c4089686965df5e52105b6eac06703aa11c4891695278446370f623d531b505eSHA-256 hash

Reported by 1 independent source · first reported 21 Jun 2022 by Elastic Security Labs · last reported 21 Jun 2022

Last reported 4 years ago

What the reports say

1 report, newest first · the exact sentence from each

“| ExcelMyMacros.vba SHA-256 | c4089686965df5e52105b6eac06703aa11c4891695278446370f623d531b505e |”

Elastic Security LabsVendor21 Jun 2022
Playing defense against Gamaredon Group

Indicators reported together

named in the same reports

hopto[.]orgin 1 report
pos[.]dotin 1 report
ipt[.]nein 1 report
ting[.]fiin 1 report
ns[.]nein 1 report
t[.]phin 1 report
hxxp://libcrash.ddns[.]net/ENDPOINT1_96L02G3D//posolreboot.phpin 1 report
libcrash.ddns[.]netin 1 report
bounceme[.]netin 1 report
86e0701349903105…ea1b1d7059d4in 1 report
feb0596e9735e03a…5e591a55940fin 1 report
document-out.hopto[.]orgin 1 report
141.8.195[.]60in 1 report
141.8.192[.]153in 1 report
188.225.25[.]50in 1 report
02e6e2bfaaf6e77c…bbcadd85b47din 1 report
2f310c5b16620d9f…5fab659e9fa1in 1 report
c1524a4573bc6acb…ca663b98a95fin 1 report
145a61a14ec6d32b…cdd464868eddin 1 report
beercraft[.]spacein 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

hopto[.]org
pos[.]dot
ipt[.]ne
ting[.]fi
ns[.]ne
t[.]ph
hxxp://libcrash.ddns[.]net/ENDPOINT1_96L02G3D//posolreboot.php
libcrash.ddns[.]net
bounceme[.]net
86e0701349903105b0c346df9485dd59d85dd9463c2bee46d974ea1b1d7059d4
feb0596e9735e03ae929d9b5ee862da19e16e5cdf57dd2a795205e591a55940f
document-out.hopto[.]org
141.8.195[.]60
141.8.192[.]153
188.225.25[.]50
02e6e2bfaaf6e77cfaccadaf26167135c53cf2c934d17c5a83e5bbcadd85b47d
2f310c5b16620d9f6e5d93db52607f21040b4829aa6110e22ac55fab659e9fa1
c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f
145a61a14ec6d32b105a6279cd943317b41f1d27f21ac64df61bcdd464868edd
beercraft[.]space

Thanks — we review every report.

Report a wrong value