eu1-zcash.flypool[.]orgDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 7 years ago
What the reports say
1 report, newest first · the exact sentence from each-
50 Shades of Ransomware“…lse > "%TEMP%/pxNXSB.vbs" && start /WAIT wscript.exe "%TEMP%/pxNXSB.vbs" "C:\Users\0136\AppData\Roaming\SOFTWA~1\NHEQMI~1.EXE -l eu1-zcash.flypool[.]org:3333 -u t1L9iBXyRgaYrQ5JSTSdstopV6pHtZ2Xdep.7B9D281C -t 1" && del "%TEMP%\pxNXSB.vbs"”
Indicators reported together
named in the same reports- hxxp://mat.tradetoolsfx[.]comin 1 report
- mat.tradetoolsfx[.]comin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.