9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450SHA-256 hash
Reported by 1 independent source · first reported by Google Threat Intelligence · last reported
Last reported 9 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Investigating Ephemeral Supply Chain Tampering“The primary Stage-2 downloader (upgrade-now.exe, SHA256: 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450) is a 64-bit Windows executable written in C, tracked by GTIG as the CROSSROAD malware family.”
Indicators reported together
named in the same reports- checkip.amazonaws[.]comin 1 report
- 8.210.84[.]56in 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/down_html.iniin 1 report
- www2.aomeisoftware[.]comin 1 report
- hxxps://account.aomeitech[.]com/Notifycfg.iniin 1 report
- account.aomeitech[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/upgrade-now.zipin 1 report
- hxxps://promotion.storage-data[.]com/download/abpopup/upgrade-now.zipin 1 report
- promotion.storage-data[.]comin 1 report
- ee89c99f3753231771170f5d9cbbae1ein 1 report
- 31323e7e738230fa6a8deef2b7894666in 1 report
- d2f9ef2429312667…42f75a1c5934in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.