shell[.]runDomain
Reported by 2 independent sources · first reported by Fortinet Threat Research · last reported
Last reported 3 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus“shell[.]Run('"' + newName + '"', 1, false);”
-
Threat Actors Weaponize AI Hype to Deliver AsyncRAT“shell[.]Run """" & docPath & "\ResetRealtekAudioSettings64defualt.bat""", 0, False”
Indicators reported together
named in the same reports- rtkloggingmanifest[.]manin 1 report
- shampobiskworld[.]nlin 1 report
- shampoolagtto[.]comin 1 report
- shamppocosmaticso[.]comin 1 report
- 107.172.10[.]190in 1 report
- 61b7fa5a7186cbf7…1114bda2f974in 1 report
- 7d6ee3c6ff8f70b1…44743afc0cb8in 1 report
- 96b486bd7308ef3d…97b039377ecbin 1 report
- 4.4.3[.]12in 1 report
- container[.]targetin 1 report
- d1e54270433a94aa…dda69d476c3ein 1 report
- e6d8192960a89d54…b7c1f72341b6in 1 report
- 1fc23ec18a94a599…b5e7e81a6a24in 1 report
- 1a2ca8b8e0344fe3…df934ddc011fin 1 report
- 81aabf646619ea5f…b33613021bacin 1 report
- 9164054d0bf0b7c8…dd07b6bd67ecin 1 report
- 34fcbe7e90fc87a4…10d58911368bin 1 report
- 0a545dd1b703cddf…1eb837bda61bin 1 report
- 2623c6e3c1f5a7b5…0e7b096627f7in 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-8088
Thanks — we review every report.