38.146.28[.]30IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix Removes Your Background but Leaves the Malware“A session GUID 182cc082-f104-4b5f-9975-1d8f51f43d07 is generated, and the whole package is sent to the C2 endpoint at 38.146.28[.]30:22989 over a raw TCP socket using a custom binary serializer.”
Indicators reported together
named in the same reports- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- cheeshomireciple[.]comin 1 report
- hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8in 1 report
- trindastal[.]comin 1 report
- hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8in 1 report
- hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4in 1 report
- f5dbaa09e60343f2…3744e3c11febin 1 report
- bde21d8be65d31e1…fdf6c3768c92in 1 report
- ed391a16389234f9…b7d0565d7fb9in 1 report
- hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4c/in 1 report
- hxxps://obelnamevalf[.]org/OaTS7yE9zd/defaultin 1 report
- obelnamevalf[.]orgin 1 report
- hxxps://brionter[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40.binin 1 report
- brionter[.]comin 1 report
- bg-go[.]onlinein 1 report
- background-off[.]comin 1 report
- bg-ready[.]onlinein 1 report
- bg-removerok[.]onlinein 1 report
- background-ready[.]onlinein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.