lin9gtmn.eccbc8[.]comDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Old Gremlins, new methods“To do so, it performs 23 DNS queries (such as 0x%chank_number%.lin9gtmn.eccbc8[.]com), concatenates the responses into a string, de-obfuscates it using the key lin9gtmn, and launches it.”
Indicators reported together
named in the same reports- mirfinance[.]orgin 1 report
- hxxps://dl.dropboxusercontent[.]com/s/1956cypkkihawuu/Anketa.docx?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/gjyjs0rbtihy7ue/Doc1.dotmin 1 report
- eccbc8[.]comin 1 report
- ns1.eccbc8[.]comin 1 report
- ns2.eccbc8[.]comin 1 report
- ns3.eccbc8[.]comin 1 report
- ns4.eccbc8[.]comin 1 report
- 46.101.113[.]161in 1 report
- 161.35.41[.]9in 1 report
- a3c65c[.]orgin 1 report
- ns1.a3c65c[.]orgin 1 report
- ns2.a3c65c[.]orgin 1 report
- ns3.a3c65c[.]orgin 1 report
- ns4.a3c65c[.]orgin 1 report
- dda9900cefa8cdc8…a6c4cfdc62b2in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/9kng4v6vuq7mq39/akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/fq8ew6gl3x46rjc/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/lf1w11jxp2z0f6s/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/hy2ub5wnns4c0fi/Akt_sverki.zip?dl=0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.