exl.officeappsreviews[.]comDomain

Reported by 1 independent source · first reported 27 Feb 2023 by Elastic Security Labs · last reported 27 Feb 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“| exl.officeappsreviews[.]com/lanche-334e58sfj4eeu7h4dd3sss32d | URL | Cobalt Strike C2 server |”

Elastic Security LabsVendor27 Feb 2023
Twice around the dance floor - Elastic discovers the PIPEDANCE backdoor

Indicators reported together

named in the same reports

endpoint.events[.]networkin 1 report
9d3f739e35182992…e63eddc5a1e7in 1 report
805a4250ec1f6b99…7aaf6e1e6ce7in 1 report

Copy these 3 indicators · defanged

3 indicators, defanged, one per line

endpoint.events[.]network
9d3f739e35182992f1e3ade48b8999fb3a5049f48c14db20e38ee63eddc5a1e7
805a4250ec1f6b99f1d5955283c05cd491e1aa378444a782f7bd7aaf6e1e6ce7

Thanks — we review every report.

Report a wrong value