file.rightwidth[.]devDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
New North Korean campaign uses fake coding interviews to steal developer credentials“The dropper component is Windows-only and downloads three second-stage binaries via curl from file.rightwidth[.]dev, each disguised as a .txt file, then renamed to .exe before execution.”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- ldb.rightwidth[.]devin 1 report
- upload.rightwidth[.]devin 1 report
- code[.]appin 1 report
- controller.rightwidth[.]devin 1 report
- rightwidth[.]devin 1 report
- 8e571d58794b9b44…63adcba55b1ein 1 report
- 3e6360f83a95540a…6b5bcf3b9c3cin 1 report
- 4e7639045b4a64de…42ed27f09864in 1 report
- 54bf36910d81ab51…c1fc738dc5a9in 1 report
- 96357529d17c4690…898f0635ef20in 1 report
- 9df01d242ef46adf…84090d579886in 1 report
- c5aed4c063d4970a…0ad72567ebd9in 1 report
- cc97517f80f56797…c99fe9e45730in 1 report
- fb94b2caee2c4063…8fa42351f53fin 1 report
- 195.26.248[.]212in 1 report
- 188.40.64[.]61in 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.