www.ndibstersoft[.]comDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 8 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites“Associated with www.ndibstersoft[.]com and observed in beacon communications from the dropped file.”
-
A New RAT and a Hands-on-Keyboard Intrusion“The C2 (www.ndibstersoft[.]com) is RC4-encrypted and hex-encoded, the decryption function hex-decodes the string, then RC4-decrypts it using a hardcoded 110-byte key.”
Indicators reported together
named in the same reports- hxxp://binclloudapp[.]com/466943in 1 report
- binclloudapp[.]comin 1 report
- 192.121.23[.]146in 1 report
- sectigoapps[.]comin 1 report
- solidclouaps[.]comin 1 report
- hxxps://marle[.]io/check/updprofile.aspxin 1 report
- marle[.]ioin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/AstarionRAT/win_mal_AstarionRAT.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/Matanbuchus/win_mal_Matanbuchus_loader.yarin 1 report
- de81e2155d797ff7…0f62663f33b3in 1 report
- 6ffae128e0dbf14c…3c66ecc1ad1fin 1 report
- 68858d3cbc9b8aba…e853a47e3e31in 1 report
- 03c624d251e9143e…048a0967a829in 1 report
- 8e54cd12591d67df…f9e3c71fb925in 1 report
- c31c8edbf94c85cc…e5406d80df12in 1 report
- eecc83add16f3d51…0afb64d1d2afin 1 report
- ea378496135318ac…37611b5099e5in 1 report
- hxxps://www.investonline[.]in/js/jq.phpin 1 report
- www.investonline[.]inin 1 report
- xmri[.]networkin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.