b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0SHA-256 hash
Reported by 1 independent source · first reported by Sophos X-Ops · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
deno-case-studies“…541d96d1d071f87127bf0714f70692d25e1946632457718c6f378fcc4a3dca2) which in turn runs “python85.ps1” (SHA256: b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0) from a subfolder “Serial” in the user’s local AppData folder via the command wscript.exe "[INSTALLFOLDER]L…”
Indicators reported together
named in the same reports- sendtokenscf[.]comin 1 report
- ypjkevsbsdhj.zhivachkapro[.]comin 1 report
- koromoblog[.]comin 1 report
- 74260ef8c4406920…d031b42890a0in 1 report
- 26b2cafb71b1407b8e01649548cf56aain 1 report
- readme-ov-filegithub[.]comin 1 report
- dl.deno[.]landin 1 report
- 2541d96d1d071f87…78fcc4a3dca2in 1 report
- data[.]cabin 1 report
- crahdhduf[.]comin 1 report
- 144.31.2[.]161in 1 report
- serialmenot[.]comin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.