irc[.]pidDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
LightSpy Malware Variant Targeting macOS“The macOS version of this malware makes use of a process identification number (PID) file located at /Users/Shared/irc[.]pid to verify that the implant isn’t already running.”
Indicators reported together
named in the same reports- afd03337d1500d6a…df26786ea4a4in 1 report
- 0f66a4daba647486…f8a562bc306cin 1 report
- hxxps://blogs.blackberry[.]com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-indiain 1 report
- hxxps://www.threatfabric[.]com/blogs/lightspy-mapt-mobile-payment-system-attackin 1 report
- www.threatfabric[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.