machine[.]networkDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH“…p memberships, privileges, running processes, hostname, network adapter configuration, and command interpreter path on the infected machine[.]Network Reconnaissancearp -aping -a [IP]nbtstat -A [IP]net view, net view \\[IP]net share, net sessionfor /L %i in (1,1,254) do @ping -n 1 -…”
Indicators reported together
named in the same reports- hxxp://ip-api[.]com/jsonin 1 report
- hxxps://api.github[.]com/repos/in 1 report
- tools[.]inin 1 report
- hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zipin 1 report
- jpg[.]cdin 1 report
- hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zipin 1 report
- hxxps://ipinfo[.]io/jsoncurlin 1 report
- hxxps://ipapi[.]co/jsonRetrievein 1 report
- indiatodays[.]orgin 1 report
- codes[.]networkin 1 report
- urltheprints[.]orgin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.