objshell[.]runDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Lazarus ClickFake Interview Campaign: ClickFix Malware“$s = "objShell[.]Run \"cmd /c node "”
-
Abusing Ngrok: Hackers at the End of the Tunnel“… = "powershell -windowstyle hidden C:\ProgramData\WindNT\conhost.exe start --config=C:\ProgramData\WindNT\ngrok.yml --all --region=eu"objShell[.]Run command,0Set objShell = Nothing”
Indicators reported together
named in the same reports- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- process.parent[.]pidin 1 report
- vid-crypto-assess[.]comin 1 report
- assessiohq[.]comin 1 report
- blockassess[.]comin 1 report
- blockchainjobassessment[.]comin 1 report
- blockchainjobhub[.]comin 1 report
- candidateinsightinfo[.]comin 1 report
- coinbase-walet[.]bizin 1 report
- coinbase-walet[.]mein 1 report
- competency-core[.]comin 1 report
- devchallengehq[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.