campanha1-api.ef971a42.workers[.]devDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook“After persistence is established, the agent sends a first-run POST beacon to hxxps://campanha1-api.ef971a42.workers[.]dev/api/installs with the agentId (MachineName-UserName), MachineName, UserName (redundant), and the OS version.”
Indicators reported together
named in the same reports- worker[.]devin 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/installsin 1 report
- mxtestacionamentos[.]comin 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/campaignin 1 report
- hxxps://arquivos-omie[.]comin 1 report
- arquivos-omie[.]comin 1 report
- hxxps://documents.ef971a42.workers[.]dev/filein 1 report
- documents.ef971a42.workers[.]devin 1 report
- 91fafaa1240676af…e3798797c408in 1 report
- documentos-online[.]comin 1 report
- afonsoferragista[.]comin 1 report
- doccompartilhe[.]comin 1 report
- recebamais[.]comin 1 report
- 191.96.224[.]96in 1 report
- saogeraldoshiping[.]comin 1 report
- 701d51b7be8b034c…46964995b626in 1 report
- 8a174aa70a439654…085eeb537059in 1 report
- 668f932433a24bba…7c9152342f40in 1 report
- 63beb7372098c03b…9bed2d900394in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.