217.60.195[.]167IP address
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Fake Bank of America Phishing Scam Installs Remote Access Malware“Once ScreenConnect is installed, it connects to the suspected command-and-control (C2) server at 217.60.195[.]167 over TCP port 8041 and awaits commands from the threat actor.”
-
Bank of America Phishing Email Delivers ScreenConnect Malware“Once the ScreenConnect is installed, the target's computer opens a connection to 217.60.195[.]167 over port 8041/tcp and waits for the threat actor to connect to it.”
Indicators reported together
named in the same reports- uploadtourl[.]comin 2 reports
- bkofamerica[.]comin 2 reports
- kleinschnitg[.]comin 2 reports
- sectioncompil[.]comin 2 reports
- ealerts.bkofamerica[.]comin 1 report
- 3e404e542ae99eeb…7efb0a2dbfb8in 1 report
- f580d528759829f6…e483b239e8a4in 1 report
- 6d1dae4794a80caa…94bf2b2a3f10in 1 report
- ed9f4c15d2857260…8c296a3c66f2in 1 report
- d0913e83d10cadae…9b9c41c0f4bfin 1 report
- bd987f9f493a234a…064e09cdc0eein 1 report
- hxxps://kleinschnitg[.]com/F3bebOag/?id=emailin 1 report
- hxxps://sectioncompil[.]com/wkudpl/windows/manage.htmlin 1 report
- hxxps://sectioncompil[.]com/wkudpl/windows/download/AccountGuardSetup.zipin 1 report
- hxxps://sectioncompil[.]com/wkudpl/notarize.phpin 1 report
- hxxps://sectioncompil[.]com/wkudpl/main.phpin 1 report
- hxxps://cdn.uploadtourl[.]com/3b154d8e-61be-4521-b3c3-75efb845a2e2_msi_base64.txtin 1 report
- cdn.uploadtourl[.]comin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.