ba8521ef14f1ec09f0bcb8f490e30322ca4eb84fa0013ee3bbe9c6a24866d334SHA-256 hash

Reported by 1 independent source · first reported 9 Nov 2023 by Huntress · last reported 9 Nov 2023

Last reported 2 years ago

What the reports say

1 report, newest first · the exact sentence from each

“t.zip (ba8521ef14f1ec09f0bcb8f490e30322ca4eb84fa0013ee3bbe9c6a24866d334): an archive containing three additional payloads:”

HuntressVendor9 Nov 2023
Bitter Pill

Indicators reported together

named in the same reports

hxxp://2.57.149[.]103/a.msiin 1 report
2.57.149[.]103in 1 report
45.66.230[.]146in 1 report
hxxp://119.91.138[.]133:443/test.xmlin 1 report
119.91.138[.]133in 1 report
185.12.45[.]98in 1 report
hxxps://bashupload[.]com/PXYpf/a.msiin 1 report
bashupload[.]comin 1 report
hxxp://119.91.138[.]133:9999/5E1Chin 1 report
rs.tdsclinical[.]comin 1 report
9f42bf3a61faaab8…d2386545e4e8in 1 report
70f865a7f8a01356…3610cb28fc56in 1 report
8c3b4febe58df0a0…4d94f3f657b3in 1 report
f28ee671c0f89415…529a2aae174ein 1 report
174f91806e8bc1c0…f411e8402d75in 1 report
45c8716c69f56e26…6e8997299d1ain 1 report

Copy these 16 indicators · defanged

16 indicators, defanged, one per line

hxxp://2.57.149[.]103/a.msi
2.57.149[.]103
45.66.230[.]146
hxxp://119.91.138[.]133:443/test.xml
119.91.138[.]133
185.12.45[.]98
hxxps://bashupload[.]com/PXYpf/a.msi
bashupload[.]com
hxxp://119.91.138[.]133:9999/5E1Ch
rs.tdsclinical[.]com
9f42bf3a61faaab8f86abb3c7f9db417bffb3474a55169a4efb1d2386545e4e8
70f865a7f8a01356685b17abdf6ac738e9a9098f1ae2d5a34cfa3610cb28fc56
8c3b4febe58df0a01126d78109f52035d34a4e03f02b5d4fca3e4d94f3f657b3
f28ee671c0f894154dd8c145f2b6b819b63348c785a682f60f37529a2aae174e
174f91806e8bc1c0dea24192f7d4afcefc40a1731827b32939d4f411e8402d75
45c8716c69f56e26c98369e626e0b47d7ea5e15d3fb3d97f0d5b6e8997299d1a

Also named with it: CVE-2023-27532

Thanks — we review every report.

Report a wrong value