hxxp://sfrclak[.]com:8000/URL
Reported by 2 independent sources · first reported by Trend Micro Research · last reported
Last reported 6 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Elastic releases detections for the Axios supply chain compromise“The second stage is a PowerShell-based RAT that beacons to its C2 (hxxp://sfrclak[.]com:8000/) every 60 seconds over HTTP using a fake IE8 User-Agent and base64-encoded JSON.”
-
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads“hxxp://sfrclak[.]com:8000/”
Indicators reported together
named in the same reports- sfrclak[.]comin 2 reports
- packages.npm[.]orgin 2 reports
- 142.11.206[.]73in 2 reports
- d6f3f62fd3b9f543…fd5247d5ee71in 2 reports
- 07d889e2dadce6f3…7d28ca61c766in 2 reports
- e10b1fa84f1d6481…4d894c2e0e09in 2 reports
- ed8560c1ac7ceb69…96637d5f815cin 2 reports
- 92ff08773995ebc8…071230c9645ain 2 reports
- com[.]applein 1 report
- callnrwise[.]comin 1 report
- 2553649f23220496…d0d6adc700cain 1 report
- 591a70e8b1662658…51c5cd9b1655in 1 report
- 617b67a8e1210e4f…f583c900d101in 1 report
- f7d335205b8d7b20…f4e7d07121cdin 1 report
- fcb81618bb15edfd…02bf980375cfin 1 report
- hxxp://sfrclak[.]com:8000/6202033in 1 report
- 6483c004e2071373…ba7c3394f9d7in 1 report
- e49c2732fb986154…3a9fb75bf9ffin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.