www.president[.]mnDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Introducing the REF5961 intrusion set“Upon execution, sensitive data and files were collected from the machine and uploaded to a hard-coded Mongolian government URL (www.president[.]mn/upload.php) via cURL.”
Indicators reported together
named in the same reports- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
- paper.hosted-by-bay[.]netin 1 report
- news.hosted-by-bay[.]netin 1 report
- hosted-by-bay[.]netin 1 report
- 45.133.194[.]106in 1 report
- paypal.goodspaypal[.]comin 1 report
- d218680140ad2c6e…41c02d889a59in 1 report
- redacted[.]mnin 1 report
- shop.redacted[.]mnin 1 report
- 192.123.245[.]79in 1 report
- 09005775fc587ac7…a87561aa0b06in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.