185.56.83[.]82IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 2 years ago
What the reports say
3 reports, newest first · the exact sentence from each-
MSSQL to ScreenConnect“185.56.83[.]82 - Initial “C2” IP address (target for finger command)”
-
Threat Intel Accelerates Detection and Response“… “Managed Antivirus” (MAV) alert (illustrated in Figure 2) for a finger.exe command line sending a string of digits to the IP address 185.56.83[.]82, the same IP address associated with the November activity.”
-
Can’t Touch This: Data Exfiltration via Finger“In addition to the “finger” commands, the IP address 185.56.83[.]82 was also used by the threat actor in both curl.exe and PowerShell commands to download files to the endpoint and launch them.”
Indicators reported together
named in the same reports- hxxp://95.179.241[.]10:23963/Bin/ConnectWiseControl.ClientSetup.msi?e=Access&y=Guestin 1 report
- 95.179.241[.]10in 1 report
- hxxp://95.179.241[.]10:23963/Bin/ConnectWiseControl.ClientSetup.msi?e=Accessin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.