hxxp://45.74.19[.]20:49259/receiveURL
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Technical Analysis of Marco Stealer“The encrypted data, including the victim's client ID and hardware ID, is then sent to the predefined C2 endpoint (e.g., hxxp://45.74.19[.]20:49259/receive) via an HTTP POST request with HTTP User-Agent field set to DataSender.”
Indicators reported together
named in the same reports- hxxp://217.156.50[.]228:8181/nujbOqrNYyLXXLmOhPpY/PNcWncSY.exein 1 report
- 217.156.50[.]228in 1 report
- hxxps://ipinfo[.]io/ipin 1 report
- hxxps://ipinfo[.]io/countryin 1 report
- 45.74.19[.]20in 1 report
- 34deb6594098545d7ffb98844f0790bfin 1 report
- 3a3e8f6bc70748a39ffc047b3c86a665in 1 report
- 5eb91d1ad26c7eced894e34710aaa28ein 1 report
- 1042affb0ca6758ca0043112cdc7eda2in 1 report
- a98fa5fba55e470750ae74186c15fa73in 1 report
- 33dd8a5e234d911391cc8c301dc4a606in 1 report
- 49ab8d4c55b7f64eaba699ef0dc9054bin 1 report
- 661a5465d9a322276ebc414f39891a8bin 1 report
- 028604d6aa556de2ae4ca6b31e600677in 1 report
- 107.189.25[.]189in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.