hxxps://andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/PeNoURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Inside .NET Loader Analysis: From Malspam to In-Memory Loader“Two URLs - hxxps://andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/PeNo and hxxp://catalogo.castrouria.com/c84da/bl.txt - are also passed as arguments to prFVI; they are consumed by the final .NET payload rather than fetched…”
Indicators reported together
named in the same reports- fostercareintheus.optimizationprime[.]comin 1 report
- hxxps://bth.startthewave[.]org/a/#in 1 report
- bth.startthewave[.]orgin 1 report
- hxxps://pengajian.muliastudy[.]com/images/edu/u.phpin 1 report
- pengajian.muliastudy[.]comin 1 report
- logo[.]devin 1 report
- hxxps://andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/03.txtin 1 report
- andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]brin 1 report
- hxxp://catalogo.castrouria[.]com/c84da/bl.txtin 1 report
- catalogo.castrouria[.]comin 1 report
- hxxps://andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/01.txtin 1 report
- hxxps://andrefelipedonascime1778799406970.2241107.meusitehostgator.com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/02.txtin 1 report
- d5b7247c497788cf…9816d64759b5in 1 report
- c61b1941cf756eb7…69713dfb01a6in 1 report
- c356aff1a01c2b0d…77b19f5a8c18in 1 report
- f1c3ebe78bd8c385…6160a61f5348in 1 report
- e91fb249aa97be5c…b70b7e6e74ddin 1 report
- xtadts.ddns[.]netin 1 report
- afxwd.ddns[.]netin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.