main.test[.]nameDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Advent of Configuration Extraction, Part 2: QuasarRAT Config“stsfldStore into Static Field: Pops a value from the evaluation stack and stores it into a static field of a class.stsfld string Main.test[.]name pop the last value on the stack into Main.Test.name”
Indicators reported together
named in the same reports- instr.opcode[.]namein 1 report
- instr.operand[.]namein 1 report
- vb[.]netin 1 report
- field[.]namein 1 report
- 4ef44bf6815e7860…912c38ac9639in 1 report
- mtype[.]namein 1 report
- instr.operand.declaringtype[.]namein 1 report
- typedef[.]namein 1 report
- method[.]namein 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.