hxxps://pastebin[.]com/raw/Wg8DHh2xURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 16 months ago
What the reports say
1 report, newest first · the exact sentence from each-
A Wretch Client: From ClickFix deception to information stealer deployment“…the binary as an encrypted string, and also retrieves its secondary C2 (143.110.230.167) IP from a hardcoded pastebin link hxxps://pastebin[.]com/raw/Wg8DHh2x.”
Indicators reported together
named in the same reports- 107.189.24[.]67in 1 report
- 185.156.72[.]80in 1 report
- 50.57.243[.]90in 1 report
- hxxps://clients.contology[.]com/captcha/in 1 report
- clients.contology[.]comin 1 report
- contology[.]comin 1 report
- hxxps://api.ipify[.]org/?format=jsonin 1 report
- hxxps://koonenmagaziner[.]click/counter/<IP_addressin 1 report
- koonenmagaziner[.]clickin 1 report
- hxxps://shorter[.]me/XOWyTin 1 report
- hxxps://bitly[.]cx/iddDin 1 report
- bitly[.]cxin 1 report
- 144.172.97[.]2in 1 report
- 143.110.230[.]167in 1 report
- clients.dealeronlinemarketing[.]comin 1 report
- 82cddf3a9bff315d8fc708e5f5f85f20in 1 report
- 66.63.187[.]22in 1 report
- 45.94.47[.]164in 1 report
- 84.200.17[.]129in 1 report
- 82.117.255[.]225in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.