91.194.11[.]64IP address
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 12 months ago
What the reports say
1 report, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Deobfuscating the Latrodectus malware, uncovered that it performed an HTTP request to the URL hxxp://91.194.11[.]64/MSI.msi to install the next stage, thus triggering the Suricata rule from Emerging Threats ET POLICY Observed MSI Download.”
Indicators reported together
named in the same reports- hxxp://91.194.11[.]64/MSI.msiin 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
- techbulldigital[.]comin 1 report
- filomeruginfor[.]comin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2020-1472
Thanks — we review every report.