ctrlINT What the industry said about every indicator, with the quote

twotimercvac[.]unoDomain

Reported by 1 independent source · first reported by Group-IB · last reported

Last reported 5 years ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “After launching the payload, the request was sent to the IcedID C&C server located at hxxp://twotimercvac[.]uno/.”

    Group-IBVendorC2
    Prometheus TDS

Thanks — we review every report.

Report a wrong value
What is wrong with twotimercvac[.]uno here?
No account needed. We do not store your IP address.