ferncore13[.]comDomain
Reported by 1 independent source · first reported by Palo Alto Unit 42 · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Atomic macOS (AMOS) Stealer Activity“The command in Figure 2 retrieved a Z-shell (Zsh) script from hxxps://ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688.”
Indicators reported together
named in the same reports- hxxps://ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688in 1 report
- 161.35.146[.]120in 1 report
- 188.166.78[.]138in 1 report
- 71781ad8adefb499…5c76d8cde88cin 1 report
- 7ea6ff8b12c59aaa…154d40d7ca3ain 1 report
- a598fcdcd4924731…d276668fa2a9in 1 report
- 6bfcdb4920383375…b82478012620in 1 report
- 4504006d1911057b…deba6cf667b9in 1 report
- hxxps://getmacouscloud[.]comin 1 report
- getmacouscloud[.]comin 1 report
- hxxps://grove-89[.]com/api/metrics/run?event=pastedin 1 report
- grove-89[.]comin 1 report
- hxxps://ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/updatein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.