20.20.100.32
20.20.100.32 is an IP address
that 2 published sources report
in connection with Andariel activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from AhnLab ASEC.
The reports are dated 2024-12-22.
ip address Andariel MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Microsoft Corporation |
| Announced by | AS8075 Microsoft Corporation |
| Country | United States |
| Flags | hosting range |
Sources
-
…공격자는 최초 침투 이후 시스템의 기본적인 정보들을 조회하였으며 Advanced Port Scanner가 설치된 이력도 존재한다. > ping 20.20.100.32 > tasklist > ipconfig /all > netstat -noa > whoami 이후에는 다음과 같은 파워쉘 명령으로 웹쉘을 설치하는 것으로 추정된다.…
Andariel 그룹의 국내 솔루션 대상 공격 사례 분석 (SmallTiger) - ASEC — AhnLab ASEC -
…the threat actor queried basic system information, and there is also a record of Advanced Port Scanner being installed. > ping 20.20.100.32 > tasklist > ipconfig /all > netstat -noa > whoami It is presumed that subsequently, a web shell is installed using the following…
Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger) - ASEC — AhnLab ASEC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.