hxxps://beastmodser[.]club/sil/0304/d.php?na=version.gifURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Targeted APT Activity: BABYSHARK Is Out for Blood“Downloads a version.tmp file to be then moved and renamed as version.dll for the OneDrive DLL hijacking attack (hxxps://beastmodser[.]club/sil/0304/d.php?na=version.gif)”
Indicators reported together
named in the same reports- worldinfocontact[.]clubin 1 report
- wshell[.]runin 1 report
- hxxps://hodbeast[.]com/silver/upload.phpin 1 report
- hodbeast[.]comin 1 report
- hxxps://frebough[.]com/onedrive/winmm.php?op=in 1 report
- frebough[.]comin 1 report
- hxxp://beastmodser[.]club/sil/0304/VOA_Korea.docxin 1 report
- beastmodser[.]clubin 1 report
- retmodul[.]comin 1 report
- 5b31d65b0607ae3d…14d9766978eain 1 report
- c86d6e9dfc79bdf2…67b32bef3a6bin 1 report
- bf82675bac2cd574…d2666cd72f5ain 1 report
- 2ad3266331e40567…b92036c93160in 1 report
- e314b40449b7b9b8…fd84ecf17cafin 1 report
- e08fe0b287b4d112…1329389ad931in 1 report
- def0975728fc5da6…63c7830bec8din 1 report
- d41c943fd5ffacde…4bd486f182b3in 1 report
- c327631a212e4a96…78ecb0bfe66fin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.