host.os[.]familyDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
3 reports, newest first · the exact sentence from each-
Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID“| where host.os[.]family == "windows" and event.category == "network" and”
-
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four“| where event.category == "file" and host.os[.]family == "windows" and event.action == "creation" and file.extension == "jpg" and file.name rlike """time_202\d{5}_\d{6}.jpg"""”
-
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies“| where host.os[.]family == "windows" and event.action == "load" and”
Indicators reported together
named in the same reports- process[.]pidin 3 reports
- logs-endpoint.events[.]networkin 1 report
- 0af76f2897158bf7…c2d4d284add5in 1 report
- remchukwugixiemu4.duckdns[.]orgin 1 report
- remchukwugix231fgh.duckdns[.]orgin 1 report
- 3e32447ea3b5f07c…39264f691587in 1 report
- 122.176.133[.]66in 1 report
- 8c9202885700b55d…cdd0e51b9f26in 1 report
- 43.230.202[.]33in 1 report
- 95dfdb588c7018ba…bea663686f30in 1 report
- 107.175.229[.]139in 1 report
- 517f65402d3cf185…5be24e18e179in 1 report
- money001.duckdns[.]orgin 1 report
- b1a149e11e9c85dd…c7d5189cfdbfin 1 report
- 104.250.180[.]178in 1 report
- ba6ee802d60277f6…77199e3a8670in 1 report
- 185.70.104[.]90in 1 report
- 77.105.132[.]70in 1 report
- hxxps://www.jaiminton[.]com/reverse-engineering/remcosin 1 report
- www.jaiminton[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.