cloud-server-updater1.co[.]zaDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
The footprints of Raccoon“In turn, Raccoon makes a network connection to hxxp://cloud-server-updater1.co[.]za/doc/officeupdate.exe and downloads RAT AveMaria (SHA1: a10925364347bde843a1d4105dddf4a4eb88c746), with the C&C server located at the IP address 102.130.118.152.”
Indicators reported together
named in the same reports- co[.]zain 1 report
- documents-cloud-server.co[.]zain 1 report
- b1799345152f0f11…a1867d64e119in 1 report
- hxxp://cloudupdate.co[.]za/documents/msofficeupdate.exein 1 report
- cloudupdate.co[.]zain 1 report
- f3498ba783b9c8c8…d2ff189615d9in 1 report
- badlandsparks[.]comin 1 report
- 185.244.149[.]100in 1 report
- 13b7afe8ee87977a…ca7efd62b9b6in 1 report
- 596a3cb4d82e6ab4…14b0f7bd14afin 1 report
- gineuter[.]infoin 1 report
- fastandprettycleaner[.]hkin 1 report
- c2f8d217877b1a28…5212f8dc2335in 1 report
- hxxp://download-plugin.co[.]za/documents/msofficeupdate.exein 1 report
- download-plugin.co[.]zain 1 report
- 430a406f2134b489…da11a172a7e1in 1 report
- hxxp://msupdater.co[.]za/documents/msofficeupdate.exein 1 report
- msupdater.co[.]zain 1 report
- 160.119.253[.]53in 1 report
- hxxp://www.documents-cloud-server.co[.]za/file_d/adobe-reader-update-10.21.01.exein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.