hxxps://gist.github[.]com/api0cradle/d4aaef39db0d845627d819b2b6b30512URL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 22 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite“hxxps://gist.github[.]com/api0cradle/d4aaef39db0d845627d819b2b6b30512”
Indicators reported together
named in the same reports- hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/in 1 report
- www.safebreach[.]comin 1 report
- micrornetworks[.]comin 1 report
- opera-x[.]netin 1 report
- teledown-cn[.]comin 1 report
- 15af8c34e25268b7…0276700ecc39in 1 report
- accd651f58dd3f7e…aa6db4291de7in 1 report
- 7964a9f1732911e9…73011bc54210in 1 report
- ferp.googledns[.]ioin 1 report
- hk-dns.secssl[.]comin 1 report
- hk-dns.winsiked[.]comin 1 report
- hk-dns.wkossclsaleklddeff[.]isin 1 report
- hk-dns.wkossclsaleklddeff[.]ioin 1 report
- hxxps://zcgonvh[.]com/post/Advanced_Windows_Task_Scheduler_Playbook-Part.2_from_COM_to_UAC_bypass_and_get_SYSTEM_dirtectly.htmlin 1 report
- zcgonvh[.]comin 1 report
- hxxps://www.sonicwall[.]com/blog/project-androm-backdoor-trojanin 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.