hxxps://jcibj[.]com/pcl.phpURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
How a Tax Search Leads to Kernel-Mode AV/EDR Kill“This PHP script uses character code obfuscation to hide its URL hxxps://jcibj[.]com/pcl.php.”
Indicators reported together
named in the same reports- anukitax[.]comin 1 report
- bringetax[.]comin 1 report
- grinvan[.]comin 1 report
- rpc.adspect[.]netin 1 report
- window[.]topin 1 report
- jcibj[.]comin 1 report
- bjtrck[.]comin 1 report
- cdn.justcloakit[.]comin 1 report
- client.justcloakit[.]comin 1 report
- 192.175.104[.]189in 1 report
- gripsmonga[.]sbsin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/FatMalloc/win_mal_fatmalloc.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/FatMalloc/HwAudKiller.yarin 1 report
- fioclouder[.]comin 1 report
- friugrime[.]comin 1 report
- 8a4033425d36cd99…42fbbe4c5531in 1 report
- 7509365935fc1bfa…45116106e026in 1 report
- 2b409a265f571dcc…dc5b0891da04in 1 report
- 0821661e715fe64b…9bf04cea8524in 1 report
- 033f42102362a8d8…46cbbeb59b99in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.