msedge[.]oneDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Unmasking a Financial Services Intrusion: REF0657“…he Cobalt Strike beacon from memory, the altered version loads a beacon in base64 format from a file named config.ini that connects to msedge[.]one.”
Indicators reported together
named in the same reports- 149.104.23[.]17in 1 report
- 206.237.3[.]150in 1 report
- 206.237.0[.]49in 1 report
- 149.104.23[.]176in 1 report
- hxxps://github[.]com/carlospolop/hacktricks/blob/master/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md#abusing-ssrf-in-aws-ec2-environmentin 1 report
- hxxps://github[.]com/tutorial0/WebShell/blob/master/Aspx/ASPXspy.aspxin 1 report
- hxxps://github[.]com/L-codes/Neo-reGeorg/blob/master/templates/tunnel.ashxin 1 report
- 104.21.54[.]126in 1 report
- bc90ef8121d20af2…00d860a0e716in 1 report
- 84b3bc58ec04ab27…7466f280e16din 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.