safestaticfirefox[.]comDomain

Reported by 1 independent source · first reported 20 Dec 2019 by Group-IB · last reported 20 Dec 2019

Last reported 6 years ago

What the reports say

1 report, newest first · the exact sentence from each

“The payload is CobInt stager that will download Cobalt Strike beacon from hxxp://safestaticfirefox[.]com/uacuxuiaeoerkaryixju.”

Group-IBVendor20 Dec 2019
A Shortcut to Compromise: Cobalt Gang phishing campaign

Indicators reported together

named in the same reports

swift-customer[.]comin 1 report
e85a079f9e48216e…139677ec3c9fin 1 report
76a5a477927a4b8c…fb62afa41a98in 1 report
valorleads[.]comin 1 report
1fdc309f8ff96ebb…7a91165e0b5fin 1 report
hxxps://image.isu[.]pub/130729032316-97fbf070197fbde8e88397077c468ab6/jpg/page_1.jpgin 1 report
image.isu[.]pubin 1 report
hxxp://safestaticfirefox[.]com/uacuxuiaeoerkaryixjuin 1 report

Copy these 8 indicators · defanged

8 indicators, defanged, one per line

swift-customer[.]com
e85a079f9e48216e832c075ab1543b9999235205768ed6dc5d08139677ec3c9f
76a5a477927a4b8c1471a618a10d4baf596499daa2d8937ac5dcfb62afa41a98
valorleads[.]com
1fdc309f8ff96ebbe1cc4b825e21d6e44b606d389357abe0004e7a91165e0b5f
hxxps://image.isu[.]pub/130729032316-97fbf070197fbde8e88397077c468ab6/jpg/page_1.jpg
image.isu[.]pub
hxxp://safestaticfirefox[.]com/uacuxuiaeoerkaryixju

Thanks — we review every report.

Report a wrong value