ctrlINT What the industry said about every indicator, with the quote

g[.]comDomain

Reported by 1 independent source · first reported by Huntress · last reported

Last reported 3 months ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “The threat actor then executed a tool called g[.]com and hs.com , which wrote data out to pass.txt and hash.txt, respectively, and deleted the Mimikatz kernel driver mimidrv.sys, which dumps credentials from memory.”

    HuntressVendor
    Defence Impairment Olympics

Indicators reported together

named in the same reports
Copy these 8 indicators · defanged

Also named with it: CVE-2023-26360, CVE-2023-29298, CVE-2023-29300

Thanks — we review every report.

Report a wrong value
What is wrong with g[.]com here?
No account needed. We do not store your IP address.