64.235.39[.]82IP address

Reported by 1 independent source · first reported 8 Sep 2022 by Elastic Security Labs · last reported 8 Sep 2022

Last reported 4 years ago

What the reports say

1 report, newest first · the exact sentence from each

“Download URI for the next stage was found in the Target.process.Ext.memory_region.strings (hxxp://64.235.39[.]82/Agent32.bin).”

Elastic Security LabsVendor8 Sep 2022
CUBA Ransomware Campaign Analysis

Indicators reported together

named in the same reports

0f385cc69a93abea…805bdfe468a3in 1 report
33352a38454cfc24…8ec45b4d3d0ein 1 report
b495456a2239f3ba…a48746e8051fin 1 report
159.203.70[.]39in 1 report
hxxp://208.76.253[.]84in 1 report
208.76.253[.]84in 1 report
hxxp://108.170.31[.]115/add.dllin 1 report
108.170.31[.]115in 1 report
104.217.8[.]100in 1 report
193.23.244[.]244in 1 report
86.59.21[.]38in 1 report
199.58.81[.]140in 1 report
204.13.164[.]118in 1 report
194.109.206[.]212in 1 report
131.188.40[.]189in 1 report
154.35.175[.]225in 1 report
171.25.193[.]9in 1 report
128.31.0[.]34in 1 report
128.31.0[.]39in 1 report
scams[.]inin 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

0f385cc69a93abeaf84994e7887cb173e889d309a515b55b2205805bdfe468a3
33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e
b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f
159.203.70[.]39
hxxp://208.76.253[.]84
208.76.253[.]84
hxxp://108.170.31[.]115/add.dll
108.170.31[.]115
104.217.8[.]100
193.23.244[.]244
86.59.21[.]38
199.58.81[.]140
204.13.164[.]118
194.109.206[.]212
131.188.40[.]189
154.35.175[.]225
171.25.193[.]9
128.31.0[.]34
128.31.0[.]39
scams[.]in

Thanks — we review every report.

Report a wrong value