cobaltstrikepro[.]storeDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Ace in the Hole: exposing GambleForce, an SQL injection gang“keytool -keystore CobaltStrikepro[.]store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias windows.updates.wiki -dname "CN=Microsec e-Szigno Root CA, OU=e-Szigno CA, O=Microsec Ltd., L=Budapest, S=HU, C=HU"”
Indicators reported together
named in the same reports- 212.60.5[.]129in 1 report
- hxxp://38.54.40[.]156:8888/supershell/compile/download/linuxamdx64in 1 report
- 38.54.40[.]156in 1 report
- dns-supports[.]onlinein 1 report
- windows.updates[.]wikiin 1 report
- cs[.]storein 1 report
- www.dns-supports[.]onlinein 1 report
- 37.128.246[.]50in 1 report
- 38.60.220[.]230in 1 report
- 130.162.156[.]51in 1 report
- 172.104.113[.]179in 1 report
- 123.118.226[.]80in 1 report
- 172.104.51[.]37in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2023-23752
Thanks — we review every report.