bluetechsupply[.]comDomain

Reported by 2 independent sources · first reported 8 Sep 2022 by Elastic Security Labs · last reported 8 Sep 2022

Last reported 4 years agoFeeds last saw it 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“When analyzing the process data that we extracted from memory we can see that dhl.jpg (from mvnetworking.com) and temp.png (from bluetechsupply[.]com) are being used for command and control.”

Elastic Security LabsVendor8 Sep 2022C2
CUBA Ransomware Campaign Analysis

Seen in threat feeds

1 feed

Feed	First seen	Last seen	Sightings	What the feed says
abuse.ch ThreatFox	30 Dec 2022	30 Dec 2022	1	botnet_cc · Cobalt Strike · CobaltStrike · threatview-io

Indicators reported together

named in the same reports

0f385cc69a93abea…805bdfe468a3in 1 report
33352a38454cfc24…8ec45b4d3d0ein 1 report
b495456a2239f3ba…a48746e8051fin 1 report
159.203.70[.]39in 1 report
hxxp://208.76.253[.]84in 1 report
208.76.253[.]84in 1 report
hxxp://108.170.31[.]115/add.dllin 1 report
108.170.31[.]115in 1 report
104.217.8[.]100in 1 report
193.23.244[.]244in 1 report
86.59.21[.]38in 1 report
199.58.81[.]140in 1 report
204.13.164[.]118in 1 report
194.109.206[.]212in 1 report
131.188.40[.]189in 1 report
154.35.175[.]225in 1 report
171.25.193[.]9in 1 report
128.31.0[.]34in 1 report
128.31.0[.]39in 1 report
scams[.]inin 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

0f385cc69a93abeaf84994e7887cb173e889d309a515b55b2205805bdfe468a3
33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e
b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f
159.203.70[.]39
hxxp://208.76.253[.]84
208.76.253[.]84
hxxp://108.170.31[.]115/add.dll
108.170.31[.]115
104.217.8[.]100
193.23.244[.]244
86.59.21[.]38
199.58.81[.]140
204.13.164[.]118
194.109.206[.]212
131.188.40[.]189
154.35.175[.]225
171.25.193[.]9
128.31.0[.]34
128.31.0[.]39
scams[.]in

Thanks — we review every report.

Report a wrong value