variable[.]runDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Malware Under The Microscope: Manual Analysis“set variable=createobject("wscript.shell") variable[.]run "svchost.exe /e:VBScript.Encode ""C:\security\blood.dat",false”
Indicators reported together
named in the same reports- hxxp://sauvegarde.1x[.]biz/booter.dathttp://registered.co.nf/sat39/index.phphttp://zoneh.me.pn/zoneh.dathttp://users2.Jabry.com/mysiteweb2/bump.jpghttp://newsonline.125mb.com/av.jpghttp://mysiteweb.eu5.org/system.jpghttp://mysiteweb.freezoy.com/explorer.jpghttp://babybot.125mb.com/update.jpgin 1 report
- sauvegarde.1x[.]bizin 1 report
- hxxp://users2.jabry[.]com/mysiteweb2/bump.jpgin 1 report
- users2.jabry[.]comin 1 report
- hxxp://mysiteweb.freezoy[.]com/explorer.jpgin 1 report
- mysiteweb.freezoy[.]comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.