b3038101fd0e8b11c519f739f12c7e9b60234d3bSHA-1 hash
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Big airline heist“The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK’s IP address 185.118.166.66.”
Indicators reported together
named in the same reports- ns1.colunm[.]tkin 1 report
- colunm[.]tkin 1 report
- 185.118.166[.]66in 1 report
- cs.colunm[.]tkin 1 report
- ad.airindia[.]inin 1 report
- aildelccpdt011.ad.airindia[.]inin 1 report
- aildelccpdt017.ad.airindia[.]inin 1 report
- aildelccpdt018.ad.airindia[.]inin 1 report
- aasbomcgodt009.ad.airindia[.]inin 1 report
- aildelccpdt020.ad.airindia[.]inin 1 report
- aildelccpdt023.ad.airindia[.]inin 1 report
- aildelccpdt032.ad.airindia[.]inin 1 report
- aildelccpdb01.ad.airindia[.]inin 1 report
- maaaucdt614.ad.airindia[.]inin 1 report
- ailmaaaucdt614.ad.airindia[.]inin 1 report
- aildelgsddt406.ad.airindia[.]inin 1 report
- ailbomaptdt107.ad.airindia[.]inin 1 report
- trcom.ad.airindia[.]inin 1 report
- atldelgsddt027.ad.airindia[.]inin 1 report
- ailoapditdt008.ad.airindia[.]inin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.