objects[.]dataDomain
Reported by 1 independent source · first reported by Kaspersky Securelist · last reported
Last reported 3 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Operation FlashHole: Lazarus breaks security, defies control“It now reads C:\Windows\System32\wbem\Repository\OBJECTS[.]DATA and searches for keywords such as AntiVirusProduct, companyName, and displayName to identify the installed products.”
Indicators reported together
named in the same reports- hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.jsin 1 report
- javadevhouse.co[.]krin 1 report
- hxxps://pythonapischool[.]com/api/detachin 1 report
- pythonapischool[.]comin 1 report
- hxxps://cubedesign.co[.]kr/news/AABBCCin 1 report
- cubedesign.co[.]krin 1 report
- hxxps://cubedesign.co[.]kr/news/economy/article/12345678in 1 report
- msadc[.]incin 1 report
- ec84d6cb2ae7974767aedac246b50a3ein 1 report
- a28cba214058fcae2883d8cffc883abdin 1 report
- c105d6b16f544582772de0159f24c00ain 1 report
- 2f8475a90a25624ed02f1d18d4e6d65din 1 report
- 676fabe30a28b53925fba98e34b35986in 1 report
- b4a7eff35f048f06fb0a2d7631f23a7din 1 report
- ff07641dc56914dd90ee0bd7404d7ad7in 1 report
- hxxps://cubedesign.co[.]kr/newsin 1 report
- hxxps://cubedesign.co[.]kr/mobile/fashionin 1 report
- hxxps://fp-news.co[.]kr/shop/cartin 1 report
- fp-news.co[.]krin 1 report
- hxxps://k-wbc.co[.]kr/skin/social/social_view.phpin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.