billielishhui.blogspot[.]comDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Attack chain leads to XWORM and AGENTTESLA“… following CLSID {F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} which corresponds to Shell Object, then downloads from the URL hxxps://billielishhui.blogspot[.]com/atom.xml the update powershell malware.”
Indicators reported together
named in the same reports- hxxps://www.mediafire[.]com/file/xnqxmqlcj51501d/7000m.txt/filein 1 report
- hxxps://billielishhui.blogspot[.]com/atom.xmlin 1 report
- hxxps://discord[.]com/api/webhooks/1089956337733087274/uYNA_D8Ns1z9NZ3B1mGp0XXyGq-785KLGIfEAZsrz3TJd5fvOjXA927F7bUTTzbNT6Zkin 1 report
- afbef8e590105e16…a3af761ad2f0in 1 report
- bf5ea8d5fd573abb…f9c5c3baeaa2in 1 report
- cbbb56fe6cd7277a…e3a883b6f8bcin 1 report
- 65463161760af7ab…3bdd203f85f4in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.