81.68.143.132:8080 — 2024-02-26
URL http://b.niupilao.vip:80 — 2024-02-26
URL http://bo.appleupcheck.com:443 — 2024-02-26
URL http://check.snapupdate.org:80 — 2024-02-26
URL http://cloud.awsxtd.com:443 — 2024-02-26
URL http://update.kworker.net:443 — 2024-02-26
domain issue.net — 2024-02-26
hostname b.niupilao.vip — 2024-02-26
hostname bo.appleupcheck.com — 2024-02-26
hostname check.snapupdate.org — 2024-02-26
hostname cloud.awsxtd.com — 2024-02-26
hostname update.kworker.net — 2024-02-26
URL http://13.214.222.35:443 — 2024-02-26
URL http://23.100.88.61:53 — 2024-02-26
References (1)
↗ https://asec.ahnlab.com/en/62144/