Help RSS API Feed Maltego Contact                        

Domain > ubaoyouxiang.gicp.net

This indicator is referenced in AlienVault OTX pulse ""

Is this malicious?

Most users have voted this as MALICIOUS

Reports

https://otx.alienvault.com/pulse/5554c14cb45ff5570...    
https://securelist.com/analysis/publications/69953...    
https://securelist.com/files/2015/05/TheNaikonAPT-...    

Files that talk to ubaoyouxiang.gicp.net

MD5A/V
d66c93b6a018f5a7a2e79652db2bb305[W32/Backdoor.JTXV-3261] [TR/Crypt.Xpack.112270] [Win32/Sacto.G] [W32/Sakto.AJ!tr.bdr] [Backdoor.Win32.Sakto.aj] [BackDoor-FCBB!D66C93B6A018] [Backdoor.Sakto]
8691e87bbaaf1f6559320e4c7f48a264
d8cdd40f2e196ea2b9f86346b293edcb
f6459dbcc0b23f8e9a3df151f5ef17be
713d951aa3ac8bb4bed69925f742ee68[Win32/Sacto.G] [Backdoor.Win32.Sakto.aj] [BackDoor-FCBB!713D951AA3AC] [Backdoor.Sakto]
5b6218f1f01abc1354f808210753cb89[Exploit.ComObj.CVE-2012-0158.hzuf] [Exploit.OLE2.CVE-2012-1856.a] [Exploit.CVE-2012-0158.J] [Troj/DocDrop-BE] [UnclassifiedMalware] [HEUR_OLEXP.A] [Exploit:Win32/Ratbolo] [DOC/Ratbolo] [NORMAL:Hack.Exploit.CVE-2012-0158.d!1612165] [MSWord/Toolbar.A!exploit]
dc9f59091f98061e0a115075f8406af8[W32/Backdoor.NSOP-9388] [TR/Graftor.95744] [Win32/Sacto.G] [W32/Sacto.G!tr] [Backdoor.Win32.Sakto] [Backdoor.Win32.Sakto.y] [BackDoor-FCBB!DC9F59091F98] [Backdoor.Sakto]
78d0e35adfb6652479a317b40cdb84b9
469ca0c73398903908babcad14300d8d[Trojan]

Whois

PropertyValue
Email ken@oray.com
NameServer NS2.EXHERA.COM
Created 2001-08-15 00:00:00
Changed 2012-03-06 00:00:00
Expires 2019-08-15 00:00:00
Registrar SHANGHAI BEST ORAY I