Trusted Design

Hunting Mr. Black IDs via Zegost cracking

概要

Malware is served under domain f3322.org which is having a super bad reputation in being used by Mr.Black ELF attacks and many more ELF attacks.The PE is a Win32/Zegost variant, the dropper/backdoor type. It drops, self deleted, auto-start set in registry, starting service. So it looks like that their services is used by the malware activities. It means the actor can be traced via contacting the f3322.org abuse accordingly. We're on it for we have long list of malicious subdomains used now.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• B8d96178 malware on Metadefender.com (score: 0.59)
• New POS Malware Emerges - Punkey (score: 0.58)
• The Curious Case of an Unknown Trojan Targeting German-Speaking Users (score: 0.57)
• FBI CYWATCH A-000067-DM (score: 0.57)
• The HookAds Malvertising Campaign (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る