largeroofs[.]topDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
PolarEdge: Unveiling an uncovered ORB network“The domain name of this server is also stored in an XOR-encrypted form and corresponds to hxxps://largeroofs[.]top:58425 The malware transmits this information to the reporting server, enabling the attacker to determine which device was infected through the IP address/port pairing.”
Indicators reported together
named in the same reports- 45.77.152[.]227in 1 report
- 119.8.186[.]227in 1 report
- eda7cc5e1781c681…3b1a043cbba8in 1 report
- 80cbc316aa58f8be…de4bcd98173ein 1 report
- hxxps://195.123.212[.]54:58425/cCq65x?ip=in 1 report
- 195.123.212[.]54in 1 report
- hxxps://largeroofs[.]top:58425in 1 report
- 13cd040a7f488e93…476f5d620d13in 1 report
- hxxps://asustordownload[.]com:45674in 1 report
- asustordownload[.]comin 1 report
- 464f29d5f496b4ac…2339d6946bcdin 1 report
- hxxps://siotherlentsearsitech[.]shop:58425in 1 report
- siotherlentsearsitech[.]shopin 1 report
- 932b2545bd6e3ad7…04ab084824d5in 1 report
- hxxps://122.8.183[.]181:59711in 1 report
- 122.8.183[.]181in 1 report
- hxxps://ssofhoseuegsgrfnu[.]ru/inet_ptonin 1 report
- ssofhoseuegsgrfnu[.]ruin 1 report
- 121969d72f8e6f09…336dff15b6efin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2023-20118
Thanks — we review every report.