code[.]appDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
New North Korean campaign uses fake coding interviews to steal developer credentials“…rogram\x20Files", "Program Files (x86)", "ProgramData", "All Users", "All User", "Windows", "Microsoft", "$RECYCLE.BIN", "Visual Studio Code[.]app",”
-
Initial research exposing JOKERSPY“/Applications/Visual Studio Code[.]app/Contents/MacOS/Electron.”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- ldb.rightwidth[.]devin 1 report
- upload.rightwidth[.]devin 1 report
- controller.rightwidth[.]devin 1 report
- file.rightwidth[.]devin 1 report
- rightwidth[.]devin 1 report
- 8e571d58794b9b44…63adcba55b1ein 1 report
- 3e6360f83a95540a…6b5bcf3b9c3cin 1 report
- 4e7639045b4a64de…42ed27f09864in 1 report
- 54bf36910d81ab51…c1fc738dc5a9in 1 report
- 96357529d17c4690…898f0635ef20in 1 report
- 9df01d242ef46adf…84090d579886in 1 report
- c5aed4c063d4970a…0ad72567ebd9in 1 report
- cc97517f80f56797…c99fe9e45730in 1 report
- fb94b2caee2c4063…8fa42351f53fin 1 report
- 195.26.248[.]212in 1 report
- 188.40.64[.]61in 1 report
- d895075057e491b3…c5c9bd3487d8in 1 report
- 55554944f74096a8…d97d1dff5cd4in 1 report
- idea[.]appin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.