193.168.143[.]196IP address
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 12 months ago
What the reports say
1 report, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Approximately six hours later, the process running Latrodectus established a connection to 193.168.143[.]196 on the beachhead host, which we suspect to have been a BackConnect C2 server.”
Indicators reported together
named in the same reports- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
- techbulldigital[.]comin 1 report
- filomeruginfor[.]comin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2020-1472
Thanks — we review every report.