hxxps://memshowblob[.]forum/api/index.php?a=grabURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains“The command downloads the second stage from the URL hxxps://memshowblob[.]forum/api/index.php?a=grab and executes the binary in the user's %TEMP% folder.”
Indicators reported together
named in the same reports- wblob[.]forumin 1 report
- memshowblob[.]forumin 1 report
- 580b441e2961739f…fa39ecd0c954in 1 report
- hurgadatour[.]shopin 1 report
- 03fa348b70819296…03c47995a746in 1 report
- 58aec6e3835aaf20…9bcf6cae8eedin 1 report
- cal.snehamumbai[.]orgin 1 report
- hxxps://steamcommunity[.]com//profiles/76561199705801219in 1 report
- cal.joycedoula.com[.]brin 1 report
- codebasecode[.]comin 1 report
- cee96a38e2dfe31c…22e943d242e9in 1 report
- hxxps://172.67.215[.]214/files/telemetriawork/telepuz.dllin 1 report
- 172.67.215[.]214in 1 report
- hxxps://172.67.165[.]144/files/telemetriawork/telepuz.dllin 1 report
- 172.67.165[.]144in 1 report
- bf3b4e645a3c0c23…eff68ffaf343in 1 report
- ff791fe1532a2dc3…d3c4b0d62b3ein 1 report
- a955d7e2819d5fa8…e1e7e19435e3in 1 report
- 9733a3f6409de812…fe6b312477ebin 1 report
- 444f1c0c82b3f6cc…0c2a6537efc1in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.