calculator[.]appDomain
Reported by 1 independent source · first reported by Datadog Security Labs · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)“"preinstall": "open /System/Applications/Calculator[.]app && id > /tmp/opencode-rce"”
Indicators reported together
named in the same reports- hxxp://127.0.0[.]1:4096/in 1 report
- hxxp://127.0.0[.]1:4096/global/upgradein 1 report
- httpapibuilder[.]groupin 1 report
- effect[.]mapin 1 report
- hxxp://165.227.82[.]252:4444in 1 report
- 165.227.82[.]252in 1 report
- hxxp://165.227.82[.]252:4444/in 1 report
- hxxp://165.227.82[.]252/opencode-malicious.tgzin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.