wshell[.]runDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Targeted APT Activity: BABYSHARK Is Out for Blood“On Error Resume Next:Set wShell=CreateObject("WScript.Shell"):retu=wShell[.]run("""%userprofile%\AppData\Local\Microsoft\OneDrive\onedrive.exe"" /background",0,false)”
Indicators reported together
named in the same reports- worldinfocontact[.]clubin 1 report
- hxxps://hodbeast[.]com/silver/upload.phpin 1 report
- hodbeast[.]comin 1 report
- hxxps://frebough[.]com/onedrive/winmm.php?op=in 1 report
- frebough[.]comin 1 report
- hxxp://beastmodser[.]club/sil/0304/VOA_Korea.docxin 1 report
- beastmodser[.]clubin 1 report
- hxxps://beastmodser[.]club/sil/0304/d.php?na=version.gifin 1 report
- retmodul[.]comin 1 report
- 5b31d65b0607ae3d…14d9766978eain 1 report
- c86d6e9dfc79bdf2…67b32bef3a6bin 1 report
- bf82675bac2cd574…d2666cd72f5ain 1 report
- 2ad3266331e40567…b92036c93160in 1 report
- e314b40449b7b9b8…fd84ecf17cafin 1 report
- e08fe0b287b4d112…1329389ad931in 1 report
- def0975728fc5da6…63c7830bec8din 1 report
- d41c943fd5ffacde…4bd486f182b3in 1 report
- c327631a212e4a96…78ecb0bfe66fin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.