files[.]cabDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer“EXPAND.EXE -R files[.]cab drops the components into %AppData%\ComponentsFolder\, and the installer executes prnfig.wsf.”
Indicators reported together
named in the same reports- hxxps://readonline365[.]com/view/image.pngin 1 report
- readonline365[.]comin 1 report
- hxxps://onlineview365[.]com/propi.msiin 1 report
- onlineview365[.]comin 1 report
- 54ed18aa883b5379…47dc81dd5b76in 1 report
- thatawful[.]boutiquein 1 report
- 67.43.50[.]11in 1 report
- effectivecpmnetwork[.]comin 1 report
- megchartedbk7[.]comin 1 report
- storageonline[.]mein 1 report
- viewdocument[.]livein 1 report
- advancedfuturetechnology[.]comin 1 report
- sharedfuturetech[.]comin 1 report
- 394c93dfbb7581c6…0ee3fe693c04in 1 report
- 9fb5888f9ac99227…0d7a5aac847fin 1 report
- 1c923c685f97e556…4c720ff6b918in 1 report
- 52b242047a8055c0…acefa8ae883ain 1 report
- 4a18f65ab7de7be3…f9b7a324a6b0in 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2023-38831, CVE-2024-21412
Thanks — we review every report.