chat.ririmochii.workers[.]devDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 56 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers“Once loaded, the trojanized jQuery file injected a secondary browser agent from hxxps://chat.ririmochii.workers[.]dev/core.js, establishing encrypted WebRTC and WebSocket channels back to the following attacker-controlled C2 infrastructure to push dynamic eval() frames and harvest…”
Indicators reported together
named in the same reports- redacted[.]comin 1 report
- secure.redacted[.]comin 1 report
- hxxps://chat.ririmochii.workers[.]dev/core.jsin 1 report
- hxxps://fk.bubuneeko.workers[.]dev/_cf/relin 1 report
- fk.bubuneeko.workers[.]devin 1 report
- hxxps://fk.bubuneeko.workers[.]dev/_cf/icein 1 report
- 0d8f7bf30aa1ac95…c841c6e861d3in 1 report
- 5f69ff7a2e024f94…dfdd4472905ein 1 report
- e9dee286069afb6b…ef1a7e0e3879in 1 report
- 0d93c3a8ded46887…2e34f238d19ain 1 report
- b06b581d91f41089…1bd670867485in 1 report
- 7bb594a77f726bf2…9301de1f1ab4in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.